Address workshop issues and expand challenge guidance
This commit is contained in:
hkoeck
+53
-97
@@ -150,7 +150,7 @@
|
||||
<main>
|
||||
<section class="panel">
|
||||
<h1>Challenges - Reverse Proxy & TLS</h1>
|
||||
<p>Fokus: manuelle Proxy-Konfiguration, saubere Security-Entscheidungen, TLS von Grund auf.</p>
|
||||
<p>Manuelle Proxy-Konfiguration, Security-Entscheidungen und TLS von Grund auf.</p>
|
||||
<div class="top-links">
|
||||
<a class="pill" href="/">Startseite</a>
|
||||
<a class="pill" href="/hints.html">Hints</a>
|
||||
@@ -161,11 +161,11 @@
|
||||
</section>
|
||||
|
||||
<section class="panel">
|
||||
<h2>Abgabe-Format (fuer jede Challenge)</h2>
|
||||
<h2>Abgabe-Format</h2>
|
||||
<ul>
|
||||
<li><span class="kw">1) Demo:</span> 1-3 Minuten, live zeigen.</li>
|
||||
<li><span class="kw">2) Check:</span> Done-Check Command ausfuehren.</li>
|
||||
<li><span class="kw">3) Erklaerung:</span> 2-3 Saetze: was, warum, Sicherheitswirkung.</li>
|
||||
<li>1-3 Minuten Demo</li>
|
||||
<li>Done-Check live ausfuehren</li>
|
||||
<li>2-3 Saetze: was, warum, welche Wirkung</li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
@@ -173,45 +173,28 @@
|
||||
<h2>Easy</h2>
|
||||
|
||||
<details open>
|
||||
<summary><span class="badge easy">Easy</span> 1) Routing verstehen</summary>
|
||||
<p><span class="kw">Ziel:</span> Verstehen, wie der Reverse Proxy Requests anhand des Pfads verteilt.</p>
|
||||
<p><span class="kw">Muss:</span></p>
|
||||
<summary><span class="badge easy">Easy</span> 1) Routing verstehen (aktiv)</summary>
|
||||
<p><span class="kw">Muss:</span> zuerst in <code>proxy/nginx.conf</code> nachsehen, dann testen.</p>
|
||||
<ul>
|
||||
<li><code>/service/a</code> und <code>/service/b</code> aufrufen.</li>
|
||||
<li>Unterschied der Antworten erklaeren.</li>
|
||||
<li>In 1 Satz erklaeren, welche <code>location</code> auf welchen <code>upstream</code> zeigt.</li>
|
||||
<li>Welche <code>location</code> matched <code>/service/a</code>?</li>
|
||||
<li>Welcher <code>upstream</code> wird verwendet?</li>
|
||||
</ul>
|
||||
<p><span class="kw">Done-Check:</span></p>
|
||||
<pre><code>curl http://localhost:8080/service/a
|
||||
curl http://localhost:8080/service/b</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge easy">Easy</span> 2) backend-c manuell hinzufuegen</summary>
|
||||
<p><span class="kw">Ziel:</span> Proxy-Setup sinnvoll erweitern, ohne bestehenden Traffic zu brechen.</p>
|
||||
<p><span class="kw">Dateien:</span> <code>docker-compose.yml</code>, <code>proxy/nginx.conf</code></p>
|
||||
<p><span class="kw">Muss:</span></p>
|
||||
<ul>
|
||||
<li>Service <code>backend-c</code> in Compose anlegen.</li>
|
||||
<li>In Nginx <code>upstream backend_c</code> und <code>location /service/c</code> konfigurieren.</li>
|
||||
<li>Routing fuer A/B darf danach nicht kaputt sein.</li>
|
||||
</ul>
|
||||
<p><span class="kw">Done-Check:</span></p>
|
||||
<summary><span class="badge easy">Easy</span> 2) backend-c hinzufuegen</summary>
|
||||
<p><span class="kw">Muss:</span> Compose-Service + Upstream + Route <code>/service/c</code>.</p>
|
||||
<p><span class="kw">Zusatz:</span> <code>backends/c/index.html</code> ist vorhanden und darf angepasst werden.</p>
|
||||
<pre><code>curl http://localhost:8080/service/c
|
||||
curl http://localhost:8080/service/a
|
||||
curl http://localhost:8080/service/b</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge easy">Easy</span> 3) Eigene Route mit Rewrite</summary>
|
||||
<p><span class="kw">Ziel:</span> URL-Design vom Backend entkoppeln.</p>
|
||||
<p><span class="kw">Muss:</span></p>
|
||||
<ul>
|
||||
<li>Neue public Route (z. B. <code>/demo/a</code>) einbauen.</li>
|
||||
<li>Intern auf bestehenden Backend-Pfad umbiegen (Rewrite oder eigene Route).</li>
|
||||
<li>In der Demo erklaeren, warum solche Pfad-Abstraktion nuetzlich ist.</li>
|
||||
</ul>
|
||||
<p><span class="kw">Done-Check:</span></p>
|
||||
<summary><span class="badge easy">Easy</span> 3) Eigene Route /demo/a</summary>
|
||||
<p><span class="kw">Muss:</span> Alias-Route bauen, die auf Backend A fuehrt.</p>
|
||||
<pre><code>curl http://localhost:8080/demo/a</code></pre>
|
||||
</details>
|
||||
</section>
|
||||
@@ -220,43 +203,45 @@ curl http://localhost:8080/service/b</code></pre>
|
||||
<h2>Medium</h2>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 4) Security Headers setzen</summary>
|
||||
<p><span class="kw">Ziel:</span> Browser-Schutzmechanismen bewusst aktivieren.</p>
|
||||
<p><span class="kw">Muss:</span></p>
|
||||
<ul>
|
||||
<li><code>X-Content-Type-Options: nosniff</code></li>
|
||||
<li><code>X-Frame-Options: DENY</code></li>
|
||||
<li><code>Referrer-Policy: no-referrer</code></li>
|
||||
</ul>
|
||||
<p><span class="kw">Done-Check:</span></p>
|
||||
<summary><span class="badge medium">Medium</span> 4) Security Headers</summary>
|
||||
<p>Setze mindestens <code>nosniff</code>, <code>DENY</code>, <code>no-referrer</code>.</p>
|
||||
<pre><code>curl -I http://localhost:8080/</code></pre>
|
||||
<p><span class="kw">Abgabe:</span> kurz erklaeren, welchen Angriff jeder Header erschwert.</p>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 5) Interne Route absichern</summary>
|
||||
<p><span class="kw">Ziel:</span> Zugangskontrolle direkt im Proxy umsetzen.</p>
|
||||
<p><span class="kw">Muss:</span></p>
|
||||
<ul>
|
||||
<li>Route <code>/internal/status</code> einbauen.</li>
|
||||
<li>Nur <code>127.0.0.1</code> erlauben, alle anderen verbieten.</li>
|
||||
<li>Sinn der Route erklaeren (z. B. intern fuer Ops/Monitoring).</li>
|
||||
</ul>
|
||||
<p><span class="kw">Done-Check:</span></p>
|
||||
<pre><code>curl -i http://localhost:8080/internal/status</code></pre>
|
||||
<p><span class="kw">Muss:</span> <code>/internal/status</code> nur fuer <code>127.0.0.1</code>.</p>
|
||||
<p><span class="kw">Wichtig:</span> Host-Request zeigt typischerweise 403 (Docker-Netzwerk).</p>
|
||||
<pre><code>curl -i http://localhost:8080/internal/status
|
||||
./scripts/compose.sh exec -T reverse-proxy sh -lc "wget -qO- http://127.0.0.1/internal/status"</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6) Logging verbessern</summary>
|
||||
<p><span class="kw">Ziel:</span> Fehler schneller eingrenzen koennen.</p>
|
||||
<p><span class="kw">Muss:</span></p>
|
||||
<ul>
|
||||
<li>Eigenes <code>log_format</code> mit Upstream-Daten erstellen.</li>
|
||||
<li>Mindestens enthalten: <code>status</code>, <code>upstream_addr</code>, Timing.</li>
|
||||
<li>Access Log auf das neue Format stellen.</li>
|
||||
</ul>
|
||||
<p><span class="kw">Done-Check:</span></p>
|
||||
<p>Eigenes <code>log_format</code> mit Upstream-Infos einbauen.</p>
|
||||
<pre><code>curl http://localhost:8080/service/a
|
||||
./scripts/compose.sh logs reverse-proxy</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6a) Load Balancing</summary>
|
||||
<p>Zweite Instanz von Backend A (<code>backend-a2</code>) einbauen und Round-Robin zeigen.</p>
|
||||
<pre><code>for i in $(seq 1 8); do
|
||||
curl -s http://localhost:8080/service/a | grep -o "Target A2\|Target A"
|
||||
done</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6b) Header Stripping</summary>
|
||||
<p>Mindestens einen Backend-Response-Header per <code>proxy_hide_header</code> ausblenden.</p>
|
||||
<pre><code>curl -I http://localhost:8080/service/a</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6c) Debugging Challenge</summary>
|
||||
<p>Mit <code>proxy/nginx.broken.conf</code> arbeiten, Fehler finden und reparieren.</p>
|
||||
<pre><code>curl http://localhost:8080/service/a
|
||||
curl http://localhost:8080/service/b
|
||||
./scripts/compose.sh logs reverse-proxy</code></pre>
|
||||
</details>
|
||||
</section>
|
||||
@@ -266,41 +251,19 @@ curl http://localhost:8080/service/b</code></pre>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 7) HTTPS von 0 (Easy-RSA)</summary>
|
||||
<p><span class="kw">Ziel:</span> Eigene PKI und TLS-Endpoint fuer den Proxy aufbauen.</p>
|
||||
<p><span class="kw">Muss:</span></p>
|
||||
<ul>
|
||||
<li>Server-Zertifikat fuer <code>localhost</code> erstellen.</li>
|
||||
<li>Proxy auf <code>443</code> erweitern (z. B. <code>8443:443</code>).</li>
|
||||
<li>Root-CA importieren und ohne <code>-k</code> testen.</li>
|
||||
</ul>
|
||||
<p><span class="kw">Done-Check:</span></p>
|
||||
<p>Zertifikat fuer <code>localhost</code>, Port <code>8443:443</code>, Root-CA importiert.</p>
|
||||
<pre><code>curl https://localhost:8443/service/a</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 8) HTTP -> HTTPS Redirect</summary>
|
||||
<p><span class="kw">Ziel:</span> Client sauber auf TLS umleiten.</p>
|
||||
<p><span class="kw">Muss:</span></p>
|
||||
<ul>
|
||||
<li>Alle HTTP Requests nach HTTPS redirecten.</li>
|
||||
<li><code>/healthz</code> darf optional auf HTTP bleiben.</li>
|
||||
<li>Redirect-Statuscode + Location Header erklaeren.</li>
|
||||
</ul>
|
||||
<p><span class="kw">Done-Check:</span></p>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 abgeschlossen. Bestehende Config weiterverwenden.</p>
|
||||
<pre><code>curl -I http://localhost:8080/service/a</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 9) TLS Haertung + Chain Check + HSTS</summary>
|
||||
<p><span class="kw">Ziel:</span> TLS nicht nur aktivieren, sondern sinnvoll haerten.</p>
|
||||
<p><span class="kw">Muss:</span></p>
|
||||
<ul>
|
||||
<li>TLS auf 1.2/1.3 beschraenken.</li>
|
||||
<li>HSTS Header setzen: <code>Strict-Transport-Security</code>.</li>
|
||||
<li>Zertifikatskette pruefen und in der Demo erklaeren.</li>
|
||||
</ul>
|
||||
<p><span class="kw">Hinweis:</span> Im HTTP-Basissetup ist HSTS absichtlich noch nicht aktiv.</p>
|
||||
<p><span class="kw">Done-Check:</span></p>
|
||||
<summary><span class="badge hard">Hard</span> 9) TLS Haertung + Chain + HSTS</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 und 8 abgeschlossen. Gleiche Config weiter erweitern.</p>
|
||||
<pre><code>curl -I https://localhost:8443/service/a
|
||||
openssl s_client -connect localhost:8443 -servername localhost</code></pre>
|
||||
</details>
|
||||
@@ -311,21 +274,14 @@ openssl s_client -connect localhost:8443 -servername localhost</code></pre>
|
||||
|
||||
<details open>
|
||||
<summary><span class="badge expert">Expert</span> 10) Wireshark: HTTP vs HTTPS sauber ausarbeiten</summary>
|
||||
<p><span class="kw">Ziel:</span> Nachweisbar zeigen, was bei HTTP lesbar und bei HTTPS geschuetzt ist.</p>
|
||||
<p><span class="kw">Muss:</span></p>
|
||||
<ol>
|
||||
<li>HTTP Capture auf Port <code>8080</code>, Request erzeugen, Klartext markieren.</li>
|
||||
<li>HTTPS Capture auf Port <code>8443</code>, TLS Handshake markieren.</li>
|
||||
<li>Pakete mit <code>ClientHello</code>, <code>ServerHello</code>, <code>Certificate</code> zeigen.</li>
|
||||
<li>Kurze Analyse: Was sieht ein Angreifer im HTTP-Fall vs im HTTPS-Fall?</li>
|
||||
<li>HTTP auf <code>8080</code> mitschneiden und Klartext zeigen.</li>
|
||||
<li>HTTPS auf <code>8443</code> mitschneiden.</li>
|
||||
<li><code>ClientHello</code>, <code>ServerHello</code>, <code>Certificate</code> markieren.</li>
|
||||
<li>3-5 Bulletpoints: was ist sichtbar, was ist geschuetzt?</li>
|
||||
</ol>
|
||||
<p><span class="kw">Optional:</span> TLS Decrypt via <code>SSLKEYLOGFILE</code> und Unterschied vorher/nachher erklaeren.</p>
|
||||
<p><span class="kw">Done-Check / Abgabe:</span></p>
|
||||
<ul>
|
||||
<li>Mindestens 3 Screenshots mit Markierungen.</li>
|
||||
<li>3-5 Bulletpoints als technische Schlussfolgerung.</li>
|
||||
<li>Ein Satz zu Grenzen der Methode (z. B. nur mit Keylog decryption).</li>
|
||||
</ul>
|
||||
<p><span class="kw">Optional:</span> TLS Decrypt mit <code>SSLKEYLOGFILE</code>.</p>
|
||||
<p><span class="kw">Abgabe:</span> mind. 3 Screenshots + technische Interpretation.</p>
|
||||
</details>
|
||||
</section>
|
||||
</main>
|
||||
|
||||
@@ -190,12 +190,12 @@ location /service/c {
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}</code></pre>
|
||||
<p><span class="kw">Check:</span> <code>curl http://localhost:8080/service/c</code></p>
|
||||
<p><span class="kw">Hinweis:</span> Stelle sicher, dass <code>backends/c/index.html</code> existiert (Starterdatei liegt bereits im Repo).</p>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge easy">Easy</span> 3) Rewrite Route</summary>
|
||||
<pre><code>location = /demo/a {
|
||||
rewrite ^ /service/a break;
|
||||
proxy_pass http://backend_a/;
|
||||
}</code></pre>
|
||||
<p><span class="kw">Check:</span> <code>curl http://localhost:8080/demo/a</code></p>
|
||||
@@ -221,7 +221,9 @@ add_header Referrer-Policy "no-referrer" always;</code></pre>
|
||||
default_type text/plain;
|
||||
return 200 "internal ok\n";
|
||||
}</code></pre>
|
||||
<p><span class="kw">Check:</span> <code>curl -i http://localhost:8080/internal/status</code></p>
|
||||
<p><span class="kw">Check (Host):</span> <code>curl -i http://localhost:8080/internal/status</code> (typisch 403)</p>
|
||||
<p><span class="kw">Check (Container-intern):</span></p>
|
||||
<pre><code>./scripts/compose.sh exec -T reverse-proxy sh -lc "wget -qO- http://127.0.0.1/internal/status"</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
@@ -235,6 +237,44 @@ access_log /var/log/nginx/access.log workshop;</code></pre>
|
||||
<pre><code>curl http://localhost:8080/service/a
|
||||
./scripts/compose.sh logs reverse-proxy</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6a) Load Balancing</summary>
|
||||
<p><span class="kw">Compose (backend-a2):</span></p>
|
||||
<pre><code>backend-a2:
|
||||
image: nginx:1.27-alpine
|
||||
container_name: workshop-backend-a2
|
||||
volumes:
|
||||
- ./backends/a2:/usr/share/nginx/html:ro,z</code></pre>
|
||||
<p><span class="kw">Nginx (upstream erweitern):</span></p>
|
||||
<pre><code>upstream backend_a {
|
||||
server backend-a:80;
|
||||
server backend-a2:80;
|
||||
}</code></pre>
|
||||
<p><span class="kw">Check:</span></p>
|
||||
<pre><code>for i in $(seq 1 8); do
|
||||
curl -s http://localhost:8080/service/a | grep -o "Target A2\|Target A"
|
||||
done</code></pre>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6b) Header Stripping</summary>
|
||||
<pre><code>location /service/a {
|
||||
proxy_pass http://backend_a/;
|
||||
proxy_hide_header ETag;
|
||||
proxy_hide_header Last-Modified;
|
||||
}</code></pre>
|
||||
<p><span class="kw">Check:</span> <code>curl -I http://localhost:8080/service/a</code></p>
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary><span class="badge medium">Medium</span> 6c) Debugging Challenge</summary>
|
||||
<p>Kopiere testweise <code>proxy/nginx.broken.conf</code> auf <code>proxy/nginx.conf</code>, behebe die Fehler und stelle danach die funktionierende Konfiguration wieder her.</p>
|
||||
<pre><code>cp proxy/nginx.broken.conf proxy/nginx.conf
|
||||
make proxy-reload
|
||||
./scripts/compose.sh logs reverse-proxy</code></pre>
|
||||
<p><span class="kw">Check:</span> beide Routen funktionieren wieder.</p>
|
||||
</details>
|
||||
</section>
|
||||
|
||||
<section class="panel">
|
||||
@@ -261,6 +301,7 @@ cd certs/easyrsa
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 8) HTTP -> HTTPS Redirect</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 abgeschlossen (gleiches Config-File weiterverwenden).</p>
|
||||
<pre><code>server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
@@ -279,6 +320,7 @@ cd certs/easyrsa
|
||||
|
||||
<details>
|
||||
<summary><span class="badge hard">Hard</span> 9) TLS Haertung + HSTS</summary>
|
||||
<p><span class="kw">Voraussetzung:</span> Challenge 7 und 8 abgeschlossen.</p>
|
||||
<pre><code>ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_prefer_server_ciphers on;
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;</code></pre>
|
||||
|
||||
@@ -0,0 +1,47 @@
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
sendfile on;
|
||||
server_tokens off;
|
||||
|
||||
upstream backend_a_typo {
|
||||
server backend-a:8080;
|
||||
}
|
||||
|
||||
upstream backend_b {
|
||||
server backend-b:80;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
|
||||
location / {
|
||||
root /usr/share/nginx/html;
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
|
||||
location /service/a {
|
||||
proxy_pass http://backend_a/;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-Proto http;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
|
||||
location /service/b {
|
||||
proxy_pass http://backend_b;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-Proto http;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
|
||||
location = /healthz {
|
||||
default_type text/plain;
|
||||
return 200 "ok\n";
|
||||
}
|
||||
}
|
||||
}
|
||||
+1
-1
@@ -39,7 +39,7 @@ http {
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
|
||||
location /healthz {
|
||||
location = /healthz {
|
||||
default_type text/plain;
|
||||
return 200 "ok\n";
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user