diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/etc/nevis/k8s-operations-nevisproxy-instance-bd83dfbd467e8211ffe71d28.yaml b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/etc/nevis/k8s-operations-nevisproxy-instance-bd83dfbd467e8211ffe71d28.yaml index cb9f621..2372e1e 100644 --- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/etc/nevis/k8s-operations-nevisproxy-instance-bd83dfbd467e8211ffe71d28.yaml +++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/etc/nevis/k8s-operations-nevisproxy-instance-bd83dfbd467e8211ffe71d28.yaml @@ -46,7 +46,7 @@ spec: podDisruptionBudget: maxUnavailable: "50%" git: - tag: "r-3341a3df2b54ab6368125d7df7c223019a1fb969" + tag: "r-f7d5f97ee0feefcae245dd0d18143b4d911b6bd8" dir: "DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp" credentials: "git-credentials" keystores: diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/csrf_default.lua b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/csrf_default.lua deleted file mode 100644 index bc67a54..0000000 --- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/csrf_default.lua +++ /dev/null @@ -1,73 +0,0 @@ -function contains(tab, val) - for index, value in ipairs(tab) do - if value == val then - return true - end - end - return false -end - -function inputHeader(request, response) - - if (request:getMethod() == "GET" or request:getMethod() == "HEAD" or request:getMethod() == "OPTIONS" or request:getMethod() == "TRACE") then - -- these requests are not sensitive (do not manipulate state) and are thus not checked - return - end - - -- patterns sets allowed domains or {} - domains = {} - - host = request:getHeader("Host") - - if (host == nil) then - -- Internet-based HTTP/1.1 servers MUST respond with a 400 (Bad Request) status code to any HTTP/1.1 request message which lacks a Host header field. - request:getTracer():notice("VA05", "Missing Host header") - response:setHeader("Content-Type", "text/plain") - response:setBody("400 Bad Request") - response:send(400) - return - end - - -- extract host name - host = host:match('([^:]+)') - - referer = request:getHeader("Referer") - if (referer ~= nil) then - referer = referer:match('^%w+://([^/:]+)') - if (referer ~= host and not contains(domains, referer)) then - if (referer ~= nil) then - request:getTracer():notice("VA01", "HTTP Referer header " .. referer .. " does not match host " .. host) - else - request:getTracer():notice("VA01", "HTTP Referer header " .. request:getHeader("Referer") .. " does not match pattern '^[a-zA-Z0-9]+://([^/:]+)'") - end - response:setHeader("Content-Type", "text/plain") - response:setBody("403 Denied") - response:send(403) - return - end - end - - origin = request:getHeader("Origin") - if (origin ~= nil) then - origin = origin:match('^%w+://([^/:]+)') - if (origin ~= host and not contains(domains, origin)) then - if (origin ~= nil) then - request:getTracer():notice("VA01", "HTTP Origin header " .. origin .. " does not match host " .. host) - else - request:getTracer():notice("VA01", "HTTP Origin header " .. request:getHeader("Origin") .. " does not match pattern '^[a-zA-Z0-9]+://([^/:]+)'") - end - response:setHeader("Content-Type", "text/plain") - response:setBody("403 Denied") - response:send(403) - return - end - end - - if (origin == nil and referer == nil) then - request:getTracer():info("VA05", "Referer or Origin header is required for sensitive requests") - response:setHeader("Content-Type", "text/plain") - response:setBody("403 Denied") - response:send(403) - return - end -end \ No newline at end of file diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_backend.conf b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_backend.conf deleted file mode 100644 index 7b19be5..0000000 --- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_backend.conf +++ /dev/null @@ -1,18 +0,0 @@ -# load modsecurity -Include /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/modsecurity.conf - -# apply whitelist modifications - must be done before loading other rules (replaces REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf) - - -# apply application-specific paranoia level -SecAction "id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=1" - -# load the rule set of the virtual host -Include /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/rules.conf - -# apply rule exceptions (replaces RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf) - - -# set mode -SecRuleEngine On - diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_frontend.conf b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_frontend.conf deleted file mode 100644 index 7b19be5..0000000 --- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_frontend.conf +++ /dev/null @@ -1,18 +0,0 @@ -# load modsecurity -Include /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/modsecurity.conf - -# apply whitelist modifications - must be done before loading other rules (replaces REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf) - - -# apply application-specific paranoia level -SecAction "id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=1" - -# load the rule set of the virtual host -Include /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/rules.conf - -# apply rule exceptions (replaces RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf) - - -# set mode -SecRuleEngine On - diff --git a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/web.xml b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/web.xml index c753b92..0f009c6 100644 --- a/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/web.xml +++ b/DEFAULT-ADN-AGOV-ADMIN-PROJECT/DEFAULT-ADN-AGOV-ADMIN-INV/proxy-sp/var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/web.xml @@ -66,7 +66,7 @@ false - + Authentication_SAML_SP_nevisidm_operations_Realm ch::nevis::isiweb4::filter::auth::IdentityCreationFilter @@ -116,36 +116,6 @@ false - - - Authorization_Forbidden_Roles_nevisIdm.Root_SAML_SP_nevisidm_operations_Realm - ch::nevis::isiweb4::filter::auth::SecurityRoleFilter - - - DynamicRoleAcquire - false - - - - RolesForbidden - nevisIdm.Root - - - - - Authorization_Required_Roles_nevisIdm.Helpdesk_nevisIdm.TemplateAdmin_nevisIdm.UserAndUnitAdmin_nevisIdm.AppAdmin_nevisIdm.UserAdmin_nevisIdm.AppOwner_nevisIdm.EnterpriseRoleAdmin_nevisIdm.ClientRoot_SAML_SP_nevisidm_operations_Realm - ch::nevis::isiweb4::filter::auth::SecurityRoleFilter - - - DynamicRoleAcquire - false - - - - RolesRequired - nevisIdm.Helpdesk nevisIdm.TemplateAdmin nevisIdm.UserAndUnitAdmin nevisIdm.AppAdmin nevisIdm.UserAdmin nevisIdm.AppOwner nevisIdm.EnterpriseRoleAdmin nevisIdm.ClientRoot - - CSRFRewrite_nevisIDM_Operations_Administration_GUI @@ -161,21 +131,6 @@ replacement - - - CSRF_Default - ch::nevis::isiweb4::filter::lua::LuaFilter - - - Script.InputHeaderFunctionName - inputHeader - - - - Script.Path - /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/csrf_default.lua - - DefaultErrorFilter @@ -225,26 +180,6 @@ /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_op-onbrdng-modsecuritysettings.conf - - - ModSecurity_Web_Application_canaryPage_backend - ch::nevis::nevisproxy::filter::modsecurity::ModsecurityFilter - - - ConfigFile - /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_backend.conf - - - - - ModSecurity_Web_Application_canaryPage_frontend - ch::nevis::nevisproxy::filter::modsecurity::ModsecurityFilter - - - ConfigFile - /var/opt/nevisproxy/default/host-op.agov-w.azure.adnovum.net/WEB-INF/security_web_application_canarypage_frontend.conf - - ModSecurity_nevisIDM_Operations_Administration_GUI @@ -471,7 +406,7 @@ 120 - + SessionHandler_SAML_SP_nevisidm_operations_Realm ch::nevis::nevisproxy::filter::session::SessionManagementFilter @@ -593,17 +528,6 @@ /nevisidm/* - - SessionHandler_SAML_SP_nevisidm_operations_Realm - /canary/api/* - - - - SessionHandler_SAML_SP_nevisidm_operations_Realm - /canary/* - ^/canary/api/.*$ - - SAML_AllowCORS_SAML_SP_nevisidm_operations_Realm /SAML2/ACS/* @@ -628,28 +552,6 @@ ModSecurity_OP-ONBRDNG-ModSecuritySettings /AUTH/ONBOARDING/* - - - ModSecurity_Web_Application_canaryPage_backend - /canary/api/* - - - - CSRF_Default - /canary/api/* - - - - CSRF_Default - /canary/* - ^/canary/api/.*$ - - - - ModSecurity_Web_Application_canaryPage_frontend - /canary/* - ^/canary/api/.*$ - Authentication_SAML_SP_nevisidm_operations_Realm @@ -661,17 +563,6 @@ /nevisidm/* - - Authentication_SAML_SP_nevisidm_operations_Realm - /canary/api/* - - - - Authentication_SAML_SP_nevisidm_operations_Realm - /canary/* - ^/canary/api/.*$ - - SAML_SAML_SP_nevisidm_operations_Realm /SAML2/ACS/* @@ -691,16 +582,6 @@ Requirement_NEVIS_SecToken_SAML_SP_nevisidm_operations_Realm /nevisidm/* - - - Authorization_Required_Roles_nevisIdm.Helpdesk_nevisIdm.TemplateAdmin_nevisIdm.UserAndUnitAdmin_nevisIdm.AppAdmin_nevisIdm.UserAdmin_nevisIdm.AppOwner_nevisIdm.EnterpriseRoleAdmin_nevisIdm.ClientRoot_SAML_SP_nevisidm_operations_Realm - /nevisidm/* - - - - Authorization_Forbidden_Roles_nevisIdm.Root_SAML_SP_nevisidm_operations_Realm - /nevisidm/* - Token_NEVIS_SecToken @@ -858,78 +739,6 @@ /var/opt/keys/own/proxy-sp-saml-sp-nevisidm-operations-realm-identity/key.pem - - - Connector_Web_Application_canaryPage_backend - - ch::nevis::isiweb4::servlet::connector::http::HttpsConnectorServlet - - - AllowedMethods - ALL-HTTP,ALL-WEBDAV,-TRACE,-CONNECT - - - - AutoRewrite - header - - - - CookieManager - retain:^.*$ - - - - DNSCache.ttl - 60 - - - - InetAddress - canary-application-be.adn-agov-canary-01-dev:8081 - - - - UseSSL - false - - - - - Connector_Web_Application_canaryPage_frontend - - ch::nevis::isiweb4::servlet::connector::http::HttpsConnectorServlet - - - AllowedMethods - ALL-HTTP,ALL-WEBDAV,-TRACE,-CONNECT - - - - AutoRewrite - header - - - - CookieManager - retain:^.*$ - - - - DNSCache.ttl - 60 - - - - InetAddress - canary-application-fe.adn-agov-canary-01-dev:8080 - - - - UseSSL - false - - Connector_nevisIDM_Operations_Administration_GUI @@ -1050,16 +859,6 @@ Hosting_Default /SAML2/stepup/* - - - Connector_Web_Application_canaryPage_frontend - /canary/* - - - - Connector_Web_Application_canaryPage_backend - /canary/api/* - Connector_GreenMail