@cryptotaxi247 / MeshCentral / commits / 4830afa9

Create haproxy-with-client-certs.cfg.example

Example file for Haproxy that adds agent direct downloads, splitting of IPv4/IPv6 and validated client certificates to MeshCentral. This does not override the need for a username/password. It simply provides a layer for authorization.

Bobberty committed May 8, 2021 at 06:46 UTC 4830afa9a42ff978a0aafe140e91751eb2f45a50
1 file changed +284
docs/Example configs/haproxy-with-client-certs.cfg.example new
+284
@@ -0,0 +1,284 @@
1 +# This example config is designed for HAProxy. It allows MeshCentral to use and validate Client Certificates.
2 +# Usernames/Passwords are still required. This will provide a layer for authorization.
3 +#
4 +# The MeshID enviorment variable is used for the binary paths. Simply put your MeshID for an incoming group
5 +# into this variable and the binary paths will use the ID for downloading the agent directly to the client.
6 +# Simply type in your specific url (https://reallycoolmeshsystem.com/win10full) and the agent will download
7 +# with the proper meshid for the specified group. In my usage, I have an incoming group assigned.
8 +#
9 +# The config also ensures a split between IPv4 and IPv6. Thus if a client attempts to connect on IPv4,
10 +# it will connect to Meshcentral with IPv4. And if IPv6 is used, IPv6 connection to Meshcentral will be used.
11 +# This config is written in *long* form, it is written for simplicity and clarity. I'm confident that someone
12 +# can shorten the script size easily.
13 +#
14 +# Please examine the MeshID, location of the certificates, certificate names and OU test for the certificates.
15 +# CRL and guest connections are not integrated yet.
16 +#
17 +#
18 +# The following specific path names do not require a validated client certificate:
19 +#
20 +# /win10background - Windows 10 Background Binary Installer
21 +# /win10full - Windows 10 Binary Interactive and Background Installer
22 +# /macosxfull - MacOS 10 Binary Interactive and Background Installer
23 +# /linuxscript - Linux Script ( See Docs)
24 +# /linux64full - Linux AMD64 Binary Interactive and Background Installer
25 +# /linux64background - Linux AMD64 Binary Background Installer
26 +# /linuxarmfull - Linux ARMhf Binary Interactive and Background Installer
27 +# /linuxarmbackground - Linux ARMhf Binary Background Installer
28 +#
29 +# /agent.ashx - Agent to server connection (Websockets)
30 +# /meshrelay.ashx - Agent to server relay
31 +# /meshagents - Default agent download path
32 +# /meshosxagent - Default agent download path for Mac OS X
33 +
34 +
35 +global
36 + log /dev/log local0
37 + log /dev/log local1 info
38 + chroot /var/lib/haproxy
39 + stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
40 + stats timeout 30s
41 + user haproxy
42 + group haproxy
43 + daemon
44 +
45 + # Set the meshID to the incoming group ID
46 + setenv meshID {{really long mesh group ID}}
47 +
48 + # Default SSL material locations
49 + # Probably needs a more secure location
50 + ca-base /etc/haproxy/
51 + crt-base /etc/haproxy/
52 +
53 +
54 + # Default ciphers to use on SSL-enabled listening sockets.
55 + # For more information, see ciphers(1SSL). This list is from:
56 + # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
57 + # An alternative list with additional directives can be obtained from
58 + # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy
59 + ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
60 + ssl-default-bind-options no-sslv3
61 +
62 +
63 +defaults
64 + log global
65 + mode http
66 + option httplog
67 + option dontlognull
68 + timeout connect 5000
69 + timeout client 50000
70 + timeout server 50000
71 + errorfile 400 /etc/haproxy/errors/400.http
72 + errorfile 403 /etc/haproxy/errors/403.http
73 + errorfile 408 /etc/haproxy/errors/408.http
74 + errorfile 500 /etc/haproxy/errors/500.http
75 + errorfile 502 /etc/haproxy/errors/502.http
76 + errorfile 503 /etc/haproxy/errors/503.http
77 + errorfile 504 /etc/haproxy/errors/504.http
78 +
79 +frontend http
80 + bind :::80 v4v6
81 + redirect scheme http code 301 if !{ ssl_fc }
82 +
83 +frontend https
84 + # Replace Root-ca.pem and mesh.pem with proper certs
85 + bind :::443 v4v6 ssl crt mesh.pem ca-file Root-ca.pem verify optional crt-ignore-err all ca-ignore-err all
86 + http-request add-header X-Forwarded-Proto https
87 +
88 +# Testing for Client Certificate used
89 + acl clientssl ssl_c_used
90 +
91 +# Set SSL Cert OU here to verify a proper user
92 + acl clientssl ssl_c_s_dn(OU) "Bad Ass Mesh Services Inc"
93 +
94 +# Agents for download
95 + acl meshagent path_beg /meshagents
96 + acl macmeshagent path_beg /meshosxagent
97 +
98 +# IPV4 vs IPV6 test
99 + acl meshipv4 src 0.0.0.0/0
100 + acl meshipv6 src ::/0
101 +
102 +# Websockets ACL
103 + acl host_ws path_beg /agent.ashx
104 +
105 +# MeshRelay
106 + acl meshrelay path_beg /meshrelay.ashx
107 +
108 +# Specific Agent installers for each platform
109 + acl winback path_beg /win10background
110 + acl winfull path_beg /win10full
111 + acl macosx path_beg /macosxfull
112 + acl linuxscript path_beg /linuxscript
113 + acl linux64full path_beg /linux64full
114 + acl linux64back path_beg /linux64background
115 + acl linuxarmfull path_beg /linuxarmfull
116 + acl linuxarmback path_beg /linuxarmbackground
117 +
118 +# WebSockets
119 + use_backend meshWebSocket4 if host_ws meshipv4 !clientssl
120 + use_backend meshWebSocket6 if host_ws meshipv6 !clientssl
121 +
122 +# Mesh Relay
123 + use_backend meshcentralv4 if meshrelay meshipv4
124 + use_backend meshcentralv6 if meshrelay meshipv6
125 +
126 +# Client SSL Specific
127 + use_backend meshcentralv4 if meshipv4 !meshagent !macmeshagent clientssl
128 + use_backend meshcentralv6 if meshipv6 !meshagent !macmeshagent clientssl
129 +
130 +# Direct Mesh Agent download
131 + use_backend meshcentralv4 if meshipv4 meshagent
132 + use_backend meshcentralv6 if meshipv6 meshagent
133 +
134 + use_backend meshcentralv4 if meshipv4 macmeshagent
135 + use_backend meshcentralv6 if meshipv6 macmeshagent
136 +
137 +# Windows Custom Download
138 + use_backend Win10full4 if meshipv4 winfull
139 + use_backend Win10full6 if meshipv6 winfull
140 +
141 + use_backend Win10back4 if meshipv4 winback
142 + use_backend Win10back6 if meshipv6 winback
143 +
144 +# Mac CUstom Download
145 + use_backend macosx4 if meshipv4 macosx
146 + use_backend macosx6 if meshipv6 macosx
147 +
148 +# Linux Script Custom Download
149 + use_backend linuxSCRIPT4 if meshipv4 linuxscript
150 + use_backend linuxSCRIPT6 if meshipv6 linuxscript
151 +
152 +# Linux Script Custom Download
153 + use_backend linux64-bin-full4 if meshipv4 linux64full
154 + use_backend linux64-bin-full6 if meshipv6 linux64full
155 +
156 + use_backend linux64-bin-back4 if meshipv4 linux64back
157 + use_backend linux64-bin-back6 if meshipv6 linux64back
158 +
159 + use_backend linuxarm-bin-full4 if meshipv4 linuxarmfull
160 + use_backend linuxarm-bin-full6 if meshipv6 linuxarmfull
161 +
162 + use_backend linuxarm-bin-back4 if meshipv4 linuxarmback
163 + use_backend linuxarm-bin-back6 if meshipv6 linuxarmback
164 +# Fail if none of the above
165 + http-request deny if !macmeshagent !meshagent !clientssl !host_ws !winback !winfull !macosx !linuxscript !linux64full !linux64back !linuxarmfull !linuxarmback !meshrelay
166 +
167 +
168 +# Websockets
169 +backend meshWebSocket4
170 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
171 + server ipv4 127.0.0.1:444
172 +
173 +backend meshWebSocket6
174 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
175 + server ipv6 [::1]:444
176 +
177 +# Standard Interface
178 +backend meshcentralv4
179 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
180 + server ipv4 127.0.0.1:444
181 +
182 +backend meshcentralv6
183 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
184 + server ipv6 [::1]:444
185 +
186 +# Windows Agent Download
187 +backend Win10back4
188 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
189 + http-request set-path /meshagents
190 + http-request set-query id=4&meshid=%[env(meshID)]&installflags=2
191 + server ipv4 127.0.0.1:444
192 +
193 +backend Win10back6
194 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
195 + http-request set-path /meshagents
196 + http-request set-query id=4&meshid=%[env(meshID)]&installflags=2
197 + server ipv6 [::1]:444
198 +
199 +backend Win10full4
200 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
201 + http-request set-path /meshagents
202 + http-request set-query id=4&meshid=%[env(meshdID)]&installflags=0
203 + server ipv4 127.0.0.1:444
204 +
205 +backend Win10full6
206 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
207 + http-request set-path /meshagents
208 + http-request set-query id=4&meshid=%[env(meshID)]&installflags=0
209 + server ipv6 [::1]:444
210 +
211 +# MacOS Agent Download
212 +backend macosx6
213 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
214 + http-request set-path /meshosxagents
215 + http-request set-query id=100054&meshid=%[env(meshID)]
216 + server ipv6 [::1]:444
217 +
218 +backend macosx4
219 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
220 + http-request set-path /meshosxagents
221 + http-request set-query id=100054&meshid=%[env(meshID)]
222 + server ipv4 127.0.0.1:444
223 +
224 +# Linux Script Downloads
225 +backend linuxSCRIPT6
226 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
227 + http-request set-path /meshagents
228 + http-request set-query scrpot=1
229 + server ipv6 [::1]:444
230 +
231 +backend linuxSCRIPT4
232 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
233 + http-request set-path /meshagents
234 + http-request set-query scrpot=1
235 + server ipv4 127.0.0.1:444
236 +
237 +# Linux Binary Downloads
238 +backend linux64-bin-full6
239 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
240 + http-request set-path /meshagents
241 + http-request set-query id=%[env(meshID)]&installflags=0&meshinstall=6
242 + server ipv6 [::1]:444
243 +
244 +backend linux64-bin-full4
245 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
246 + http-request set-path /meshagents
247 + http-request set-query id=%[env(meshID)]&installflags=0&meshinstall=6
248 + server ipv4 127.0.0.1:444
249 +
250 +backend linux64-bin-back6
251 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
252 + http-request set-path /meshagents
253 + http-request set-query id=%[env(meshID)]&installflags=2&meshinstall=6
254 + server ipv6 [::1]:444
255 +
256 +backend linux64-bin-back4
257 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
258 + http-request set-path /meshagents
259 + http-request set-query id=%[env(meshID)]&installflags=2&meshinstall=6
260 + server ipv4 127.0.0.1:444
261 +
262 +backend linuxarm-bin-full6
263 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
264 + http-request set-path /meshagents
265 + http-request set-query id=%[env(meshID)]&installflags=0&meshinstall=25
266 + server ipv6 [::1]:444
267 +
268 +backend linuxarm-bin-full4
269 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
270 + http-request set-path /meshagents
271 + http-request set-query id=%[env(meshID)]&installflags=0&meshinstall=25
272 + server ipv4 127.0.0.1:444
273 +
274 +backend linuxarm-bin-back6
275 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
276 + http-request set-path /meshagents
277 + http-request set-query id=%[env(meshID)]&installflags=2&meshinstall=25`
278 + server ipv6 [::1]:444
279 +
280 +backend linuxarm-bin-back4
281 + http-request add-header X-Forwarded-Host %[req.hdr(Host)]
282 + http-request set-path /meshagents
283 + http-request set-query id=%[env(meshID)]&installflags=2&meshinstall=25
284 + server ipv4 127.0.0.1:444