merge

Add required IPv6 ICMP types to iptables

See merge request cyber5k/mistborn!86

.gitlab-ci.yml

@@ -13,7 +13,6 @@ stages:
 
 include:
   - template: Code-Quality.gitlab-ci.yml
-  - template: Security/SAST.gitlab-ci.yml
 
 docker_build:
   stage: test

README.md

@@ -15,7 +15,7 @@ The term [Mistborn](http://www.brandonsanderson.com/the-mistborn-saga-the-origin
 
 Mistborn started as a passion project for a husband and father protecting his family. Certain family members insisted on connecting their devices to free public WiFi networks. We needed a way to secure all family devices with a solid VPN (WireGuard). Once we had that we wanted to control DNS to block ads to all devices and block malicious websites across all family devices. Then we wanted chat, file-sharing, and webchat services that we could use for ourselves without entrusting our data to some big tech company. And then... home automation. I know I'll be adding more services so I made that easy to do.
 
-As a [Certified Information Systems Security Professional (CISSP)](https://www.credly.com/badges/ebcb76f2-1e82-4079-9ea3-b507ffbd1d15/public_url) and an [Offensive Security Certified Professional (OSCP)](https://www.credly.com/badges/b93c44ec-3af5-48e8-9a33-b64365b70c61/public_url), I designed Mistborn thinking about how it would be attacked by both external and internal threats. In making design trade-off decisions I tend to the paranoid. See [Technical and Security Insights](#technical-and-security-insights).
+As an [Offensive Security Certified Professional (OSCP)](https://resources.infosecinstitute.com/certification/the-oscp-certification-and-exam/), I designed Mistborn thinking about how it would be attacked by both external and internal threats. In making design trade-off decisions I tend to the paranoid. See [Technical and Security Insights](#technical-and-security-insights).
 
 Ideal for teams who:
 - hate internet ads
@@ -62,9 +62,8 @@ Within Mistborn is a panel to enable and manage these free extra services (off b
 # Quickstart
 Tested Operating Systems (in order of thoroughness):
 - Ubuntu 20.04 LTS
-- Debian 11 (Bullseye)
+- Debian 10 (Buster)
 - Raspberry Pi OS (formerly Raspbian) Buster
-- Formerly tested and may still work: Ubuntu 18.04 LTS, Debian 10 (Buster)
 
 **Note:** Install operating system updates and restart. Raspberry Pi OS particularly needs to be restarted after kernel updates (kernel modules for the currently running kernel may be missing).
 

base.yml

@@ -119,7 +119,7 @@ services:
     restart: unless-stopped
   
   redis:
-    image: redis:5.0
+    image: redis:6.2-alpine
     container_name: mistborn_production_redis
     restart: unless-stopped
 
@@ -130,7 +130,6 @@ services:
       - /home/mistborn/.ssh:/ssh
       - ../mistborn_volumes/base/media:/mistborn-media
       - ../mistborn_volumes/base/private_media:/mistborn-private-media
-      - ./.envs/.production/.global:/.global
     env_file:
       - ./.envs/.production/.django
       - ./.envs/.production/.postgres
@@ -139,8 +138,10 @@ services:
       default:
       dns_net:
         ipv4_address: 10.2.1.3
+        ipv6_address: "fd0c:6164:c111:ecee::3"
     dns:
       - 10.2.1.2
+      - "fd0c:6164:c111:ecee::2"
     depends_on:
       - traefik
       - pihole
@@ -154,7 +155,6 @@ services:
       - /home/mistborn/.ssh:/ssh
       - ../mistborn_volumes/base/media:/mistborn-media
       - ../mistborn_volumes/base/private_media:/mistborn-private-media
-      - ./.envs/.production/.global:/.global
     env_file:
       - ./.envs/.production/.django
       - ./.envs/.production/.postgres
@@ -163,8 +163,10 @@ services:
       default:
       dns_net:
         ipv4_address: 10.2.1.4
+        ipv6_address: "fd0c:6164:c111:ecee::4"
     dns:
       - 10.2.1.2
+      - "fd0c:6164:c111:ecee::2"
     depends_on:
       - traefik
       - pihole
@@ -213,10 +215,11 @@ services:
       - "traefik.http.services.pihole-service.loadbalancer.server.port=80"
    environment:
      - ServerIP=10.2.0.3
-     - PIHOLE_DNS_=10.2.0.2#5054
+     - PIHOLE_DNS_=10.2.0.2#5054;fdce:7a9e:13ce:d817::2#5054
+     - ServerIPv6=fdce:7a9e:13ce:d817::3
      #- DNS1='10.2.0.2#5054' # docs say port 5054, was 54; use network_mode: host to see which port is used
      #- DNS2=''
-     - IPv6='false'
+     - IPv6=true
      - DNSMASQ_LISTENING=all
    #  TZ: 'America/New York'
    # Volumes store your data between container upgrades
@@ -229,8 +232,10 @@ services:
      default:
      pihole_net:
        ipv4_address: 10.2.0.3
+       ipv6_address: "fdce:7a9e:13ce:d817::3"
      dns_net:
        ipv4_address: 10.2.1.2
+       ipv6_address: "fd0c:6164:c111:ecee::2"
    restart: unless-stopped
 
   dnscrypt-proxy:
@@ -244,17 +249,34 @@ services:
     networks:
       pihole_net:
         ipv4_address: 10.2.0.2
+        ipv6_address: "fdce:7a9e:13ce:d817::2"
     restart: unless-stopped
 
 
 networks:
+
+  default:
+    driver: bridge
+    driver_opts:
+      com.docker.network.enable_ipv6: "true"
+    ipam:
+      config:
+        - subnet: "fd39:4459:ffa9:a36f::/64"
+
   pihole_net:
     driver: bridge
+    driver_opts:
+      com.docker.network.enable_ipv6: "true"
     ipam:
       config:
         - subnet: 10.2.0.0/29
+        - subnet: "fdce:7a9e:13ce:d817::/64"
+  
   dns_net:
     driver: bridge
+    driver_opts:
+      com.docker.network.enable_ipv6: "true"
     ipam:
       config:
         - subnet: 10.2.1.0/24
+        - subnet: "fd0c:6164:c111:ecee::/64"

compose/production/postgres/Dockerfile

@@ -1,4 +1,4 @@
-FROM postgres:11.3
+FROM postgres:13.3-alpine
 
 COPY ./compose/production/postgres/maintenance /usr/local/bin/maintenance
 RUN chmod +x /usr/local/bin/maintenance/*

plugins/bitwarden/mistborn.plugin

@@ -1,9 +0,0 @@
-[DEFAULT]
-name = bitwarden
-subdomain = bitwarden
-desc = Bitwarden is a free and open-source password management service that stores sensitive information such as website credentials in an encrypted vault. The Bitwarden platform offers a variety of client applications including a web interface, desktop applications, browser extensions, mobile apps, and a CLI.
-img = img/bitwarden.png
-compose = compose/docker-compose.yml
-service = service/plugin.service
-environment = environment/environment.sh
-

plugins/elasticsearch/mistborn.plugin

@@ -1,8 +0,0 @@
-[DEFAULT]
-name = elasticsearch
-subdomain = elasticsearch
-compose = compose/docker-compose.yml
-service = service/plugin.service
-environment = environment/environment.sh
-resources = resources
-

plugins/guacamole/mistborn.plugin

@@ -1,10 +0,0 @@
-[DEFAULT]
-name = guacamole
-subdomain = guacamole
-desc = Apache Guacamole is a clientless remote desktop gateway. It supports standard protocols like VNC, RDP, and SSH.
-img = img/guacamole.png
-compose = compose/docker-compose.yml
-service = service/plugin.service
-environment = environment/environment.sh
-resources = resources
-

plugins/homeassistant/mistborn.plugin

@@ -1,9 +0,0 @@
-[DEFAULT]
-name = homeassistant
-subdomain = homeassistant
-desc = Home Assistant is an Open source home automation software that puts local control and privacy first.
-img = img/homeassistant.png
-compose = compose/docker-compose.yml
-service = service/plugin.service
-resources = resources
-

plugins/jellyfin/mistborn.plugin

@@ -1,8 +0,0 @@
-[DEFAULT]
-name = jellyfin
-subdomain = jellyfin
-desc = The Free Software Media System. Jellyfin is the volunteer-built media solution that puts you in control of your media. Stream to any device from your own server, with no strings attached.
-img = img/jellyfin.png
-compose = compose/docker-compose.yml
-service = service/plugin.service
-

plugins/jitsi/mistborn.plugin

@@ -1,10 +0,0 @@
-[DEFAULT]
-name = jitsi
-subdomain = jitsi
-desc = Jitsi is a collection of free and open-source multiplatform voice, videoconferencing and instant messaging applications for the web platform, Windows, Linux, Mac OS X and Android.
-img = img/jitsi.png
-compose = compose/docker-compose.yml
-service = service/plugin.service
-environment = environment/environment.sh
-resources = resources
-

plugins/nextcloud/mistborn.plugin

@@ -1,9 +0,0 @@
-[DEFAULT]
-name = nextcloud
-subdomain = nextcloud
-desc = Nextcloud is a suite of client-server software for creating and using file hosting services. Nextcloud application functionally is similar to Dropbox.
-img = img/nextcloud.png
-compose = compose/docker-compose.yml
-service = service/plugin.service
-environment = environment/environment.sh
-

plugins/onlyoffice/mistborn.plugin

@@ -1,9 +0,0 @@
-[DEFAULT]
-name = onlyoffice
-subdomain = onlyoffice
-desc = An open source office suite featuring online document editors, platform for document management, corporate communication, mail and project management tools.
-img = img/onlyoffice.jpg
-compose = compose/docker-compose.yml
-service = service/plugin.service
-environment = environment/environment.sh
-

plugins/raspap/mistborn.plugin

@@ -1,9 +0,0 @@
-[DEFAULT]
-name = raspap
-subdomain = raspap
-desc = The easiest, full-featured wireless router setup for Debian-based devices. Period. (Mistborn integration in alpha testing)
-img = img/raspap.png
-compose = compose/docker-compose.yml
-service = service/plugin.service
-environment = environment/environment.sh
-

plugins/rocketchat/mistborn.plugin

@@ -1,9 +0,0 @@
-[DEFAULT]
-name = rocketchat
-subdomain = rocketchat
-desc = Rocket.Chat is the leading open source team chat software solution.
-img = img/rocketchat.png
-compose = compose/docker-compose.yml
-service = service/plugin.service
-environment = environment/environment.sh
-

plugins/syncthing/mistborn.plugin

@@ -1,8 +0,0 @@
-[DEFAULT]
-name = syncthing
-subdomain = syncthing
-desc = Syncthing is a free, open-source peer-to-peer file synchronization application available for Windows, Mac, Linux, Android, Solaris, Darwin, and BSD. It can sync files between devices on a local network, or between remote devices over the Internet. Data security and data safety are built into the design of the software.
-img = img/syncthing.png
-compose = compose/docker-compose.yml
-service = service/plugin.service
-

plugins/tor/mistborn.plugin

@@ -1,8 +0,0 @@
-[DEFAULT]
-name = tor
-subdomain = tor
-desc = Tor is free and open-source software for enabling anonymous communication.
-img = img/tor.png
-compose = compose/docker-compose.yml
-service = service/plugin.service
-

plugins/wazuh/mistborn.plugin

@@ -1,8 +0,0 @@
-[DEFAULT]
-name = wazuh
-subdomain = wazuh
-compose = compose/docker-compose.yml
-service = service/plugin.service
-environment = environment/environment.sh
-resources = resources
-

scripts/env/setup.sh

@@ -28,9 +28,9 @@ echo "MISTBORN_BIND_IP=10.2.3.1" | sudo tee -a ${VAR_FILE}
 
 # MISTBORN_TAG
 
-GIT_BRANCH=$(git -C /opt/mistborn symbolic-ref --short HEAD || echo "v1-1")
-MISTBORN_TAG="v1"
-if [ "$GIT_BRANCH" != "v1-1" ]; then
+GIT_BRANCH=$(git -C /opt/mistborn symbolic-ref --short HEAD || echo "master")
+MISTBORN_TAG="latest"
+if [ "$GIT_BRANCH" != "master" ]; then
     MISTBORN_TAG="test"
 fi
 

scripts/install.sh

@@ -105,39 +105,13 @@ source ./scripts/subinstallers/platform.sh
 
 # iptables
 echo "Setting up firewall (iptables)"
-if [ -f "/etc/iptables/rules.v4" ]; then
-    echo "Caution: iptables rules exist."
-
-    read -p "Would you like to Clear (C) existing iptables rules or Add (A) to existing rules (this may cause problems)? [c/a] " MISTBORN_IPTABLES_ACTION
-    echo
-
-    if [[ "${MISTBORN_IPTABLES_ACTION}" =~ ^([cC])$ ]]; then
-    # clear
-        echo "Clearing existing iptables rules..."
-        sudo rm -rf /etc/iptables/rules.v4
-        sudo iptables -F
-        sudo iptables -t nat -F
-        sudo iptables -P INPUT ACCEPT
-        sudo iptables -P FORWARD ACCEPT
-        sudo rm -rf /etc/iptables/rules.v6 || true
-        sudo ip6tables -F || true
-        sudo ip6tables -t nat -F || true
-        sudo ip6tables -P INPUT ACCEPT || true
-        sudo ip6tables -P FORWARD ACCEPT || true
-
-    elif [[ "${MISTBORN_IPTABLES_ACTION}" =~ ^([aA])$ ]]; then
-    # do nothing
-        echo "Proceeding..."
-
-    else
-        echo "Unrecognized action: stopping"
-        exit 1;
-
-    fi
+if [ ! -f "/etc/iptables/rules.v4" ]; then
+    echo "Setting iptables rules..."
+    ./scripts/subinstallers/iptables.sh
+else
+    echo "iptables rules exist. Leaving alone."
 fi
 
-echo "Setting iptables rules..."
-source ./scripts/subinstallers/iptables.sh
 
 # SSH Server
 sudo -E apt-get install -y openssh-server

scripts/subinstallers/gen_prod_env.sh

@@ -43,8 +43,3 @@ WEBPASSWORD="$1"
 echo "TZ=\"America/New York\"" > $PIHOLE_PROD_FILE
 echo "WEBPASSWORD=$WEBPASSWORD" >> $PIHOLE_PROD_FILE
 chmod 600 $PIHOLE_PROD_FILE
-
-
-GLOBAL_SERVICES_FILE="./.envs/.production/.global"
-echo "[DEFAULT]" > $GLOBAL_SERVICES_FILE
-chmod 600 $GLOBAL_SERVICES_FILE

scripts/subinstallers/iptables.sh

@@ -50,7 +50,11 @@ sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 if [ ! -z "${SSH_CLIENT}" ]; then
     SSH_SRC=$(echo $SSH_CLIENT | awk '{print $1}')
     SSH_PRT=$(echo $SSH_CLIENT | awk '{print $3}')
-    sudo iptables -A INPUT -p tcp -s $SSH_SRC --dport $SSH_PRT -j ACCEPT
+    if [[ $SSH_SRC =~ .*:.* ]]; then
+        sudo ip6tables -A INPUT -p tcp -s $SSH_SRC --dport $SSH_PRT -j ACCEPT
+    else
+        sudo iptables -A INPUT -p tcp -s $SSH_SRC --dport $SSH_PRT -j ACCEPT
+    fi
 fi
 
 # docker rules
@@ -91,6 +95,15 @@ echo "Setting ip6tables rules"
 sudo ip6tables -P INPUT ACCEPT
 sudo ip6tables -I INPUT -i lo -j ACCEPT
 sudo ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+# Allow as per RFC 4890
+sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 1   -j ACCEPT
+sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 2   -j ACCEPT
+sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 3   -j ACCEPT
+sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 4   -j ACCEPT
+sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 133 -j ACCEPT
+sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 134 -j ACCEPT
+sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 135 -j ACCEPT
+sudo ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 136 -j ACCEPT
 sudo ip6tables -A INPUT -j MISTBORN_LOG_DROP
 
 sudo ip6tables -P INPUT DROP