nginxinc / ansible-role-nginx-app-protect Goto Github PK

Describe the bug

When running role nginx_app_protect it's failing during fetch of app-protect-security-updates repository with error.

To reproduce

Steps to reproduce the behaviour:

1. Deploy NGINX App Protect role using deploy-nginx.yml using variables.

   role: nginx_app_protect
   vars:
   nginx_app_protect_license:
   certificate: "/nginx/nginx-repo.crt"
   key: "/nginx/nginx-repo.key"
   nginx_app_protect_setup_license: true
   nginx_app_protect_remove_license: false
   nginx_app_protect_install_signatures: true
   nginx_app_protect_install_threat_campaigns: true
   nginx_app_protect_configure: true
   nginx_app_protect_security_policy_template_enable: true
   nginx_app_protect_security_policy_enforcement_mode: blocking
   nginx_app_protect_log_policy_template_enable: true
   nginx_app_protect_log_policy_filter_request_type: all
   nginx_app_protect_conf_template_enable: false

2. First failure occurred in the role nginx_app_protect running below task.

2021-10-06T12:39:00.6291143Z TASK [nginxinc.nginx_core.nginx_app_protect : (Debian/Ubuntu) Install NGINX App Protect] ***
2021-10-06T12:39:00.6291745Z Wednesday 06 October 2021  12:39:00 +0000 (0:00:01.199)       0:04:33.252 ***** 
2021-10-06T12:39:00.6295209Z Wednesday 06 October 2021  12:39:00 +0000 (0:00:01.199)       0:04:33.251 ***** 
2021-10-06T12:39:34.0436592Z fatal: [SECNGXDEVSR1004]: FAILED! => {"changed": false, "msg": "Failed to update apt cache: E:Failed to fetch https://app-protect-security-updates.nginx.com/ubuntu/dists/bionic/InRelease  403  Forbidden [IP: 3.126.134.177 443], E:The repository 'https://app-protect-security-updates.nginx.com/ubuntu bionic InRelease' is not signed."}
2021-10-06T12:39:37.8032937Z fatal: [SECNGXDEVSR1003]: FAILED! => {"changed": false, "msg": "Failed to update apt cache: E:Failed to fetch https://app-protect-security-updates.nginx.com/ubuntu/dists/bionic/InRelease  403  Forbidden [IP: 52.59.52.27 443], E:The repository 'https://app-protect-security-updates.nginx.com/ubuntu bionic InRelease' is not signed."}
 runs tasks until we get to ;
fatal: [SECNGXDEVSR1004]: FAILED! => {"changed": false, "msg": "Failed to update apt cache: E:Failed to fetch https://app-protect-security-updates.nginx.com/ubuntu/dists/bionic/InRelease  403  Forbidden [IP: 3.126.134.177 443], E:The repository 'https://app-protect-security-updates.nginx.com/ubuntu bionic InRelease' is not signed."}

The second run failed much earlier during task in core.nginx role;

2021-10-06T15:36:15.4912739Z TASK [nginxinc.nginx_core.nginx : (Debian/Ubuntu) Install dependencies] ********
2021-10-06T15:36:15.4913704Z Wednesday 06 October 2021  15:36:15 +0000 (0:00:00.117)       0:03:49.313 ***** 
2021-10-06T15:36:15.4915801Z Wednesday 06 October 2021  15:36:15 +0000 (0:00:00.117)       0:03:49.313 ***** 
2021-10-06T15:36:52.5807900Z fatal: [SECNGXDEVSR1004]: FAILED! => {"changed": false, "msg": "Failed to update apt cache: E:Failed to fetch https://app-protect-security-updates.nginx.com/ubuntu/dists/bionic/InRelease  403  Forbidden [IP: 52.59.52.27 443], E:The repository 'https://app-protect-security-updates.nginx.com/ubuntu bionic InRelease' is not signed."}
2021-10-06T15:36:54.2451939Z fatal: [SECNGXDEVSR1003]: FAILED! => {"changed": false, "msg": "Failed to update apt cache: E:Failed to fetch https://app-protect-security-updates.nginx.com/ubuntu/dists/bionic/InRelease  403  Forbidden [IP: 52.59.52.27 443], E:The repository 'https://app-protect-security-updates.nginx.com/ubuntu bionic InRelease' is not signed."}

Expected behavior

Install roles core.nginx and core.nginx_app_protect

Your environment

NGINX App Protect role 0.3.0 (January 11, 2021)
ansible [core 2.11.4]
config file = /etc/ansible/ansible.cfg
configured module search path = ['/home/vmadmin/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/local/lib/python3.6/dist-packages/ansible
ansible collection location = /home/vmadmin/.ansible/collections:/usr/share/ansible/collections
executable location = /usr/local/bin/ansible
python version = 3.6.9 (default, Jan 26 2021, 15:33:00) [GCC 8.4.0]
jinja version = 2.10
libyaml = True

• agent running Ubuntu 18.04.5 LTS

Additional context

Failing at different points with same error.

We don't officially support CentOS/RHEL 8+. Should we keep it on our OS list ?

Describe the bug

While there is an option to remove the App Protect WAF package, no option exists for App Protect DoS.

Is your feature request related to a problem? Please describe.
Currently, the role will create JSON policy and log profiles based on a Jinja2 template, and the user cannot specify their own.

Describe the solution you'd like
In addition to the existing implementation, it would be good to be able to reference user-provided files to be used.

Describe alternatives you've considered
An alternative solution would be that the user could copy their own files to the target instance using their own playbook.

Is your feature request related to a problem? Please describe.
Customers that have a RHEL subscription want to use dependency packages maintained by Red Hat rather than the CentOS repositories.

Describe the solution you'd like
Provide the ability to specify the subscription using the yum-config-manager rather than using the CentOS repositories.

Describe alternatives you've considered
None

Additional context
Should be equivalent to the RHEL Subscription process in the App Protect documentation: https://docs.nginx.com/nginx-app-protect/admin-guide/#rhel-7-4-installation

Describe the bug
Get error:

TASK [nginx_app_protect : Copy NGINX App Protect certificate and license key] ***
fatal: [nginxwaf-0]: FAILED! => {"msg": "'nginx_app_protect_license' is undefined"}

nginx_app_protect_license is not described as a possible key/value in main.yaml
but it is called here

To reproduce
Steps to reproduce the behavior:
playbook.yaml.TXT

Expected behavior
Doc: add nginx_app_protect_license key

Your environment:

• Version of the NGINX App Protect role or specific commit: update collection before each job execution
• Version of Ansible: 2.9.7
• Target deployment platform: CentOS 7.4

Is your feature request related to a problem? Please describe

I would like the ability to pin the version of app protect and nginx plus so when this role is executed it installs the version specified instead of latest.

Describe the solution you'd like

Variables for app protect and nginx plus package versions.

Describe alternatives you've considered

Recommend approach to do this. For example, should you just make your own role to install nginx plus. Trying to use the official nginx ansible role.

Additional context

Need to remove the global disabling of SELinux on CentOS (and RHEL, future) for security reasons. Need to take a more surgical approach based on a couple of resources:

https://www.nginx.com/blog/using-nginx-plus-with-selinux/?_ga=2.151629625.1669196458.1589810351-710787638.1580222492

https://wiki.centos.org/HowTos/SELinux

Need to create molecule tests to ensure test coverage for this Ansible role following the guidelines at https://molecule.readthedocs.io/en/latest/

Currently, the role only supports installing the latest version of the signature package from the official repo. There is likely going to be a case to install a previous version of a signature package using this role.