mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 18:36:55 +00:00
CyberMind-FR
b0ae4f1f23
Add placeholder pages for sidebar links: - Architecture-Modules.md - Architecture-Security.md - Configuration-Advanced.md - Modules-Networking.md - Modules-Security.md - QEMU-ARM64.md Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
167 lines
2.8 KiB
Markdown
167 lines
2.8 KiB
Markdown
# Configuration Advanced
|
|
|
|
Advanced configuration options for SecuBox OS.
|
|
|
|
---
|
|
|
|
## Configuration Files
|
|
|
|
| File | Description |
|
|
|------|-------------|
|
|
| `/etc/secubox/secubox.conf` | Main TOML configuration |
|
|
| `/etc/secubox/modules.d/` | Per-module configs |
|
|
| `/etc/netplan/*.yaml` | Network configuration |
|
|
| `/etc/nftables.conf` | Firewall rules |
|
|
|
|
---
|
|
|
|
## TOML Configuration
|
|
|
|
### Main Config
|
|
|
|
```toml
|
|
# /etc/secubox/secubox.conf
|
|
|
|
[system]
|
|
hostname = "secubox"
|
|
timezone = "Europe/Paris"
|
|
locale = "fr_FR.UTF-8"
|
|
|
|
[api]
|
|
listen = "/run/secubox/api.sock"
|
|
jwt_secret_file = "/etc/secubox/secrets/jwt.key"
|
|
jwt_expiry = 3600
|
|
|
|
[logging]
|
|
level = "info"
|
|
audit_log = "/var/log/secubox/audit.log"
|
|
```
|
|
|
|
### Module Config Example
|
|
|
|
```toml
|
|
# /etc/secubox/modules.d/crowdsec.toml
|
|
|
|
[crowdsec]
|
|
enabled = true
|
|
api_url = "http://127.0.0.1:8080"
|
|
bouncer_key_file = "/etc/secubox/secrets/crowdsec-bouncer.key"
|
|
|
|
[crowdsec.thresholds]
|
|
ban_duration = "4h"
|
|
captcha_duration = "1h"
|
|
```
|
|
|
|
---
|
|
|
|
## Network Modes
|
|
|
|
### Router Mode (Default)
|
|
|
|
```yaml
|
|
# /etc/netplan/00-secubox.yaml
|
|
network:
|
|
version: 2
|
|
ethernets:
|
|
wan0:
|
|
dhcp4: true
|
|
bridges:
|
|
br-lan:
|
|
interfaces: [lan0, lan1]
|
|
addresses: [192.168.1.1/24]
|
|
dhcp4: false
|
|
```
|
|
|
|
### Bridge Mode
|
|
|
|
```yaml
|
|
network:
|
|
version: 2
|
|
bridges:
|
|
br0:
|
|
interfaces: [wan0, lan0, lan1]
|
|
dhcp4: true
|
|
```
|
|
|
|
---
|
|
|
|
## Firewall Rules
|
|
|
|
### Add Custom Rule
|
|
|
|
```bash
|
|
# Allow specific port
|
|
nft add rule inet filter input tcp dport 8080 accept
|
|
|
|
# Block IP
|
|
nft add rule inet filter input ip saddr 1.2.3.4 drop
|
|
|
|
# Save rules
|
|
nft list ruleset > /etc/nftables.conf
|
|
```
|
|
|
|
### Default Policy
|
|
|
|
SecuBox uses **DEFAULT DROP** policy:
|
|
- All incoming blocked except established
|
|
- All outgoing allowed
|
|
- Explicit rules for services
|
|
|
|
---
|
|
|
|
## API Authentication
|
|
|
|
### Generate New JWT Secret
|
|
|
|
```bash
|
|
openssl rand -base64 32 > /etc/secubox/secrets/jwt.key
|
|
chmod 600 /etc/secubox/secrets/jwt.key
|
|
systemctl restart secubox-api
|
|
```
|
|
|
|
### API Token
|
|
|
|
```bash
|
|
# Get token
|
|
curl -X POST https://localhost:9443/api/v1/auth/login \
|
|
-d '{"username":"admin","password":"secubox"}' \
|
|
-H "Content-Type: application/json"
|
|
|
|
# Use token
|
|
curl -H "Authorization: Bearer <token>" \
|
|
https://localhost:9443/api/v1/system/status
|
|
```
|
|
|
|
---
|
|
|
|
## Double-Buffer Configuration
|
|
|
|
SecuBox uses PARAMETERS double-buffer for safe config changes:
|
|
|
|
```
|
|
/etc/secubox/
|
|
├── active/ ← Live config (read-only)
|
|
├── shadow/ ← Edit here
|
|
└── rollback/ ← R1-R4 snapshots
|
|
```
|
|
|
|
### Swap Config
|
|
|
|
```bash
|
|
secubox-config validate # Validate shadow
|
|
secubox-config swap # Atomic swap
|
|
secubox-config rollback # Revert to R1
|
|
```
|
|
|
|
---
|
|
|
|
## See Also
|
|
|
|
- [[Configuration]] — Basic configuration
|
|
- [[Troubleshooting]] — Common issues
|
|
- [[Architecture-Security]] — Security model
|
|
|
|
---
|
|
|
|
*← Back to [[Home|SecuBox OS]]*
|