MISP
/
misp-docker
mirror of https://github.com/MISP/misp-docker
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #107 from drcursor/addcertauth 

Add required parameters for cert authentication
pull/1/head
Jason Kendall 2021-04-19 10:37:47 -04:00 committed by GitHub
parent 9c705163b9 42a936b3d4
commit df3b7efeb1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
README.md
View File

@ -64,6 +64,7 @@ Updating the images should be as simple as `docker-compose pull` which, unless c
- Directory volume mount SSL Certs `./ssl`: `/etc/ssl/certs` - Directory volume mount SSL Certs `./ssl`: `/etc/ssl/certs`
- Certificate File: `cert.pem` - Certificate File: `cert.pem`
- Certificate Key File: `key.pem` - Certificate Key File: `key.pem`
- CA File for Cert Authentication (optional) `ca.pem`
- Directory volume mount and create configs: `/var/www/MISP/app/Config/` - Directory volume mount and create configs: `/var/www/MISP/app/Config/`

1
docker-compose.yml
View File

@ -50,6 +50,7 @@ services:
# Optional Settings # Optional Settings
# - "NOREDIR=true" # Do not redirect port 80 # - "NOREDIR=true" # Do not redirect port 80
# - "DISIPV6=true" # Disable IPV6 in nginx # - "DISIPV6=true" # Disable IPV6 in nginx
# - "CERTAUTH=optional" # Can be set to optional or on - Step 2 of https://github.com/MISP/MISP/tree/2.4/app/Plugin/CertAuth is still required
# - "SECURESSL=true" # Enable higher security SSL in nginx # - "SECURESSL=true" # Enable higher security SSL in nginx
# - "MISP_MODULES_FQDN=http://misp-modules" # Set the MISP Modules FQDN, used for Enrichment_services_url/Import_services_url/Export_services_url # - "MISP_MODULES_FQDN=http://misp-modules" # Set the MISP Modules FQDN, used for Enrichment_services_url/Import_services_url/Export_services_url
misp-modules: misp-modules:

11
server/files/entrypoint_nginx.sh
View File

@ -169,6 +169,17 @@ if [[ ! "$SECURESSL" == true && ! -f /etc/nginx/certs/dhparams.pem ]]; then
openssl dhparam -out /etc/nginx/certs/dhparams.pem 2048 openssl dhparam -out /etc/nginx/certs/dhparams.pem 2048
fi fi
if [[ $CERTAUTH = @(optional|on) ]]; then
echo "Configure NGINX | Enabling SSL Cert Authentication"
grep -qF "fastcgi_param SSL_CLIENT_I_DN \$ssl_client_i_dn;" /etc/nginx/snippets/fastcgi-php.conf || echo "fastcgi_param SSL_CLIENT_I_DN \$ssl_client_i_dn;" >> /etc/nginx/snippets/fastcgi-php.conf
grep -qF "fastcgi_param SSL_CLIENT_S_DN \$ssl_client_s_dn;" /etc/nginx/snippets/fastcgi-php.conf || echo "fastcgi_param SSL_CLIENT_S_DN \$ssl_client_s_dn;" >> /etc/nginx/snippets/fastcgi-php.conf
grep -qF 'ssl_client_certificate' /etc/nginx/sites-enabled/misp || sed -i '/ssl_prefer_server_ciphers/a \\ ssl_client_certificate /etc/nginx/certs/ca.pem;' /etc/nginx/sites-enabled/misp
grep -qF 'ssl_verify_client' /etc/nginx/sites-enabled/misp || sed -i "/ssl_prefer_server_ciphers/a \\ ssl_verify_client $CERTAUTH;" /etc/nginx/sites-enabled/misp
echo "Configure bootstrap | Enabling Cert Auth Plugin - Don't forget to configure it https://github.com/MISP/MISP/tree/2.4/app/Plugin/CertAuth (Step 2)"
sed -i "s/\/\/ CakePlugin::load('CertAuth');/CakePlugin::load('CertAuth');/" $MISP_APP_CONFIG_PATH/bootstrap.php
fi
if [[ "$DISIPV6" == true ]]; then if [[ "$DISIPV6" == true ]]; then
echo "Configure NGINX | Disabling IPv6" echo "Configure NGINX | Disabling IPv6"
sed -i "s/listen \[\:\:\]/\#listen \[\:\:\]/" /etc/nginx/sites-enabled/misp80 sed -i "s/listen \[\:\:\]/\#listen \[\:\:\]/" /etc/nginx/sites-enabled/misp80