joola.ioWorkshopsSystemandSecurity

WorkshopDetailsandInstructions

AbouttheworkshopForsystemandsecurityengineers

Thisisahands-onworkshop

Labmaterialsareavailableforthisworkshop

ThisworkshopandmaterialsareavailableonourGitHubrepo

WorkshopGoalsUnderstandjoola.ioonallofitscomponents

Deployandconfigurejoola.io

Controlandmonitorjoola.io

Defineworkspaces,rolesandusers

Monitorsecurityviolations

LabDetailsDuringthisworkshopwe'llbeaccessinganonlinelab

PleaseSSHwiththefollowing

$sshworkshop@lab-sec.joola.io

Password:password

*accesstotheabovelabiswhitelisted

Understandingjoola.io

Whatisjoola.io?$npminstalljoola.io

DataAnalyticsandVisualizationFramework

Scalabletodealwithhighvolumesofdataandqueries

Secureandmulti-tenant

Embedandintegratedatavisualizationsintoexistingsites

OpenSource

ScalabilityandAvailabilityWritteninNode.JS

UsesRedisandMongoDB(bydefault)asunderlyingstores

Masterlessnode/gridbasedapproach

$nodejoola.io

EasilyscriptedusingPuppetorChefforVMdeployments

ASecureSystemMulti-tenancy

Allactionsareexecutedwithinacontext

Rolebasedpermissions

Cascadingsecurityfilters

Granularpermissionsoncontentanddata

$joola.io.cli-e"joolaio.users.list()"

RoleBasedPermissionsRolesaremappedtopermissions

Canvases,DimensionsandMetricsaremappedtoroles

UsersaremappedtoRoles

RolescanhaveFilters

DataIntegrationDataispushedusingRESTAPI

Multipledatastoretypesaresupported

Pushingisroleandpermissionsbased

Oncedataispushedin,it'simmediatelyavailable

Guaranteedwriteoperation

Scalabletosupportincreaseinwriteops

WebsiteIntegrationBundledJavascriptSDK

Copy-pasteVisualizations

Richdocumentationandexamples

AllAPIactionsaresupportedbySDK(CLIusesSDK)

RoleandPermissionsbased

DeployandConfigure

InstallandRunjoola.ioBeforeinstallingyouneedtohavenode,MongoDBandRedisinstalled.

$npminstalljoola.io-g

Torunjoola.io

$nodejoola.io

joola.ioisnowrunningandavailableonhttps://localhost:8080

Connecttojoola.ioConnecttojoola.ioeitherusingthewebinterface@https://localhost:8080

orusetheCLI

$npminstalljoola.io.cli-g$joola.io.cli

TheGridjoola.ioisgridbased,eachnodeispartofthehive

Master-less

Actionsarecarriedoverthegrid

Nothingiscommittedlocallytoasinglenode

$joola.io.cli

joola.io#admin@localhost:8080>joolaio.system.listnodes();

Connecttoasinglenodeandyou'reconnectedtotheentiregrid

ConfigurationBaseconfigurationstoredatconfig/baseline.json

Assumesredisisrunningonlocalhost

//getconfigvaluejoolaio.config.get('store');

//setconfigvaluejoolaio.config.set('store:cache:mongo:host','mymongoserver');

Overrideconfigsettingsby$joola.io--store:cache:redis:hostmyredishost

Authentication

SecurityContextBuilt-inAuthenticationStoreorSingleSignOn(SSO)

Supportsusername/passwordand/orAPITokens

Eachrequestisvalidatedforpermissions

Contentendpointsvalidatecontentpermissions

Dispatchedmessagescontainsecuritycontext

AuthenticationMethods//usingAPITokenjoolaio.init({APIToken:'apitoken'});

//usingusername/passwordjoolaio.users.authenticate('workspace','user','password',function(err,user){console.log(user);});

//server-sidejoolaio.users.authenticate('workspace','user','password',function(err,user){console.log('passthistoclientas_token',user.token);});//client-sidejoolaio.init({token:_token});

SingleSignOnUseAPItogeneratesecuritycontextandtokenandPassgeneratedtokentoSDK

//server-sidevaruser={username:'user',name:'DisplayName',_roles:['user'],_filter:['tag','eq','tagvalue']};joolaio.users.generateToken('workspace',user,function(err,token){//passtoken._downtotheSDK});//client-sidejoolaio.init({token:_token});

ControlandMonitor

Controllingjoola.ioStarting/Stopping

$joola.io#start$joola.io.cli-e"joolaio.system.terminate('nodeuid')"#stop

StopGrid$joola.io.cli-e"joolaio.system.shutdown()"

StatusReport$joola.io.cli-e"joolaio.system.nodelist()"

Daemonizing(PM2)WeusePM2fordaemonizingnode.jsprocesses

Arriveswithafullsuiteoftoolsandmonitors

Utilizesmulti-corestoallowverticalscaling

$npminstall-gpm2$pm2startjoola.io-imax

Thiswillstartjoola.ioonallavailablecores

LoggingEachnodehasthreeloggingchannels:localfs,MongoDB(bydefault)andin-memoryring-buffer.

Fornodespecificlogs,use`pm2logs`onthenodemachineorreviewlocalfs.

Foracentralizedlog,usethewebinterfaceorCLI.

$joola.io.cli-e"joolaio.logger.fetch()"

Thiswillprintoutthelast1,000loggedevents.

HealthMonitorDonebysamplingAPIendpoints

Dedicatedendpointsforsystem/nodestatus

Asimplenagiosforcheckinggeneralhealthdefineservice{usegeneric-servicehost_namehost.name.comservice_descriptionHTTPcheck_commandcheck_http!--port=8080check_interval1max_check_attempts3first_notification_delay0notifications_enabled1}

Workspaces,RolesandUsers

Multi-TenancySecureaccesswithdatafencing

[workspaces]|--[rootworkspace]|--[customworkspace]|--[roles]|--[users]|--[collections]|--[dimensions]|--[metrics]|--[canvases]|--[reports]|--[dashboards]|--[custom2workspace]

AddaWorkspaceWorkspaceisthetop-levelentity

varworkspace={id:'sampleWorkspace',name:'Thisisasampleworkspace'};

joolaio.workspaces.add(workspace,function(err,result){console.log(result);});

Nowthatwehaveaworkspace,wecancreaterolesandusers

AddaBeaconRole&UserTheBeaconuserwillpushdataintojoola.io

varrole={name:'beacon',permissions:['access_system','collections_stats','beacon_insert']};varuser={username:'beacon',_password:'beacon',_roles:['beacon'],workspace:'sampleWorkspace',APIToken:'apitoken-beacon'};joolaio.roles.add('sampleWorkspace',role);joolaio.users.add('sampleWorkspace',user);

AddaReaderRoleandUserTheReaderuserwillqueryandvisualizedata

varrole={name:'reader',permissions:['access_system','query_fetch']};varuser={username:'reader',_password:'reader',_roles:['reader'],workspace:'sampleWorkspace',APIToken:'apitoken-reader'};joolaio.roles.add('sampleWorkspace',role);joolaio.users.add('sampleWorkspace',user);

PushSomeDataSwitchtoBeaconuserandpushdata

joolaio.set('APIToken','apitoken-beacon');vardoc={timestamp:newDate(),machine:{hostname:'myhost',os:'centos6.5',uptime:123}open_files:123,no_of_logged_in_users};joolaio.beacon.insert('sampleCollection',doc);joolaio.collections.stats('sampleCollection')

SecurityAlertsandEvents

EventScreeningWescreenlogsforrelevanteventsusingCLI

$joola.io.cli-e"joolaio.logger.fetch({category:'security'})"

{time:'2014-03-04T19:05:42.605Z',msg:'Token[fFlzoNklT]isvalidforuser[root].',hostname:'lab01',pid:922,level:20,category:'security',req:{start_ts:'2014-03-04T19:05:42.590Z',remoteaddr:'127.0.0.1',params:{resource:'users',action:'verifyAPIToken',APIToken:'apitoken-root'},url:'api/users/verifyAPIToken',headers:{'joolaio-apitoken':'apitoken-root'}}}

SecurityAlerts$joola.io.cli-e"joolaio.alerts.add({key:'failed_login',endpoint:{type:'email',target:'alerts@joo.la'},query:{timeframe:'last_minute',dimensions:['username','password','token','APIToken','remoteaddr'],metrics:['failed_logins'],filter:[['event','eq','failed_login']]}});"