CyberMind-FR a35ab5c50e feat(secubox-mitmproxy): Phase 7.A.2 + 7.B — WAF backport + dashboard + rate-limit + honeypot (ref #498) ... Phase 7.A.2 + 7.B shipped same-day after Phase 7.A landing (#498 mid-day). ## Live verified on gk2 ### Phase 7.A.2 - `packages/secubox-waf/mitmproxy/secubox_waf.py` (older 756→878 lines) : backported `_load_crowdsec_cfg`, `_cs_jwt`, `_ban_via_crowdsec`, Phase 6.J Connection:close. Both WAF copies now in sync. - `debian/postinst` : auto-invokes `secubox-waf-cs-bridge-setup` if cscli present, installs config to host + bind-mounts into LXC if present. - `api/routers/waf.py` : new GET /enforcement returns bridge_enabled, bans_pushed/failed, requests, blocked, warnings, rate_limit_offenders (live nft set count), honeypot_hits_last_hour (from nginx log scan), recent_bans (cscli decisions list --origin=secubox-waf), recent_threats. - `www/mitmproxy/threats.html` : new tab with 6 KPI cards + 2 tables (bans, threats), auto-refresh 5s. ### Phase 7.B - `nftables/secubox-waf-ratelimit.nft` : table inet secubox_waf_ratelimit with offenders_v4/v6 (dynamic 5min timeout) + whitelist_v4 (LAN/loopback) + input hook priority -10. Rule : tcp SYN to 80/443, limit rate over 30/second burst 50 → drop + add to offenders. Live-loaded : table created, chain attached, ready to drop slowloris/scanners the moment they cross threshold. - `debian/secubox-waf-ratelimit.service` : systemd unit loads the nft file on boot (idempotent, RemainAfterExit=yes). - `nginx/honeypot.conf` : 5 location blocks for known bot signatures (`/wp-admin`, `/.env`, `/.git/config`, `/phpmyadmin`, `/actuator` etc). Returns empty 200, logs to `/var/log/nginx/honeypot.log` with custom `secubox_honeypot` log_format. Live-tested : 3 paths returned 200, honeypot.log filled in real-time. - `debian/postinst` : copies honeypot.conf to /etc/nginx/secubox-routes.d/ and creates log_format conf.d snippet. ### Files added packages/secubox-mitmproxy/nftables/secubox-waf-ratelimit.nft (NEW) packages/secubox-mitmproxy/nginx/honeypot.conf (NEW) packages/secubox-mitmproxy/www/mitmproxy/threats.html (NEW) packages/secubox-mitmproxy/debian/secubox-waf-ratelimit.service (NEW) ### Files modified packages/secubox-waf/mitmproxy/secubox_waf.py +120 lines packages/secubox-mitmproxy/api/routers/waf.py +130 lines packages/secubox-mitmproxy/debian/postinst +35 lines packages/secubox-mitmproxy/debian/rules +11 lines ## What's NOT in this commit (Phase 7.C, future) - eBPF/XDP kernel filter (replaces Python WAF hot-path) - ModSecurity in HAProxy with OWASP CRS rules - Federation : push to CrowdSec Hub + pull AlienVault OTX + Spamhaus DROP - Tune BAN_THRESHOLD per category (XSS=2, SQLi=1) Filed as remaining sub-tasks in issue #498 (kept open).		2026-06-05 17:23:00 +02:00
..
secubox-waf-ratelimit.nft	feat(secubox-mitmproxy): Phase 7.A.2 + 7.B — WAF backport + dashboard + rate-limit + honeypot (ref #498)	2026-06-05 17:23:00 +02:00