Set up SSL client certificate to protect dashboard

[tiguchi]

I'm a bit paranoid about leaving an administration dashboard out in the open, and would love to see an option for setting up SSL client certificate validation for the dashboard.

I guess the current workaround would be to install Netmaker natively and utilize NGINX for requiring client certificates, but I'd rather use the dockerized version instead. Is there already a way to configure the docker-compose.yml file to support that? Or would that impact Netmaker in a way so it cannot operate correctly?

[mattkasun]

I not sure I understand you question and it maybe due to vocabulary ... when you refer to clients accessing dashboard are you referring to netclient clients or brower clients.

All netmaker endpoints are secured with certificates via the reverse proxy (traefik) or self-signed certs in the case of MQ (MQ traffic can also be proxied)

where do you see the need for additional client certs

[tiguchi]

I'm talking about SSL client certificates in context of web browsers. At the moment the default installation of the Netmaker UI dashboard is accessible to anyone who knows the URL, and they could attempt to hack into an admin account using the login form, or possibly also exploit some known or unknown security vulnerabilities.

That possibility could be reduced by setting up the reverse proxy to require a valid SSL client certificate.

The equivalent NGINX configuration would look like this:

server {
    ssl_client_certificate /etc/nginx/certificates/client-cert-ca.pem;
    ssl_verify_client on;
    ...
}

That configuration would deny any browser without a valid client certificate access to the dashboard.

The client certificate would be added to the browser configuration of the administrator who is allowed to access the dashboard.

[mattkasun]

The default installation of netmaker uses traefik as a reverse proxy. Traefik automatically obtains certificates for the UI and API.

[tiguchi]

Yes, I noticed that traefik obtains Let's Encrypt server SSL certificates for the dashboard and API, and that feature works.

A client certificate is something different though:

Client certificates are, as the name indicates, used to identify a client or a user, authenticating the client to the server and establishing precisely who they are.

A regular server certificate is used by the server to authenticate to the client. A client certificate is used by the client to authenticate to the server, so it's the opposite authentication direction.

In reverse proxies like NGINX client certificate validation can be set up in addition to the regular server certificate, in order to verify that the client is authorized to access a resource. If validation passes, then NGINX proceeds as normal and serves the content. If it fails, then NGINX responds with a 400 bad request error by default, which would prevent the dashboard from being served to unauthorized users.

I'm not familiar with traefik, and glancing over their documentation they seem to be having some sort of support, but it's a bit over my head at the moment.
Since I also have other problems with the dockerized version of Netmaker, I will probably try to switch to a native installation and put NGINX in front of it.

[mattkasun]

Ok, now I am following you.... I understand your suggestion
question: how do you propose distributing client certificates to admin/user?

[afeiszli]

We now have instructions for locking down the dashboard to individual IP addresses. You can find it here: https://docs.netmaker.org/server-installation.html#security-settings