diff --git a/README.md b/README.md index 38df89a..f8f40ed 100755 --- a/README.md +++ b/README.md @@ -10,30 +10,28 @@ Sacrificial VM provides infrastructure for containers. ### Ports -SSH: -- Gateway VM SSH Honeypot: `2222`, `22` -- Gateway VM SSHD: `2333` -- Other VMs SSHD: `22` - -Audit: +Gateway VM: +- Honeypot gateway: `22`, `2222` (`2222` is redirected to `22`) +- SSH: `2333` +- cAdvisor: `8088` +- Node Exporter: `9100` +- ContainerSSH auth-config server: `8080` +- ContainerSSH metrics server(TBD): `9101` +Logger VM: +- SSH: `22` +- cAdvisor: `8088` +- Node Exporter: `9100` - MinIO server: `9000` - MinIO Console: `9090` - -Monitoring - - Grafana: `3000` - Prometheus: `9091` -Services: - -- Auth-Config: `8080` -- containerSSH Audit-logs: `9101` - -Utilities: - +Sacrificial VM: +- SSH: `22` - cAdvisor: `8088` -- Node exporter: `9100` +- Node Exporter: `9100` +- Dockerd over TLS: `2376` ## Setting up the service on GCP diff --git a/diagrams/infra.drawio.svg b/diagrams/infra.drawio.svg index 5cdf7e8..a6d537f 100644 --- a/diagrams/infra.drawio.svg +++ b/diagrams/infra.drawio.svg @@ -1,11 +1,11 @@ - + - + -
+
Gateway Subnet @@ -15,18 +15,18 @@
- + Gateway Subnet... - - - + + + -
+
@@ -50,16 +50,16 @@
- + Gateway VM... - + -
+
@@ -71,7 +71,7 @@
- + Honeypot Subnet... @@ -96,7 +96,7 @@ - + @@ -122,8 +122,8 @@ - - + + @@ -132,7 +132,7 @@
- Prometheus: + Prometheus
@@ -146,7 +146,7 @@
- Prometheus:... + Prometheus... @@ -190,7 +190,7 @@ -
+
@@ -240,12 +240,12 @@ - - + + -
+
@@ -262,23 +262,26 @@ - + -
+
-
- ContainerSSH -
-
+ ContainerSSH gateway +
+ + + :22 + +
- - ContainerSSH + + ContainerSSH gateway... @@ -315,35 +318,6 @@ - - - - - -
-
-
-
- - Monitor -
- -
-
- - <logger-vm>:3000 - -
-
-
-
-
- - - Monitor... - - - @@ -369,13 +343,13 @@ - - - + + + -
+
@@ -391,64 +365,34 @@
- + Sacrificial VM... - + -
-
-
- honeypot -
-
-
- - - honeypot - - - - - - - -
-
-
- honeypot -
-
-
- - - honeypot - - - - - - - -
+
- containerssh: + Docker daemon
- guest-image + + + :2376 + +
- - containerssh:... + + Docker daemon... @@ -518,13 +462,71 @@ - + + + + + +
+
+
+ honeypot +
+ containers +
+
+
+ + + honeypot... + + + + + + + +
+
+
+ honeypot +
+ containers +
+
+
+ + + honeypot... + + + + + + + +
+
+
+ honeypot +
+ containers +
+
+
+ + + honeypot... + + + +
-
+
Work in Progress
@@ -535,14 +537,14 @@ - - + +
-
+
container's metrics
@@ -553,13 +555,13 @@ - +
-
+
cAdvisor @@ -586,17 +588,15 @@ - - - + -
+
-
+
- Grafana: + Grafana
@@ -610,53 +610,20 @@
- - Grafana:... - - - - - - - -
-
-
-
- - - auth-config - - -
- - -
-
- - - :8080 - - -
-
-
-
- - - auth-config... + + Grafana... - - - + + +
-
+
node_exporter @@ -683,15 +650,15 @@ - - - + + +
-
+
cAdvisor @@ -718,12 +685,50 @@ - - - - - - + + + + + + + + + +
+
+
+ TLS +
+
+
+ + + TLS + + + + + + + + + + + + +
+
+
+ Admin +
+
+
+ + + Admin + + + diff --git a/terraform/README.md b/terraform/README.md index b0508cf..9bf3731 100755 --- a/terraform/README.md +++ b/terraform/README.md @@ -76,10 +76,13 @@ You should be able to log in with any password. ```bash # Gateway VM -gcloud compute ssh gateway-vm --zone=europe-west3-c --ssh-flag="-p 2333" +gcloud compute ssh root@gateway-vm --zone=europe-west3-c --ssh-flag="-p 2333" -# Other VM -gcp compute ssh --zone=europe-west3-c +# Logger VM +gcloud compute ssh root@logger-vm --zone=europe-west3-c + +# Sacrificial VM +gcloud compute ssh root@sacrificial-vm --zone=europe-west3-c ``` #### Managing MinIO with MinIO Client `mc` diff --git a/terraform/firewall_rules.tf b/terraform/firewall_rules.tf index 2f1ae2c..2f25fb5 100644 --- a/terraform/firewall_rules.tf +++ b/terraform/firewall_rules.tf @@ -1,93 +1,112 @@ -resource "google_compute_firewall" "containerssh_allow_all" { - name = "containerssh-allow-all" - network = google_compute_network.main.self_link +# Firewall rules naming convention: +# "action_source_to_destination_service/port" - allow { - protocol = "icmp" +locals { + ports = { + cadvisor = "8088" + node_exporter = "9100" + prometheus = "9091" + minio_server = "9000" + minio_console = "9090" + grafana = "3000" + docker_tls = "2376" } +} + +resource "google_compute_firewall" "allow_all_to_network_icmp" { + name = "allow-all-to-network-icmp" + network = google_compute_network.main.self_link allow { - protocol = "udp" - ports = ["0-65535"] + protocol = "icmp" } + source_ranges = ["0.0.0.0/0"] +} + +resource "google_compute_firewall" "allow_all_to_network_ssh" { + name = "allow-all-to-network-ssh" + network = google_compute_network.main.self_link allow { protocol = "tcp" - ports = ["0-65535"] + ports = ["22"] } source_ranges = ["0.0.0.0/0"] } -resource "google_compute_firewall" "containerssh_allow_ssh" { - name = "containerssh-allow-ssh" - network = google_compute_network.main.self_link - +resource "google_compute_firewall" "allow_all_to_gateway_vm_2333" { + name = "allow-all-to-gateway-vm-2333" + description = "Allow access to Gateway VM's SSH server on port 2333" + network = google_compute_network.main.self_link allow { - protocol = "icmp" + protocol = "tcp" + ports = ["2333"] } + source_ranges = ["0.0.0.0/0"] + target_tags = ["gateway"] +} +resource "google_compute_firewall" "allow_all_to_logger_vm_grafana" { + name = "allow-all-to-logger-vm-grafana" + network = google_compute_network.main.self_link allow { protocol = "tcp" - ports = ["22"] + ports = [local.ports.grafana] } - source_ranges = ["0.0.0.0/0"] + target_tags = ["logger"] } -# open port 3000 for Grafana, 9000 and 9090 for MinIO on our logger-vm -resource "google_compute_firewall" "firewall_logger_view" { - name = "firewall-logger-view" +resource "google_compute_firewall" "allow_all_to_logger_vm_minio" { + name = "allow-all-to-logger-vm-minio" network = google_compute_network.main.self_link allow { protocol = "tcp" - ports = ["3000", "9000", "9090"] + ports = [ + local.ports.minio_console, + local.ports.minio_server + ] } - target_tags = ["observer"] source_ranges = ["0.0.0.0/0"] + target_tags = ["logger"] } -# open gateway-port 9100 and 9101, to our prometheus and metrics server -resource "google_compute_firewall" "firewall_gateway_nodeexport" { - name = "firewall-gateway-nodeexport" +resource "google_compute_firewall" "allow_all_to_logger_vm_prometheus" { + name = "allow-all-to-logger-vm-prometheus" network = google_compute_network.main.self_link - allow { protocol = "tcp" - ports = ["8088", "9100", "9101"] + ports = [ + local.ports.prometheus + ] } - - target_tags = ["gateway"] - source_tags = ["observer"] + source_ranges = ["0.0.0.0/0"] + target_tags = ["logger"] } -# allow inbound connection on TCP port 2376 from gateway -resource "google_compute_firewall" "firewall_sacrificial_exception" { - name = "firewall-sacrificial-exception" - network = google_compute_network.main.name - priority = 500 - source_tags = ["gateway"] - target_tags = ["sacrificial"] +resource "google_compute_firewall" "allow_logger_vm_to_network_cadvisor" { + name = "allow-logger-vm-to-network-cadvisor" + network = google_compute_network.main.self_link allow { protocol = "tcp" - ports = ["2376"] + ports = [local.ports.cadvisor] } + source_tags = ["logger"] } -# open sacrificial-port 8088 for cadvisor and 9100 for node-exporter -resource "google_compute_firewall" "firewall_sacrificial_nodeexport" { - name = "firewall-sacrificial-nodeexport" +resource "google_compute_firewall" "allow_logger_vm_to_network_node_exporter" { + name = "allow-logger-vm-to-network-node-exporter" network = google_compute_network.main.self_link allow { protocol = "tcp" - ports = ["8088", "9100"] + ports = [local.ports.node_exporter] } - target_tags = ["sacrificial"] - source_tags = ["observer"] + source_tags = ["logger"] } -# close all outgoing connection from sacrificial host -resource "google_compute_firewall" "firewall_sacrificial_no_egress" { - name = "firewall-sacrificial-no-egress" +resource "google_compute_firewall" "deny_sacrificial_vm_to_all" { + name = "deny-sacrificial-vm-to-all" + description = "Deny all outgoing connection from sacrificial host" network = google_compute_network.main.name direction = "EGRESS" destination_ranges = ["0.0.0.0/0"] @@ -96,3 +115,14 @@ resource "google_compute_firewall" "firewall_sacrificial_no_egress" { protocol = "all" } } + +resource "google_compute_firewall" "allow_gateway_vm_to_sacrificial_vm_docker_tls" { + name = "allow-gateway-vm-to-sacrificial-vm-docker-tls" + network = google_compute_network.main.name + allow { + protocol = "tcp" + ports = [local.ports.docker_tls] + } + source_tags = ["gateway"] + target_tags = ["sacrificial"] +} diff --git a/terraform/instances.tf b/terraform/instances.tf index b77f58e..959a557 100644 --- a/terraform/instances.tf +++ b/terraform/instances.tf @@ -62,7 +62,7 @@ resource "google_compute_instance" "sacrificial_vm" { resource "google_compute_instance" "logger_vm" { name = "logger-vm" machine_type = var.machine_type - tags = ["observer"] + tags = ["logger"] boot_disk { initialize_params {