Setup Reverse Proxy for Cortex

By Adrian | September 26, 2019

This is part 6 of the Cortex build. In this part I’ll add, configure and test out an analyser. Links to the previous articles are here:

Part I - Building TheHive
Part II - Setup reverse proxy for TheHive
Part III - Building MISP
Part IV - Building Cortex
Part V - Adding analyzers to Cortex
Part VI - Setup reverse proxy for Cortex
Part VII - Integrate TheHive and Cortex
Part VIII - Integrate MISP to TheHive
Part IX - Upgrading TheHive
Part X - Updating MISP
Part XI - Upgrading Cortex
Part XII - Wrapup of TheHive, MISP, Cortex

Similar to how I setup the reverse proxy for TheHive in part II, I will pretty much follow the same steps and this time incorporate some learnings from that along the way.

Install Pre-Reqs

So that we can generate our certificate using LetsEncrypt, we need to install a few items

# Install certbot components
sudo apt-get update
sudo apt-get install software-properties-common
sudo add-apt-repository universe
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install certbot python-certbot-nginx

# Add in the route53 extension to certbot, python3-pip has already been installed with the Cortex analysers
# sudo apt install python3-pip
sudo pip3 install certbot-dns-route53

Now we need to get the awscli package and configure it. Ensure that you have configured the programatic access for the account you plan to use. This account will require API access to Route53.

# Get the awscli package
sudo apt-get install awscli

# You can configure the aws credentials with this command.  You will need to create an account in AWS with the correct permissions
sudo aws configure

Generate the certificate

sudo certbot certonly --dns-route53 -d 'cortex.example.com' --server https://acme-v02.api.letsencrypt.org/directory -m youremail@example.com --non-interactive --agree-tos

# Output
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Found credentials in shared credentials file: ~/.aws/credentials
Plugins selected: Authenticator dns-route53, Installer None
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for cortex.example.com
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/cortex.example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/cortex.example.com/privkey.pem
   Your cert will expire on 2019-12-24. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

All going well you should have the .pem files saved out to /etc/letsencrypt/live/cortex.example.com/fullchain.pem

Configure nginx

First start the service and enable on reboot using these commands:

sudo systemctl start nginx
sudo systemctl enable nginx

Create /etc/nginx/sites-enabled/cortex.conf with the following config

server {
       listen         80;
       server_name    cortex.example.com;
       return         301 https://$server_name$request_uri;
}

server {
  listen 443 ssl;
  server_name cortex.example.com;

  ssl on;
  ssl_certificate       /etc/letsencrypt/live/cortex.example.com/cert.pem;
  ssl_certificate_key   /etc/letsencrypt/live/cortex.example.com/privkey.pem;

  proxy_connect_timeout   600;
  proxy_send_timeout      600;
  proxy_read_timeout      600;
  send_timeout            600;
  client_max_body_size    2G;
  proxy_buffering off;
  client_header_buffer_size 8k;

  location / {
    add_header              Strict-Transport-Security "max-age=31536000; includeSubDomains";
    proxy_pass              http://127.0.0.1:9001/;
    proxy_http_version      1.1;
  }
}

Confim that the nginx config is ok

sudo nginx -t

Reload the nginx config with this command

sudo nginx -s reload

Test that you can access your instance of Cortex via https now. Even if you navigate using straight http you will be redirected to https.

In the next part of this series, we will complete the integration between TheHive and Coretex.

Search

Tags