diff --git a/CHANGELOG.md b/CHANGELOG.md index f5b6e5e7e..617bbb6f5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,3 @@ -# UTMStack 10.8.3 Release Notes +# UTMStack 10.8.4 Release Notes -- Fixed a potential delay in log input in O365, AWS, and Sophos Central integrations. \ No newline at end of file +- Enhanced security and compliance by upgrading several internal components—most notably the update server—to exclusively support TLS 1.3. \ No newline at end of file diff --git a/agent-manager/auth/dependencies_interceptor.go b/agent-manager/auth/dependencies_interceptor.go deleted file mode 100644 index b1bc2980c..000000000 --- a/agent-manager/auth/dependencies_interceptor.go +++ /dev/null @@ -1,45 +0,0 @@ -package auth - -import ( - "net/http" - "strconv" - - "github.com/gin-gonic/gin" - "google.golang.org/grpc/metadata" -) - -func HTTPAuthInterceptor() gin.HandlerFunc { - return func(c *gin.Context) { - connectionKey := c.GetHeader("connection-key") - id := c.GetHeader("id") - key := c.GetHeader("key") - requestURL := c.Request.URL.Path - - if connectionKey == "" && id == "" && key == "" { - c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "authentication is not provided"}) - return - } else if connectionKey != "" { - if err := authenticateRequest(metadata.New(map[string]string{"connection-key": connectionKey}), "connection-key"); err != nil { - c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid connection key"}) - return - } - } else if id != "" && key != "" { - idInt, err := strconv.ParseUint(id, 10, 32) - if err != nil { - c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "id is not valid"}) - return - } - - if err := checkKeyAuth(key, idInt, requestURL); err != nil { - c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid key"}) - return - } - - } else { - c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "invalid auth type"}) - return - } - - c.Next() - } -} diff --git a/agent-manager/updates/updates.go b/agent-manager/updates/updates.go index 4431ddb9c..03525e72c 100644 --- a/agent-manager/updates/updates.go +++ b/agent-manager/updates/updates.go @@ -1,11 +1,11 @@ package updates import ( + "crypto/tls" "net/http" "github.com/gin-contrib/gzip" "github.com/gin-gonic/gin" - "github.com/utmstack/UTMStack/agent-manager/auth" "github.com/utmstack/UTMStack/agent-manager/util" ) @@ -27,14 +27,38 @@ func ServeDependencies() { r.NoRoute(notFound) - group := r.Group("/private", auth.HTTPAuthInterceptor()) + group := r.Group("/private") group.StaticFS("/dependencies", http.Dir("/dependencies")) + cert, err := tls.LoadX509KeyPair("/cert/utm.crt", "/cert/utm.key") + if err != nil { + util.Logger.ErrorF("failed to load certificates: %v", err) + } + + tlsConfig := &tls.Config{ + MinVersion: tls.VersionTLS12, + Certificates: []tls.Certificate{cert}, + CipherSuites: []uint16{ + tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, + }, + + PreferServerCipherSuites: true, + } + + server := &http.Server{ + Addr: ":8080", + Handler: r, + TLSConfig: tlsConfig, + } + util.Logger.Info("Starting HTTP server on port 8080") - if err := r.RunTLS(":8080", "/cert/utm.crt", "/cert/utm.key"); err != nil { + err = server.ListenAndServeTLS("", "") + if err != nil { util.Logger.ErrorF("error starting HTTP server: %v", err) - return } + } func notFound(c *gin.Context) { diff --git a/agent/serv/clean-old.go b/agent/serv/clean-old.go index 0814da03f..6369a9ebd 100644 --- a/agent/serv/clean-old.go +++ b/agent/serv/clean-old.go @@ -51,14 +51,8 @@ func CleanOldServices(cnf *config.Config) { if oldVersion { utils.Logger.Info("old version of agent found, downloading new version") - headers := map[string]string{ - "key": cnf.AgentKey, - "id": fmt.Sprintf("%v", cnf.AgentID), - "type": "agent", - } - if runtime.GOOS != "darwin" { - if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, fmt.Sprintf(config.UpdaterSelf, "")), headers, fmt.Sprintf(config.UpdaterSelf, "_new"), utils.GetMyPath(), cnf.SkipCertValidation); err != nil { + if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, fmt.Sprintf(config.UpdaterSelf, "")), map[string]string{}, fmt.Sprintf(config.UpdaterSelf, "_new"), utils.GetMyPath(), cnf.SkipCertValidation); err != nil { utils.Logger.LogF(100, "error downloading updater: %v", err) return } diff --git a/agent/updates/dependencies.go b/agent/updates/dependencies.go index 56e59707e..5779c4838 100644 --- a/agent/updates/dependencies.go +++ b/agent/updates/dependencies.go @@ -12,15 +12,13 @@ import ( ) func DownloadFirstDependencies(address string, authKey string, insecure bool) error { - headers := map[string]string{"connection-key": authKey} - - if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, address, config.DependenciesPort, "version.json"), headers, "version.json", utils.GetMyPath(), insecure); err != nil { + if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, address, config.DependenciesPort, "version.json"), map[string]string{}, "version.json", utils.GetMyPath(), insecure); err != nil { return fmt.Errorf("error downloading version.json : %v", err) } dependFiles := config.DependFiles for _, file := range dependFiles { - if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, address, config.DependenciesPort, file), headers, file, utils.GetMyPath(), insecure); err != nil { + if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, address, config.DependenciesPort, file), map[string]string{}, file, utils.GetMyPath(), insecure); err != nil { return fmt.Errorf("error downloading file %s: %v", file, err) } } diff --git a/agent/updates/update.go b/agent/updates/update.go index e35b09add..a732f5640 100644 --- a/agent/updates/update.go +++ b/agent/updates/update.go @@ -29,13 +29,7 @@ func UpdateDependencies(cnf *config.Config) { for { time.Sleep(checkEvery) - headers := map[string]string{ - "key": cnf.AgentKey, - "id": fmt.Sprintf("%v", cnf.AgentID), - "type": "agent", - } - - if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, "version.json"), headers, "version_new.json", utils.GetMyPath(), cnf.SkipCertValidation); err != nil { + if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, "version.json"), map[string]string{}, "version_new.json", utils.GetMyPath(), cnf.SkipCertValidation); err != nil { utils.Logger.ErrorF("error downloading version.json: %v", err) continue } @@ -48,7 +42,7 @@ func UpdateDependencies(cnf *config.Config) { if newVersion.Version != currentVersion.Version { utils.Logger.Info("New version of agent found: %s", newVersion.Version) - if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, fmt.Sprintf(config.ServiceFile, "")), headers, fmt.Sprintf(config.ServiceFile, "_new"), utils.GetMyPath(), cnf.SkipCertValidation); err != nil { + if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, fmt.Sprintf(config.ServiceFile, "")), map[string]string{}, fmt.Sprintf(config.ServiceFile, "_new"), utils.GetMyPath(), cnf.SkipCertValidation); err != nil { utils.Logger.ErrorF("error downloading agent: %v", err) continue } diff --git a/bitdefender/server/server.go b/bitdefender/server/server.go index 81ee9a4bc..3e834b85c 100644 --- a/bitdefender/server/server.go +++ b/bitdefender/server/server.go @@ -1,6 +1,7 @@ package server import ( + "crypto/tls" "encoding/json" "net/http" "path/filepath" @@ -80,12 +81,17 @@ func ServerUp(cnf *types.ConfigurationSection, certsPath string) { _, _ = w.Write([]byte("Server is up and running")) }).Methods("GET") + tlsConfig := &tls.Config{ + MinVersion: tls.VersionTLS13, + } + server := &http.Server{ Addr: ":" + constants.GetConnectorPort(), Handler: r, ReadTimeout: 10 * time.Second, WriteTimeout: 10 * time.Second, MaxHeaderBytes: 1 << 20, + TLSConfig: tlsConfig, } go func() { diff --git a/frontend/src/app/app-module/guides/guide-as400/constants.ts b/frontend/src/app/app-module/guides/guide-as400/constants.ts index 37f0201ed..72e9d0ca6 100644 --- a/frontend/src/app/app-module/guides/guide-as400/constants.ts +++ b/frontend/src/app/app-module/guides/guide-as400/constants.ts @@ -5,9 +5,10 @@ export const PLATFORM = [ name: 'WINDOWS', install: `New-Item -ItemType Directory -Force -Path "C:\\Program Files\\UTMStack\\UTMStack Collectors\\AS400"; ` + `cd "C:\\Program Files\\UTMStack\\UTMStack Collectors\\AS400"; ` + - `Invoke-WebRequest -Uri "https://V_IP:9001/private/dependencies/collector/windows-as400-collector.zip" ` + - `-OutFile ".\\windows-as400-collector.zip"; Expand-Archive -Path ".\\windows-as400-collector.zip" ` + - `-DestinationPath "."; Remove-Item ".\\windows-as400-collector.zip"; Start-Process ".\\utmstack_collectors_installer.exe" ` + + `& curl.exe -k -o ".\\windows-as400-collector.zip" ` + + `"https://V_IP:9001/private/dependencies/collector/windows-as400-collector.zip"; ` + + `Expand-Archive -Path ".\\windows-as400-collector.zip" -DestinationPath "."; ` + + `Remove-Item ".\\windows-as400-collector.zip"; Start-Process ".\\utmstack_collectors_installer.exe" ` + `-ArgumentList 'install', 'as400', 'V_IP', 'V_TOKEN' -NoNewWindow -Wait`, uninstall: `cd "C:\\Program Files\\UTMStack\\UTMStack Collectors\\AS400"; ` + @@ -29,11 +30,11 @@ export const PLATFORM = [ name: 'LINUX UBUNTU', install: `sudo bash -c "apt update -y && apt install wget unzip -y && mkdir -p ` + `/opt/utmstack-linux-collectors/as400 && cd /opt/utmstack-linux-collectors/as400 && ` + - `wget --no-check-certificate --header='connection-key: V_TOKEN' ` + + `wget --no-check-certificate ` + `https://V_IP:9001/private/dependencies/collector/linux-as400-collector.zip ` + `&& unzip linux-as400-collector.zip && rm linux-as400-collector.zip && chmod -R 777 ` + `utmstack_collectors_installer && ./utmstack_collectors_installer install as400 ` + - `V_IP V_TOKEN"`, + `V_IP V_TOKEN"`, uninstall: `sudo bash -c " cd /opt/utmstack-linux-collectors/as400 && ./utmstack_collectors_installer ` + diff --git a/frontend/src/app/app-module/guides/guide-linux-agent/guide-linux-agent.component.ts b/frontend/src/app/app-module/guides/guide-linux-agent/guide-linux-agent.component.ts index e6854c368..1a25c1f73 100644 --- a/frontend/src/app/app-module/guides/guide-linux-agent/guide-linux-agent.component.ts +++ b/frontend/src/app/app-module/guides/guide-linux-agent/guide-linux-agent.component.ts @@ -37,7 +37,7 @@ export class GuideLinuxAgentComponent implements OnInit { const ip = window.location.host.includes(':') ? window.location.host.split(':')[0] : window.location.host; return `sudo bash -c "apt update -y && apt install wget -y && mkdir -p /opt/utmstack-linux-agent && \ - wget --no-check-certificate --header='connection-key: ${this.token}' -P /opt/utmstack-linux-agent \ + wget --no-check-certificate -P /opt/utmstack-linux-agent \ https://${ip}:9001/private/dependencies/agent/${installerName} && \ chmod -R 777 /opt/utmstack-linux-agent/${installerName} && \ /opt/utmstack-linux-agent/${installerName} install ${ip} ${this.token} yes"`; @@ -47,7 +47,7 @@ export class GuideLinuxAgentComponent implements OnInit { const ip = window.location.host.includes(':') ? window.location.host.split(':')[0] : window.location.host; return `sudo bash -c "yum install wget -y && mkdir -p /opt/utmstack-linux-agent && \ - wget --no-check-certificate --header='connection-key: ${this.token}' -P /opt/utmstack-linux-agent \ + wget --no-check-certificate -P /opt/utmstack-linux-agent \ https://${ip}:9001/private/dependencies/agent/${installerName} && \ chmod -R 777 /opt/utmstack-linux-agent/${installerName} && \ /opt/utmstack-linux-agent/${installerName} install ${ip} ${this.token} yes"`; @@ -57,7 +57,7 @@ export class GuideLinuxAgentComponent implements OnInit { const ip = window.location.host.includes(':') ? window.location.host.split(':')[0] : window.location.host; return `sudo bash -c "dnf install wget -y && mkdir -p /opt/utmstack-linux-agent && \ - wget --no-check-certificate --header='connection-key: ${this.token}' -P /opt/utmstack-linux-agent \ + wget --no-check-certificate -P /opt/utmstack-linux-agent \ https://${ip}:9001/private/dependencies/agent/${installerName} && \ chmod -R 777 /opt/utmstack-linux-agent/${installerName} && \ /opt/utmstack-linux-agent/${installerName} install ${ip} ${this.token} yes"`; diff --git a/frontend/src/app/app-module/guides/guide-winlogbeat/guide-winlogbeat.component.ts b/frontend/src/app/app-module/guides/guide-winlogbeat/guide-winlogbeat.component.ts index a7d2e7b4d..bca0c2878 100644 --- a/frontend/src/app/app-module/guides/guide-winlogbeat/guide-winlogbeat.component.ts +++ b/frontend/src/app/app-module/guides/guide-winlogbeat/guide-winlogbeat.component.ts @@ -56,8 +56,7 @@ export class GuideWinlogbeatComponent implements OnInit { const ip = window.location.host.includes(':') ? window.location.host.split(':')[0] : window.location.host; return `New-Item -ItemType Directory -Force -Path "C:\\Program Files\\UTMStack\\UTMStack Agent"; ` + - `& curl.exe -k -H "connection-key: ${this.token}" ` + - `-o "C:\\Program Files\\UTMStack\\UTMStack Agent\\${arch}" ` + + `& curl.exe -k -o "C:\\Program Files\\UTMStack\\UTMStack Agent\\${arch}" ` + `"https://${ip}:9001/private/dependencies/agent/${arch}"; ` + `Start-Process "C:\\Program Files\\UTMStack\\UTMStack Agent\\${arch}" ` + `-ArgumentList 'install', '${ip}', '${this.token}', 'yes' -NoNewWindow -Wait`; diff --git a/installer/templates/proxy.go b/installer/templates/proxy.go index 07dfb4bb0..56388bdf6 100644 --- a/installer/templates/proxy.go +++ b/installer/templates/proxy.go @@ -32,7 +32,7 @@ server { ssl_certificate /utmstack/cert/utm.crt; ssl_certificate_key /utmstack/cert/utm.key; - ssl_protocols TLSv1.2 TLSv1.3; + ssl_protocols TLSv1.3; ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; @@ -86,7 +86,7 @@ server { ssl_certificate /utmstack/cert/utm.crt; ssl_certificate_key /utmstack/cert/utm.key; - ssl_protocols TLSv1.2 TLSv1.3; + ssl_protocols TLSv1.3; ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; diff --git a/version.yml b/version.yml index 3b56e74f3..71d121f8c 100644 --- a/version.yml +++ b/version.yml @@ -1 +1 @@ -version: 10.8.3 \ No newline at end of file +version: 10.8.4 \ No newline at end of file