Improve workshop consistency and navigation
Align challenge numbering and cross-page links, and clarify Backend C/TLS guidance so participants always see valid routes and safer cert mounting defaults.
This commit is contained in:
hkoeck
+13
-11
@@ -172,6 +172,7 @@
|
||||
<a class="pill" href="/solutions.html">Solutions</a>
|
||||
<a class="pill" href="/service/a">Backend A</a>
|
||||
<a class="pill" href="/service/b">Backend B</a>
|
||||
<a class="pill" href="/challenges.html#challenge-2-backend-c">Backend C (ab C2)</a>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
@@ -199,7 +200,7 @@
|
||||
curl http://localhost:8080/service/b</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<details id="challenge-2-backend-c">
|
||||
<summary><span class="badge easy">Easy</span> 2) backend-c hinzufuegen</summary>
|
||||
<p><span class="kw">Muss:</span> Compose-Service + Upstream + Route <code>/service/c</code>.</p>
|
||||
<p><span class="kw">Zusatz:</span> <code>backends/c/index.html</code> ist vorhanden und darf angepasst werden.</p>
|
||||
@@ -246,7 +247,7 @@ curl http://localhost:8080/service/b</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6a) Load Balancing</summary>
|
||||
<summary><span class="badge medium">Medium</span> 7) Load Balancing</summary>
|
||||
<p>Zweite Instanz von Backend A (<code>backend-a2</code>) einbauen und Round-Robin zeigen.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Lastverteilung ist Kernnutzen eines Reverse Proxys fuer Skalierung und Verfuegbarkeit.</p>
|
||||
<pre><code>for i in $(seq 1 8); do
|
||||
@@ -255,17 +256,18 @@ done</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6b) Response Header Minimization</summary>
|
||||
<summary><span class="badge medium">Medium</span> 8) Response Header Minimization</summary>
|
||||
<p>Mindestens einen Backend-Response-Header per <code>proxy_hide_header</code> ausblenden.</p>
|
||||
<p><span class="kw">Abgrenzung zu #4:</span> #4 setzt Schutz-Header, #6b entfernt unnoetige Header aus Upstream-Responses.</p>
|
||||
<p><span class="kw">Abgrenzung zu #4:</span> #4 setzt Schutz-Header, #8 entfernt unnoetige Header aus Upstream-Responses.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Weniger preisgegebene Metadaten erschweren Fingerprinting und zielgerichtete Angriffe.</p>
|
||||
<pre><code>curl -I http://localhost:8080/service/a</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6c) Debugging Challenge</summary>
|
||||
<summary><span class="badge medium">Medium</span> 9) Debugging Challenge</summary>
|
||||
<p>Mit <code>proxy/nginx.broken.conf</code> arbeiten, Fehler finden und reparieren.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> In der Praxis geht es oft um Diagnose unter Zeitdruck, nicht nur um Greenfield-Konfiguration.</p>
|
||||
<p><span class="kw">Typische Fehler in der kaputten Datei:</span> Upstream-Name-Mismatch, falscher Port, fehlender Trailing Slash in <code>proxy_pass</code>.</p>
|
||||
<pre><code>curl http://localhost:8080/service/a
|
||||
curl http://localhost:8080/service/b
|
||||
./scripts/compose.sh logs reverse-proxy</code></pre>
|
||||
@@ -276,22 +278,22 @@ curl http://localhost:8080/service/b
|
||||
<h2>Hard (TLS)</h2>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 7) HTTPS von 0 (Easy-RSA)</summary>
|
||||
<summary><span class="badge hard">Hard</span> 10) HTTPS von 0 (Easy-RSA)</summary>
|
||||
<p>Zertifikat fuer <code>localhost</code>, Port <code>8443:443</code>, Root-CA importiert.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> TLS-Grundaufbau ist Voraussetzung fuer vertrauliche und manipulationssichere Kommunikation.</p>
|
||||
<pre><code>curl https://localhost:8443/service/a</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 8) HTTP -> HTTPS Redirect</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 abgeschlossen. Bestehende Config weiterverwenden.</p>
|
||||
<summary><span class="badge hard">Hard</span> 11) HTTP -> HTTPS Redirect</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 10 abgeschlossen. Bestehende Config weiterverwenden.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Redirect verhindert unabsichtliche Klartext-Nutzung und erzwingt den sicheren Transport.</p>
|
||||
<pre><code>curl -I http://localhost:8080/service/a</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 9) TLS Haertung + Chain + HSTS</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 und 8 abgeschlossen. Gleiche Config weiter erweitern.</p>
|
||||
<summary><span class="badge hard">Hard</span> 12) TLS Haertung + Chain + HSTS</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 10 und 11 abgeschlossen. Gleiche Config weiter erweitern.</p>
|
||||
<p><span class="kw">Warum wichtig:</span> Erst Haertung + HSTS reduzieren Downgrade-Risiken und sorgen fuer dauerhaft sichere Clients.</p>
|
||||
<pre><code>curl -I https://localhost:8443/service/a
|
||||
openssl s_client -connect localhost:8443 -servername localhost</code></pre>
|
||||
@@ -302,7 +304,7 @@ openssl s_client -connect localhost:8443 -servername localhost</code></pre>
|
||||
<h2>Bonus Expert</h2>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge expert">Expert</span> 10) Wireshark: HTTP vs HTTPS sauber ausarbeiten</summary>
|
||||
<summary><span class="badge expert">Expert</span> 13) Wireshark: HTTP vs HTTPS sauber ausarbeiten</summary>
|
||||
<p><span class="kw">Warum wichtig:</span> Sichtbarkeit auf Paketebene macht den Sicherheitsgewinn von TLS fuer alle nachvollziehbar.</p>
|
||||
<ol>
|
||||
<li>HTTP auf <code>8080</code> mitschneiden und Klartext zeigen.</li>
|
||||
|
||||
@@ -134,6 +134,7 @@
|
||||
<a class="pill" href="/solutions.html">Solutions</a>
|
||||
<a class="pill" href="/service/a">Backend A</a>
|
||||
<a class="pill" href="/service/b">Backend B</a>
|
||||
<a class="pill" href="/challenges.html#challenge-2-backend-c">Backend C (ab C2)</a>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
@@ -173,6 +174,7 @@ cd certs/easyrsa
|
||||
./easyrsa build-ca nopass
|
||||
./easyrsa gen-req localhost nopass
|
||||
./easyrsa sign-req server localhost</code></pre>
|
||||
<p>Nur Runtime-Certs mounten (z. B. <code>certs/live</code>), nicht die komplette PKI.</p>
|
||||
</article>
|
||||
<article class="card">
|
||||
<h3>Fedora CA Import</h3>
|
||||
|
||||
@@ -114,6 +114,7 @@
|
||||
<a class="pill" href="/solutions.html">Solutions</a>
|
||||
<a class="pill" href="/service/a">Backend A</a>
|
||||
<a class="pill" href="/service/b">Backend B</a>
|
||||
<a class="pill" href="/challenges.html#challenge-2-backend-c">Backend C (ab C2)</a>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
|
||||
+25
-13
@@ -173,6 +173,7 @@
|
||||
<a class="pill" href="/solutions.html">Solutions</a>
|
||||
<a class="pill" href="/service/a">Backend A</a>
|
||||
<a class="pill" href="/service/b">Backend B</a>
|
||||
<a class="pill" href="/challenges.html#challenge-2-backend-c">Backend C (ab C2)</a>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
@@ -272,7 +273,7 @@ access_log /var/log/nginx/access.log workshop;</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6a) Load Balancing</summary>
|
||||
<summary><span class="badge medium">Medium</span> 7) Load Balancing</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>docker-compose.yml</code>, <code>proxy/nginx.conf</code>, <code>backends/a2/index.html</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<p><span class="kw">Compose (backend-a2):</span></p>
|
||||
@@ -293,10 +294,10 @@ done</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6b) Response Header Minimization</summary>
|
||||
<summary><span class="badge medium">Medium</span> 8) Response Header Minimization</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<p><span class="kw">Abgrenzung zu #4:</span> #4 fuegt Schutz-Header hinzu, #6b entfernt unnoetige Upstream-Metadaten.</p>
|
||||
<p><span class="kw">Abgrenzung zu #4:</span> #4 fuegt Schutz-Header hinzu, #8 entfernt unnoetige Upstream-Metadaten.</p>
|
||||
<pre><code>location /service/a {
|
||||
proxy_pass http://backend_a/;
|
||||
proxy_hide_header ETag;
|
||||
@@ -306,14 +307,23 @@ done</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6c) Debugging Challenge</summary>
|
||||
<summary><span class="badge medium">Medium</span> 9) Debugging Challenge</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.broken.conf</code>, <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<p>Kopiere testweise <code>proxy/nginx.broken.conf</code> auf <code>proxy/nginx.conf</code>, behebe die Fehler und stelle danach die funktionierende Konfiguration wieder her.</p>
|
||||
<p><span class="kw">Ablauf:</span> Kopiere testweise <code>proxy/nginx.broken.conf</code> auf <code>proxy/nginx.conf</code>, behebe die Fehler und stelle danach die funktionierende Konfiguration wieder her.</p>
|
||||
<pre><code>cp proxy/nginx.broken.conf proxy/nginx.conf
|
||||
make proxy-reload
|
||||
./scripts/compose.sh logs reverse-proxy</code></pre>
|
||||
<p><span class="kw">Konkrete Fehler und Fixes:</span></p>
|
||||
<ol>
|
||||
<li><span class="kw">Upstream-Mismatch:</span> <code>backend_a_typo</code> ist definiert, aber <code>backend_a</code> wird referenziert -> Namen angleichen.</li>
|
||||
<li><span class="kw">Falscher Port:</span> <code>backend-a:8080</code> -> auf <code>backend-a:80</code> korrigieren.</li>
|
||||
<li><span class="kw">Pfadfehler:</span> in <code>/service/b</code> fehlt der Trailing Slash bei <code>proxy_pass</code> -> <code>proxy_pass http://backend_b/;</code>.</li>
|
||||
</ol>
|
||||
<p><span class="kw">Check:</span> beide Routen funktionieren wieder.</p>
|
||||
<pre><code>curl http://localhost:8080/service/a
|
||||
curl http://localhost:8080/service/b
|
||||
./scripts/compose.sh logs reverse-proxy</code></pre>
|
||||
</details>
|
||||
</section>
|
||||
|
||||
@@ -321,7 +331,7 @@ make proxy-reload
|
||||
<h2>Hard (TLS) - Musterloesungen</h2>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 7) HTTPS mit Easy-RSA</summary>
|
||||
<summary><span class="badge hard">Hard</span> 10) HTTPS mit Easy-RSA</summary>
|
||||
<p><span class="kw">Dateien:</span> <code>docker-compose.yml</code>, <code>proxy/nginx.conf</code>, <code>certs/easyrsa/*</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>mkdir -p certs/easyrsa
|
||||
@@ -337,13 +347,15 @@ cd certs/easyrsa
|
||||
- "8080:80"
|
||||
- "8443:443"
|
||||
volumes:
|
||||
- ./certs/easyrsa/pki:/etc/nginx/pki:ro,z</code></pre>
|
||||
- ./certs/live:/etc/nginx/certs:ro,z</code></pre>
|
||||
<p><span class="kw">Wichtig:</span> Nicht die komplette PKI in den Container mounten. Nur Runtime-Zertifikat + Key bereitstellen.</p>
|
||||
<p><span class="kw">Nginx TLS-Pfade:</span> <code>ssl_certificate /etc/nginx/certs/localhost.crt;</code> und <code>ssl_certificate_key /etc/nginx/certs/localhost.key;</code></p>
|
||||
<p><span class="kw">Check:</span> <code>curl https://localhost:8443/service/a</code> (ohne <code>-k</code> nach CA-Import)</p>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 8) HTTP -> HTTPS Redirect</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 abgeschlossen (gleiches Config-File weiterverwenden).</p>
|
||||
<summary><span class="badge hard">Hard</span> 11) HTTP -> HTTPS Redirect</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 10 abgeschlossen (gleiches Config-File weiterverwenden).</p>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>server {
|
||||
@@ -363,8 +375,8 @@ cd certs/easyrsa
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 9) TLS Haertung + HSTS</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 und 8 abgeschlossen.</p>
|
||||
<summary><span class="badge hard">Hard</span> 12) TLS Haertung + HSTS</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 10 und 11 abgeschlossen.</p>
|
||||
<p><span class="kw">Dateien:</span> <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<pre><code>ssl_protocols TLSv1.2 TLSv1.3;
|
||||
@@ -381,7 +393,7 @@ openssl s_client -connect localhost:8443 -servername localhost</code></pre>
|
||||
<h2>Bonus Expert - Wireshark (ausformulierte Referenzloesung)</h2>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge expert">Expert</span> 10) HTTP vs HTTPS sauber analysieren</summary>
|
||||
<summary><span class="badge expert">Expert</span> 13) HTTP vs HTTPS sauber analysieren</summary>
|
||||
<p><span class="kw">Dateien:</span> keine Pflicht-Datei; optional Wireshark Settings und Keylog-Datei</p>
|
||||
<p><span class="kw">Commands noetig:</span> ja</p>
|
||||
<p><span class="kw">Schritt 1 - HTTP Capture:</span></p>
|
||||
@@ -394,7 +406,7 @@ openssl s_client -connect localhost:8443 -servername localhost</code></pre>
|
||||
|
||||
<p><span class="kw">Schritt 2 - HTTPS Capture:</span></p>
|
||||
<ol>
|
||||
<li>HTTPS muss vorher laufen (Challenge 7).</li>
|
||||
<li>HTTPS muss vorher laufen (Challenge 10).</li>
|
||||
<li>Filter auf <code>tcp.port == 8443</code> oder <code>tls</code> setzen.</li>
|
||||
<li>Request senden: <code>curl https://localhost:8443/service/a</code>.</li>
|
||||
<li>Pakete markieren: <code>ClientHello</code>, <code>ServerHello</code>, <code>Certificate</code>.</li>
|
||||
|
||||
@@ -34,8 +34,8 @@ http {
|
||||
listen 443 ssl;
|
||||
server_name localhost;
|
||||
|
||||
ssl_certificate /etc/nginx/pki/issued/localhost.crt;
|
||||
ssl_certificate_key /etc/nginx/pki/private/localhost.key;
|
||||
ssl_certificate /etc/nginx/certs/localhost.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/localhost.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
|
||||
Reference in New Issue
Block a user