chaitin / safeline Goto Github PK
View Code? Open in Web Editor NEWserve as a reverse proxy to protect your web services from attacks and exploits.
Home Page: https://waf.chaitin.com
License: GNU General Public License v3.0
serve as a reverse proxy to protect your web services from attacks and exploits.
Home Page: https://waf.chaitin.com
License: GNU General Public License v3.0
Safeline默认ip段和腾讯云内置ip冲突,导致服务器网络异常
safeline Gateway: "169.254.0.1",
ping mirrors.tencentyun.com
PING mirrors.tencentyun.com (169.254.0.3) 56(84) bytes of data
From xxx (169.254.0.1) icmp_seq=40 Destination Host Unreachable
尝试修改compose.yaml中的169.254为其他网段,但是没有用,可能镜像里有hardcode
升级前版本:1.2.0
升级后版本:1.3.0
升级前配置:
源 IP 获取方式:从HTTP Header中获取
X-Forwarded-For
在升级版本后失效,需要重新保存才行。
其余配置都正常,SAFELINE_DIR环境变量在.env中
/home/ops/safeline
├── compose.yaml
├── .env
cat .env
SAFELINE_DIR=/home/ops/safeline
IMAGE_TAG=latest
MGT_PORT=9443
POSTGRES_PASSWORD=xxxxxx
升级方式
docker compose down && docker compose pull && docker compose up -d
希望能增加屏蔽国外IP访问功能
点个赞,给师傅看看呼声会有多大。
v1.0.2
如标题,当前管理页面上无版本号信息,建议增加上。
且能够检测是否有新版本发布。
检测日志越来越多,能否增加一个日志占用百分比自动删除,或者手动可以按照时间批量删除日志的功能?
1,目前 v1.6.0 版本只能统一配置防护模块,希望可以按域名配置不同的模块防护模式
2,如微信群沟通,希望未来社区版可以支持插件系统 https://github.com/chaitin/safeline-open-platform
真正罕见的数据集来源于大型项目,但是中间有一次tcp、http转发在中大型项目无法落地,会造成不必要的性能损耗。希望能支持内部lua、go扩展,这样才能贡献出更多高质量的大数据样本
如题,请问后续有无Arm64支持的计划~
希望能有基准的性能测试的对比文档? 能有部署在kubernetes上与ingress结合的示例就更好了。毕竟云原生时代
看页面请求,当选取“未知”标签时,参数为62
page=1&page_size=50&ip=&url=&attack_type=62
然而数据库中攻击类型为未知的告警,保存的attack_type=36
http://192.168.226.4:38989/?a=1%9c%27union%20select%20*%20from%20user
Blocked but not logged, caused by invalid UTF-8 char 0x9c
.
safeline-postgres | 2023-04-14 09:17:02.375 UTC [123] ERROR: invalid byte sequence for encoding "UTF8": 0x9c
safeline-postgres | 2023-04-14 09:17:02.375 UTC [123] CONTEXT: unnamed portal parameter $7
safeline-postgres | 2023-04-14 09:17:02.375 UTC [123] STATEMENT: INSERT INTO "mgt_detect_log_basic" ("event_id","site_uuid","src_ip","socket_ip","protocol","host","url_path","dst_port","country","province","city","attack_type","risk_level","action","rule_id","timestamp") VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16) RETURNING "id"
safeline-postgres | 2023-04-14 09:17:02.375 UTC [123] ERROR: invalid byte sequence for encoding "UTF8": 0x9c
safeline-postgres | 2023-04-14 09:17:02.375 UTC [123] CONTEXT: unnamed portal parameter $5
safeline-postgres | 2023-04-14 09:17:02.375 UTC [123] STATEMENT: INSERT INTO "mgt_detect_log_detail" ("event_id","src_port","dst_ip","method","query_string","status_code","req_header","req_body","rsp_header","rsp_body","payload","location","decode_path") VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13) RETURNING "id"
似乎是因为mario无法启动导致的网页面板出现错误
日志:
safeline-mario.csv
看起来是个空指针错误
compose.yml就是手动安装中提供的
.env的内容如图:
可以帮忙看一下是不是哪儿配置错了吗
社区版是否可以提供管理员账号密码登录,以及创建普通用户等功能?
当前通用配置是针对全局,希望能够设置不同的规则组能够对应不同的站点
希望防护站点-站点配置能批量导入导出
使用了waf的情况下套了一个CDN 情况下waf拦截的地址检测日志无法获取真实ip 但在日志的详情下是可以查看出真实IP
更正 我眼拙 没看见还可以设置获取方式
不确定是不是我的问题,手机Chrome浏览器输入不了令牌,电脑可以
安装出现以下错误,请问如何解决呢
root@DESKTOP-3SP76CV:/home/ubuntu/safeline# ./safeline-ce.sh
Success!
[+] Running 4/5
✔ Container safeline-postgres Running0.0s
✔ Container safeline-mario Running0.0s
✔ Container safeline-mgt-api Running0.0s
✔ Container safeline-detector Running0.0s
⠋ Container safeline-tengine Starting0.1s
Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "/etc/localtime" to rootfs at "/etc/localtime": mount /etc/localtime:/etc/localtime (via /proc/self/fd/6), flags: 0x5001: not a directory: unknown: Are you trying to mount a directory onto a file (or vice-versa)? Check if the specified host path exists and is the expected type
Start safeline-ce with
咱这个waf本来就是基于nginx的,能否站点添加的时候后端服务器可以添加多个服务器地址?实现本身的站点负载均衡功能?
项目里tengine(nginx)和detector之间通信用到的t1k协议,这个协议是否可以开放源码或者协议说明书?
宝塔面板安装的 nginx,在本机用,是不是要重新编译 nginx,加入upstream,才能用啊?上游服务器写 127.0.0.1 好像不行
当前存在2个域名,如下:
1、aaa.example.com 80
2、bbb.example.com 80
以上配置都正常且waf防护生效。
当使用http://waf-IP:80形式进行访问的时候,会落到以上两个站点的其中一个。
这并不是希望看到的效果,只希望通过域名+端口可以访问,IP+端口不允许访问。
希望厂家这边有什么好的办法来解决这种。
防火墙仅有的ssl设置只能通过 上传密钥及证书才能配置
希望增添一个 直接 复制粘贴的 填写设置
场景 我通过面板申请了 域名的ssl证书但没有证书和密钥文件 没有直接填写的选项是极其不便的
I realize than Waf is really helpful with my PHP website, too much attack direct focus on PHP ecosystem, and if this tool support i18n, especially for English, that will very kind.
例如下列场景:
当前版本:v1.0.2
安装时候的管理页面端口以及安装目录建议增加下自定义方式。
比如我的9443端口刚好别的应用使用了,导致冲突。
建议在执行 ./safeline-ce.sh 后进行交互选择。
业务服务为10086端口,配置了上游代理为http://127.0.0.1:10086,端口配置为7777,但是反向代理并未监听7777端口,本地curl 127.0.0.1:7777也无法访问
curl -kfLsS https://waf-ce.chaitin.cn/release/latest/upgrade.sh | bash
# replace with `docker-compose` if necessary.
docker compose down && docker compose pull && docker compose up -d
invalid interpolation format for networks.safeline-ce.ipam.config.[].gateway.
You may need to escape any $ with another $.
required variable SUBNET_PREFIX is missing a value: SUBNET_PREFIX required
本地应用 http://192.168.5.127:8878
希望使用雷池waf进行防护,这个如何配置呢?
希望能web界面能增加访问统计(TOP10_IP/TOP_URI)
目前仓库自有一个docker安装脚本,运行也是基于docker远行,如何获取源码,进行自定义修改和部署了?
方便统计
数据库内没有清洗功能,担心未来数据库内满了还要去底层进行清理;数据库能否自定义配置,不在本机内可以连接到外部数据库内
safeline有没有可能集成acme,或者能否通过外部导入的方式自动替换ssl证书,例如使用acme.sh的installcert功能更新
急需增加日志筛选、日志导出、或者日志排序功能,一页一页翻眼花了。
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.