Initialize reverse proxy and TLS workshop lab setup
This commit is contained in:
hkoeck
@@ -0,0 +1,229 @@
|
||||
# Workshop Challenges (Reverse Proxy + TLS Focus)
|
||||
|
||||
Diese Aufgaben sind auf **manuelle Proxy-Konfiguration** ausgelegt.
|
||||
|
||||
Abgabe pro Aufgabe:
|
||||
|
||||
- kurzer Demo-Run (1-3 Minuten)
|
||||
- Done-Check Command
|
||||
- 2-3 Saetze: Was wurde geaendert und warum?
|
||||
|
||||
## Arbeitsmodus
|
||||
|
||||
1. Datei anpassen (`proxy/nginx.conf`, `docker-compose.yml`).
|
||||
2. Deployen mit `make redeploy` oder `make proxy-reload`.
|
||||
3. Testen mit `curl`/`openssl`.
|
||||
4. Wenn etwas kaputt ist: `./scripts/compose.sh logs reverse-proxy`.
|
||||
|
||||
---
|
||||
|
||||
## Easy
|
||||
|
||||
### 1) Routing verstehen
|
||||
|
||||
**Ziel**
|
||||
- Reverse Proxy leitet Requests auf unterschiedliche Backends.
|
||||
|
||||
**Muss**
|
||||
- `service/a` und `service/b` aufrufen.
|
||||
- Unterschiede in den Antworten erklaeren.
|
||||
|
||||
**Done-Check**
|
||||
```bash
|
||||
curl http://localhost:8080/service/a
|
||||
curl http://localhost:8080/service/b
|
||||
```
|
||||
|
||||
### 2) Drittes Backend manuell hinzufuegen
|
||||
|
||||
**Ziel**
|
||||
- Proxy auf ein neues Backend erweitern.
|
||||
|
||||
**Dateien**
|
||||
- `docker-compose.yml`
|
||||
- `proxy/nginx.conf`
|
||||
|
||||
**Muss**
|
||||
- Service `backend-c` anlegen.
|
||||
- Upstream + Route `/service/c` konfigurieren.
|
||||
|
||||
**Done-Check**
|
||||
```bash
|
||||
curl http://localhost:8080/service/c
|
||||
```
|
||||
|
||||
### 3) Eigene Route mit Rewrite
|
||||
|
||||
**Ziel**
|
||||
- URL-Struktur im Proxy gestalten.
|
||||
|
||||
**Datei**
|
||||
- `proxy/nginx.conf`
|
||||
|
||||
**Muss**
|
||||
- Route `/demo/a` soll intern auf Backend A zeigen.
|
||||
- Implementierung ueber `rewrite` oder eigene `location`.
|
||||
|
||||
**Done-Check**
|
||||
```bash
|
||||
curl http://localhost:8080/demo/a
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Medium
|
||||
|
||||
### 4) Security Headers setzen
|
||||
|
||||
**Ziel**
|
||||
- Grundlegende Header-Haertung im Proxy.
|
||||
|
||||
**Datei**
|
||||
- `proxy/nginx.conf`
|
||||
|
||||
**Muss**
|
||||
- Setze mindestens:
|
||||
- `X-Content-Type-Options: nosniff`
|
||||
- `X-Frame-Options: DENY`
|
||||
- `Referrer-Policy: no-referrer`
|
||||
|
||||
**Done-Check**
|
||||
```bash
|
||||
curl -I http://localhost:8080/
|
||||
```
|
||||
|
||||
### 5) Interne Route absichern
|
||||
|
||||
**Ziel**
|
||||
- Route nur lokal erreichbar machen.
|
||||
|
||||
**Datei**
|
||||
- `proxy/nginx.conf`
|
||||
|
||||
**Muss**
|
||||
- Neue Route `/internal/status` bauen.
|
||||
- Nur `127.0.0.1` erlauben, alle anderen verbieten.
|
||||
|
||||
**Done-Check**
|
||||
```bash
|
||||
curl -i http://localhost:8080/internal/status
|
||||
```
|
||||
|
||||
### 6) Logging verbessern
|
||||
|
||||
**Ziel**
|
||||
- Proxy-Debugging ueber bessere Logs.
|
||||
|
||||
**Datei**
|
||||
- `proxy/nginx.conf`
|
||||
|
||||
**Muss**
|
||||
- Eigenes `log_format` mit Upstream-Infos erstellen.
|
||||
- Access Log auf dieses Format umstellen.
|
||||
|
||||
**Done-Check**
|
||||
```bash
|
||||
curl http://localhost:8080/service/a
|
||||
./scripts/compose.sh logs reverse-proxy
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Hard (TLS)
|
||||
|
||||
### 7) HTTPS von 0 mit Easy-RSA
|
||||
|
||||
**Ziel**
|
||||
- Eigene CA + Server-Zertifikat fuer `localhost`.
|
||||
|
||||
**Dateien**
|
||||
- `docker-compose.yml`
|
||||
- `proxy/nginx.conf`
|
||||
|
||||
**Muss**
|
||||
- Cert fuer `localhost` erzeugen.
|
||||
- Proxy auf `443` aktivieren (z. B. `8443:443`).
|
||||
- Root-CA importieren.
|
||||
|
||||
**Done-Check**
|
||||
```bash
|
||||
curl https://localhost:8443/service/a
|
||||
```
|
||||
|
||||
### 8) HTTP -> HTTPS Redirect
|
||||
|
||||
**Ziel**
|
||||
- Klarer Redirect-Flow.
|
||||
|
||||
**Datei**
|
||||
- `proxy/nginx.conf`
|
||||
|
||||
**Muss**
|
||||
- HTTP Requests auf HTTPS umleiten.
|
||||
- `/healthz` darf optional auf HTTP bleiben.
|
||||
|
||||
**Done-Check**
|
||||
```bash
|
||||
curl -I http://localhost:8080/service/a
|
||||
```
|
||||
|
||||
### 9) TLS Haertung + Chain Check
|
||||
|
||||
**Ziel**
|
||||
- Bessere TLS-Defaults + saubere Validierung.
|
||||
|
||||
**Datei**
|
||||
- `proxy/nginx.conf`
|
||||
|
||||
**Muss**
|
||||
- TLS auf 1.2/1.3 beschraenken.
|
||||
- HSTS aktivieren (`Strict-Transport-Security`).
|
||||
- Zertifikatskette pruefen.
|
||||
|
||||
Hinweis: Im HTTP-Basissetup ist HSTS absichtlich **noch nicht** aktiv. Das ist Teil der Aufgabe.
|
||||
|
||||
**Done-Check**
|
||||
```bash
|
||||
curl -I https://localhost:8443/service/a
|
||||
openssl s_client -connect localhost:8443 -servername localhost
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Bonus Expert
|
||||
|
||||
### 10) Wireshark: HTTP vs HTTPS
|
||||
|
||||
**Ziel**
|
||||
- Sichtbar machen, was verschluesselt ist und was nicht.
|
||||
|
||||
**Muss**
|
||||
- HTTP Traffic auf `8080` mitschneiden.
|
||||
- HTTPS Traffic auf `8443` mitschneiden.
|
||||
- TLS Handshake markieren (`ClientHello`, `ServerHello`, `Certificate`).
|
||||
- Technisch erklaeren, warum HTTP lesbar ist und HTTPS nicht.
|
||||
|
||||
**Vorgehen (empfohlen)**
|
||||
1. Capture auf `lo` (oder passendes Interface) starten, Filter `tcp.port == 8080`.
|
||||
2. `curl http://localhost:8080/service/a` senden und HTTP-Stream zeigen.
|
||||
3. Capture auf `tcp.port == 8443` oder `tls` umstellen.
|
||||
4. `curl https://localhost:8443/service/a` senden.
|
||||
5. Handshake-Pakete markieren und kurz erklaeren.
|
||||
|
||||
**Optional**
|
||||
- TLS Decrypt mit `SSLKEYLOGFILE`.
|
||||
|
||||
**Done-Check**
|
||||
- 3-4 Screenshots + 3-5 Bulletpoints Auswertung.
|
||||
|
||||
**Typische Fehler**
|
||||
- falsches Interface gewaehlt
|
||||
- HTTPS noch nicht korrekt aktiv
|
||||
- Keylog gesetzt, aber Browser nicht aus derselben Shell gestartet
|
||||
|
||||
---
|
||||
|
||||
## Zusatz-Hints
|
||||
|
||||
- `challenges/easyrsa-hints.md`
|
||||
- `challenges/wireshark-hints.md`
|
||||
@@ -0,0 +1,125 @@
|
||||
# Easy-RSA Hint Card (optional)
|
||||
|
||||
Diese Hinweise koennen Teams nutzen, wenn sie bei der HTTPS-Challenge feststecken.
|
||||
|
||||
## 1) Easy-RSA installieren (WSL/Linux)
|
||||
|
||||
Fedora:
|
||||
|
||||
```bash
|
||||
sudo dnf install -y easy-rsa openssl
|
||||
```
|
||||
|
||||
Ubuntu/WSL:
|
||||
|
||||
```bash
|
||||
sudo apt update
|
||||
sudo apt install -y easy-rsa openssl
|
||||
```
|
||||
|
||||
## 2) PKI vorbereiten
|
||||
|
||||
```bash
|
||||
mkdir -p certs/easyrsa
|
||||
cp -r /usr/share/easy-rsa/* certs/easyrsa/
|
||||
cd certs/easyrsa
|
||||
./easyrsa init-pki
|
||||
```
|
||||
|
||||
## 3) CA erstellen
|
||||
|
||||
```bash
|
||||
./easyrsa build-ca nopass
|
||||
```
|
||||
|
||||
## 4) Server-Zertifikat fuer localhost
|
||||
|
||||
```bash
|
||||
./easyrsa gen-req localhost nopass
|
||||
./easyrsa sign-req server localhost
|
||||
```
|
||||
|
||||
## 5) Dateien fuer Nginx bereitstellen
|
||||
|
||||
Typische Dateien:
|
||||
|
||||
- `pki/issued/localhost.crt`
|
||||
- `pki/private/localhost.key`
|
||||
- `pki/ca.crt`
|
||||
|
||||
Danach in `proxy/nginx.conf` TLS aktivieren und in `docker-compose.yml` Port `443` mappen.
|
||||
|
||||
### Compose-Mindestbeispiel
|
||||
|
||||
```yaml
|
||||
services:
|
||||
reverse-proxy:
|
||||
ports:
|
||||
- "8080:80"
|
||||
- "8443:443"
|
||||
volumes:
|
||||
- ./proxy/nginx.conf:/etc/nginx/nginx.conf:ro,z
|
||||
- ./proxy/html:/usr/share/nginx/html:ro,z
|
||||
- ./certs/easyrsa/pki:/etc/nginx/pki:ro,z
|
||||
```
|
||||
|
||||
### Nginx-Mindestbeispiel
|
||||
|
||||
```nginx
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name localhost;
|
||||
|
||||
ssl_certificate /etc/nginx/pki/issued/localhost.crt;
|
||||
ssl_certificate_key /etc/nginx/pki/private/localhost.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
|
||||
location /service/a {
|
||||
proxy_pass http://backend_a/;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## 6) Root-CA importieren (Trust Store)
|
||||
|
||||
Fedora:
|
||||
|
||||
```bash
|
||||
sudo cp pki/ca.crt /etc/pki/ca-trust/source/anchors/htl-workshop-root-ca.crt
|
||||
sudo update-ca-trust
|
||||
```
|
||||
|
||||
Ubuntu/Debian:
|
||||
|
||||
```bash
|
||||
sudo cp pki/ca.crt /usr/local/share/ca-certificates/htl-workshop-root-ca.crt
|
||||
sudo update-ca-certificates
|
||||
```
|
||||
|
||||
Windows (PowerShell als Admin, optional):
|
||||
|
||||
```powershell
|
||||
certutil -addstore -f Root C:\path\to\ca.crt
|
||||
```
|
||||
|
||||
## 7) Test ohne -k
|
||||
|
||||
Nach Import sollte HTTPS ohne Insecure-Flag funktionieren:
|
||||
|
||||
```bash
|
||||
curl https://localhost:8443/service/a
|
||||
```
|
||||
|
||||
Falls CA nicht global importiert ist:
|
||||
|
||||
```bash
|
||||
curl --cacert pki/ca.crt https://localhost:8443/service/a
|
||||
```
|
||||
|
||||
## 8) Typische Fehlerbilder
|
||||
|
||||
- `curl: (60) SSL certificate problem` -> Root-CA nicht importiert oder falsche CA.
|
||||
- Browser war offen waehrend CA-Import -> Browser neu starten.
|
||||
- `permission denied` beim Nginx-Config-Mount (Fedora/SELinux) -> Volumes mit `:z` mounten.
|
||||
- Zertifikat ohne `localhost` -> SAN/CN passt nicht zum Hostnamen.
|
||||
@@ -0,0 +1,116 @@
|
||||
# Wireshark Hint Card (optional)
|
||||
|
||||
Diese Hinweise helfen bei der Bonus-Challenge mit Paketmitschnitt.
|
||||
|
||||
## 1) Installation
|
||||
|
||||
Fedora:
|
||||
|
||||
```bash
|
||||
sudo dnf install -y wireshark wireshark-cli
|
||||
```
|
||||
|
||||
Ubuntu/WSL:
|
||||
|
||||
```bash
|
||||
sudo apt update
|
||||
sudo apt install -y wireshark tshark
|
||||
```
|
||||
|
||||
## 2) Interface waehlen
|
||||
|
||||
- Linux lokal: meist `lo` (Loopback) fuer `localhost`
|
||||
- Docker-Welt: ggf. `docker0` bzw. Bridge-Interface
|
||||
|
||||
## 3) HTTP zuerst (Klartext)
|
||||
|
||||
1. Mitschnitt starten
|
||||
2. Request senden:
|
||||
|
||||
```bash
|
||||
curl http://localhost:8080/service/a
|
||||
```
|
||||
|
||||
3. In Wireshark nach `http` oder `tcp.port == 8080` filtern
|
||||
|
||||
## 4) Root-CA importieren und HTTPS ohne -k testen
|
||||
|
||||
Voraussetzung: HTTPS-Challenge umgesetzt (Port `8443` aktiv).
|
||||
|
||||
Fedora:
|
||||
|
||||
```bash
|
||||
sudo cp certs/easyrsa/pki/ca.crt /etc/pki/ca-trust/source/anchors/htl-workshop-root-ca.crt
|
||||
sudo update-ca-trust
|
||||
```
|
||||
|
||||
Ubuntu/Debian:
|
||||
|
||||
```bash
|
||||
sudo cp certs/easyrsa/pki/ca.crt /usr/local/share/ca-certificates/htl-workshop-root-ca.crt
|
||||
sudo update-ca-certificates
|
||||
```
|
||||
|
||||
Test:
|
||||
|
||||
```bash
|
||||
curl https://localhost:8443/service/a
|
||||
```
|
||||
|
||||
## 5) HTTPS danach mitschneiden (verschluesselt)
|
||||
|
||||
Filter:
|
||||
|
||||
```text
|
||||
tcp.port == 8443
|
||||
```
|
||||
|
||||
oder
|
||||
|
||||
```text
|
||||
tls
|
||||
```
|
||||
|
||||
Handshake schnell finden:
|
||||
|
||||
```text
|
||||
tls.handshake
|
||||
```
|
||||
|
||||
Nur Zertifikats-Nachrichten:
|
||||
|
||||
```text
|
||||
tls.handshake.type == 11
|
||||
```
|
||||
|
||||
## 6) Optional: TLS in Wireshark entschluesseln
|
||||
|
||||
1. Vor Browser-Start setzen:
|
||||
|
||||
```bash
|
||||
export SSLKEYLOGFILE="$HOME/sslkeys.log"
|
||||
```
|
||||
|
||||
2. Browser aus derselben Shell starten und HTTPS-Request erzeugen.
|
||||
3. In Wireshark unter TLS-Preferences `sslkeys.log` als Key Log File setzen.
|
||||
4. Mitschnitt erneut laden.
|
||||
|
||||
CLI-Alternative mit tshark (optional):
|
||||
|
||||
```bash
|
||||
tshark -i lo -f "tcp port 8443"
|
||||
```
|
||||
|
||||
## 7) Was ihr zeigen sollt
|
||||
|
||||
- HTTP-Mitschnitt: URL/Headers lesbar
|
||||
- HTTPS-Mitschnitt: TLS Handshake sichtbar, Nutzdaten nicht im Klartext
|
||||
- Nach CA-Import funktioniert `curl https://localhost:8443/...` ohne `-k`
|
||||
- Optional: Mit Key Log koennen HTTP-Details im TLS-Stream sichtbar werden
|
||||
|
||||
## 8) Erwartete Abgabe (kurz)
|
||||
|
||||
- Screenshot 1: HTTP-Request mit lesbaren Daten
|
||||
- Screenshot 2: HTTPS-Request mit TLS-Handshake
|
||||
- Screenshot 3 (optional): entschluesselter TLS-Stream via Key Log
|
||||
- 3 Bulletpoints: Unterschied HTTP vs HTTPS in euren eigenen Worten
|
||||
Reference in New Issue
Block a user