Skip to content

Commit 783a943

Browse files
mjangtravisamartin
mjang
and
travisamartin
committed
feat: Secure your fleet, NGINX One
This commit adds a new landing page archetype, which has the ability to display various cards to highlight specific items. The archetype includes inline guidance like other archetypes, including explanations of new frontmatter parameters and a new card shortcode. --------- Co-authored-by: Mike Jang <[email protected]> Co-authored-by: Alan Dooley <[email protected]> Co-authored-by: Alan Dooley <[email protected]> Co-authored-by: Travis Martin <[email protected]>
1 parent fea7686 commit 783a943

File tree

5 files changed

+208
-5
lines changed

5 files changed

+208
-5
lines changed

‎content/includes/nginx-one/how-to/generate-data-plane-key.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
docs:
3+
files:
4+
- content/nginx-one/secure-your-fleet/secure.md
5+
- content/nginx-one/getting-started.md
6+
---
7+
8+
A data plane key is a security token that ensures only trusted NGINX instances can register and communicate with NGINX One.
9+
10+
To generate a data plane key:
11+
12+
- **For a new key:** In the **Add Instance** pane, select **Generate Data Plane Key**.
13+
- **To reuse an existing key:** If you already have a data plane key and want to use it again, select **Use existing key**. Then, enter the key's value in the **Data Plane Key** box.
14+
15+
{{<call-out "caution" "Data plane key guidelines" "fas fa-key" >}}
16+
Data plane keys are displayed only once and cannot be retrieved later. Be sure to copy and store this key securely.
17+
18+
Data plane keys expire after one year. You can change this expiration date later by [editing the key]({{< ref "nginx-one/connect-instances/create-manage-data-plane-keys.md#change-expiration-date" >}}).
19+
20+
If you [Revoke a data plane key]({{< ref "nginx-one/connect-instances/create-manage-data-plane-keys.md#revoke-data-plane-key" >}}) you disconnect all instances registered with that key.
21+
{{</call-out>}}

‎content/includes/nginx-one/how-to/install-nginx-agent.md

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
docs:
3+
files:
4+
- content/nginx-one/secure-your-fleet/secure.md
5+
- content/nginx-one/getting-started.md
6+
---
7+
8+
After entering your data plane key, you'll see a `curl` command similar to the one below. Copy and run this command on each NGINX instance to install NGINX Agent. Once installed, NGINX Agent typically registers with NGINX One within a few seconds.
9+
10+
{{<call-out "important" "Connecting to NGINX One" >}}
11+
NGINX Agent must be able to establish a connection to NGINX One Console's Agent endpoint (`agent.connect.nginx.com`). Ensure that any firewall rules you have in place for your NGINX hosts allows network traffic to port `443` for all of the following IPs:
12+
13+
- `3.135.72.139`
14+
- `3.133.232.50`
15+
- `52.14.85.249`
16+
{{</call-out>}}
17+
18+
To install NGINX Agent on an NGINX instance:
19+
20+
1. **Check if NGINX is running and start it if it's not:**
21+
22+
First, see if NGINX is running:
23+
24+
```shell
25+
sudo systemctl status nginx
26+
```
27+
28+
If the status isn't `Active`, go ahead and start NGINX:
29+
30+
```shell
31+
sudo systemctl start nginx
32+
```
33+
34+
2. **Install NGINX Agent:**
35+
36+
Next, use the `curl` command provided to you to install NGINX Agent:
37+
38+
``` shell
39+
curl https://agent.connect.nginx.com/nginx-agent/install | DATA_PLANE_KEY="YOUR_DATA_PLANE_KEY" sh -s -- -y
40+
```
41+
42+
- Replace `YOUR_DATA_PLANE_KEY` with your actual data plane key.

‎content/nginx-one/_index.md

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,29 +34,32 @@ F5 NGINX One Console makes it easy to manage NGINX instances across locations an
3434
{{<card title="Connect more NGINX instances" titleUrl="/nginx-one/connect-instances/" >}}
3535
Work with data plane keys, containers, and proxy servers
3636
{{</card>}}
37+
{{<card title="Secure your fleet" titleUrl="/nginx-one/secure-your-fleet/" >}}
38+
Configure alerts that match your security policies
39+
{{</ card >}}
3740
{{<card title="Manage your NGINX instances" titleUrl="/nginx-one/nginx-configs/" >}}
3841
Manage one instance or groups of instances. Monitor certificates. Set up metrics.
3942
{{</card>}}
4043
{{<card title="Secure with NGINX App Protect" titleUrl="/nginx-one/nap-integration/" >}}
41-
Set up security policies by instance and group
44+
Manage one instance or groups of instances. Monitor certificates. Set up metrics.
4245
{{</card>}}
43-
{{<card title="Connect Kubernetes deployments" titleUrl="/nginx-one/k8s/">}}
44-
Monitor deployments for CVEs and certificates
45-
{{</ card >}}
4646
{{</card-section>}}
4747
{{</card-layout>}}
4848

4949
### More information
5050

5151
{{<card-layout>}}
5252
{{<card-section showAsCards="true" >}}
53+
{{<card title="Secure with NGINX App Protect" titleUrl="/nginx-one/nap-integration/" >}}
54+
Set up security policies by instance and group
55+
{{</card>}}
5356
{{<card title="Connect Kubernetes deployments" titleUrl="/nginx-one/k8s/">}}
5457
Monitor deployments for CVEs and certificates
5558
{{</ card >}}
5659
{{<card title="Organize users with RBAC" titleUrl="/nginx-one/rbac/" >}}
5760
Assign responsibilities with role-based access control
5861
{{</card>}}
59-
{{<card title="Automate with the NGINX One Console API" titleUrl="/nginx-one/api/" >}}
62+
{{<card title="Automate with the NGINX One API" titleUrl="/nginx-one/api/" >}}
6063
Manage your NGINX fleet over REST
6164
{{</card>}}
6265
{{<card title="Glossary" titleUrl="/nginx-one/glossary/" >}}

‎content/nginx-one/secure-your-fleet/_index.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
title: Secure your fleet
3+
description:
4+
weight: 450
5+
url: /nginx-one/secure-your-fleet
6+
---

‎content/nginx-one/secure-your-fleet/secure.md

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
---
2+
title: "Set up security alerts"
3+
weight: 500
4+
toc: true
5+
nd-content-type: how-to
6+
nd-product: NGINX One
7+
---
8+
9+
With this page, you'll learn how to set up alerts in F5 Distributed Cloud. Once configured, you'll see the CVEs and insecure configurations associated with your NGINX fleet. These instructions are intended for those responsible for keeping their NGINX infrastructure and application traffic secure. It assumes you know how to:
10+
11+
- Install Linux programs or run Docker containers
12+
13+
By the end of this tutorial, you'll be able to:
14+
15+
- Access the NGINX One Console in F5 Distributed Cloud
16+
- Connect NGINX instances to the NGINX One Console
17+
- Review Security Risks associated with your NGINX fleet
18+
- Configure Alert Policies in F5 Distributed Cloud
19+
20+
## Background
21+
22+
NGINX One Console is a service to monitor and manage NGINX. It's a part of the F5 Distributed Cloud and is included with all NGINX and F5 Distributed Cloud subscriptions. While NGINX is built to be secure and stable, critical vulnerabilities can occasionally emerge – and misconfigurations may leave your applications or APIs exposed to attacks.
23+
24+
## Before you begin
25+
26+
If you already have accessed F5 Distributed Cloud and have NGINX instances available, you can skip these steps and start to connect instances to the NGINX One Console.
27+
28+
### Confirm access to the F5 Distributed Cloud
29+
30+
Confirm an F5 Distributed Cloud tenant has been provisioned for you. Log in to MyF5 and review your subscriptions. You should see within one of your subscriptions "Distributed Cloud". This could be in either an NGINX subscription or a Distributed Cloud. If the above does not appear in any of your subscriptions, reach out to either your F5 Account Team or Customer Success Manager.
31+
32+
With access, you or someone in your organization should have an email from [email protected] asking you to update your password when the tenant was created. The account name referenced in the email in bold is the tenant name.
33+
34+
Go to https://INSERT_YOUR_TENANT_NAME.console.ves.volterra.io/ to access F5 Distributed Cloud. If you have never logged in, select the **Forgot Password?** option in the log in screen. Alternatively, if someone within your organization has access, ask them to add you as a user within your tenant with a role providing permissions for NGINX One.
35+
36+
### Confirm access to NGINX One Console in the F5 Distributed Cloud
37+
38+
Once you've logged in with your password, you should be able to see and select the NGINX One tile.
39+
40+
1. Select the **NGINX One** tile
41+
1. Select **Visit Service**
42+
43+
### Install an instance of NGINX
44+
45+
Ensure you have an instance of [NGINX Open Source or NGINX Plus]({{< ref "/nginx/admin-guide/installing-nginx/" >}}) installed and available. This guide provides instructions for connecting an instance installed in a Linux environment (VM or bare metal hardware) where you have command line access.
46+
Alternatively, we also have instructions for [Deploying NGINX and NGINX Plus with Docker]({{< ref "/nginx/admin-guide/installing-nginx/installing-nginx-docker.md" >}}) with NGINX and the NGINX Agent installed. That deployment can connect with environment variables.
47+
48+
## Connect at least one NGINX instance to the NGINX One Console
49+
50+
If you already have connected instances to the NGINX One Console, you can start to [Configure an active alert policy]({{< ref "/nginx-one/secure-your-fleet/secure.md#configure-an-active-alert-policy" >}}).
51+
Otherwise, you need to generate a data plane key, add an instance, and install NGINX Agent. We assume this is the first time you are connecting an instance.
52+
53+
### Add an instance
54+
55+
{{< include "/nginx-one/how-to/add-instance.md" >}}
56+
57+
### Generate a data plane key
58+
59+
{{< include "/nginx-one/how-to/generate-data-plane-key.md" >}}
60+
61+
### Install NGINX Agent
62+
63+
{{< include "/nginx-one/how-to/install-nginx-agent.md" >}}
64+
65+
You can also install NGINX Agent from our repositories and configure it manually. Alternatively you can use our official NGINX Docker images, pre-configured with NGINX Agent.
66+
67+
## Configure an active alert policy
68+
69+
The NGINX One Console monitors all connected NGINX instances for CVEs and insecure configurations. Using the F5 Distributed Cloud's Alert Policies, you can receive alerts for these risks in a manner of your choosing; for the purposes of this guide, we show you how to configure email alerts.
70+
71+
The F5 Distributed Cloud generates alerts from all its services including NGINX One Console. You can configure rules to send those alerts to a receiver of your choice. These instructions walk you through how to configure an email notification when we see new CVEs or detect security issues with your NGINX instances.
72+
73+
This page describes basic steps to set up an email alert. For authoritative documentation, see
74+
[Alerts - Email & SMS](https://docs.cloud.f5.com/docs-v2/shared-configuration/how-tos/alerting/alerts-email-sms).
75+
76+
## Configure alerts to be sent to your email
77+
78+
To configure security-related alerts, follow these steps:
79+
80+
1. Go to the F5 Distributed Cloud Console at https://INSERT_YOUR_TENANT_NAME.console.ves.volterra.io.
81+
1. Select **Audit Logs & Alerts**
82+
1. Select **Alerts Management > Alert Receivers**
83+
1. Select **Add Alert Receiver**
84+
1. Enter the name of your choice.
85+
1. (Optional) Specify a label and description.
86+
1. Under **Receiver**, select **Email** and enter your email address.
87+
1. Select **Add Alert Receiver**
88+
1. Your email receiver should now appear on the list of Alert Receivers.
89+
1. Under the **Actions** column, select **Verify Email**.
90+
1. Select **Send email** to confirm.
91+
1. You should receive a verification code in the email provided. Copy that code.
92+
1. Under the **Actions** column, select **Enter verification code**.
93+
1. Paste the code and select **Verify receiver**.
94+
95+
## Configure Alert Policy
96+
97+
Next, configure the policy that identifies when you'll get an alert.
98+
99+
1. Go to **Alerts Management > Alert Policies**.
100+
1. Select **Add Alert Policy**.
101+
1. Enter the name of your choice.
102+
1. (Optional) Specify a label and description.
103+
1. Under **Alert Reciever Configuration > Alert Receivers,** select the **Alert Receiver** you just created.
104+
1. Under **Policy Rules** select **Configure**.
105+
1. Select **Add Item**.
106+
1. Under **Select Alerts** select a filter. If you're interested in all NGINX alerts, select **Matching RegEx of Alertname**. In the text box that appears, enter **NGINX**.
107+
1. Set the **Action as Send** and select **Apply**.
108+
1. Select **Apply** again, and then select **Apply Alert Policy**.
109+
110+
Now set a second alert related to Common Vulnerabilities and Exposures (CVEs).
111+
112+
1. Select **Add Item**
113+
1. Under **Select Alerts**, set the **Action** as **Send** and select **Apply**
114+
1. Select **Save and Exit**
115+
116+
You've now set up F5 Distributed Cloud to send you security-related alerts from NGINX One Console.
117+
118+
## Summary
119+
120+
In this tutorial, you learned how to:
121+
122+
- Access the NGINX One Console
123+
- Connect an NGINX instance
124+
- Configure an Alert
125+
126+
You will now receive an email any time the NGINX One Console recognizes one of your connected instances has a configuration that is insecure or an NGINX CVE impacts it.
127+
128+
## Next steps
129+
130+
Now that you have NGINX instances connected to the NGINX One Console, consider reviewing our [use cases]({{< ref "/nginx-one/" >}}) to see how you can easily manage your NGINX instances, draft new configurations, and more.
131+
Additionally, you can review how to add additional Alert Receivers such as [SMS](https://docs.cloud.f5.com/docs-v2/shared-configuration/how-tos/alerting/alerts-email-sms), [Slack](https://docs.cloud.f5.com/docs-v2/shared-configuration/how-tos/alerting/alerts-slack), [PagerDuty](https://docs.cloud.f5.com/docs-v2/shared-configuration/how-tos/alerting/alerts-pagerduty), or with a [webhook](https://docs.cloud.f5.com/docs-v2/shared-configuration/how-tos/alerting/alerts-webhook).

0 commit comments

Comments
 (0)