Skip to content

Commit

Permalink
Docs: proofread PR 619
Browse files Browse the repository at this point in the history
Signed-off-by: Jenni Nikolaenko <[email protected]>
  • Loading branch information
jenninikko authored and brianmcgillion committed Jun 14, 2024
1 parent ae44f59 commit fb42e01
Show file tree
Hide file tree
Showing 5 changed files with 319 additions and 479 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ Other repositories that are a part of the Ghaf project:

## Build System

Ghaf images are built and tested by our continuous integration system. For more information on a general process, see [Continuous Integration and Distribution](./docs/src/scs/ci-cd-system.md).
Ghaf images are built and tested by our continuous integration system. For more information on a general process, see [Continuous Integration and Distribution](https://tiiuae.github.io/ghaf/scs/ci-cd-system.html).

Targets: <https://github.com/tiiuae/ghaf/blob/main/hydrajobs.nix>
Hydra builders on x86 servers: <https://hydra.vedenemo.dev/>
Expand Down
6 changes: 3 additions & 3 deletions docs/src/SUMMARY.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,9 @@
- [Installer](ref_impl/installer.md)
- [Cross-Compilation](ref_impl/cross_compilation.md)
- [Creating Application VM](ref_impl/creating_appvm.md)
- [LabWC Desktop Environment](ref_impl/labwc.md)
- [Further Development of the idsvm](ref_impl/idsvm-development.md)
- [labwc Desktop Environment](ref_impl/labwc.md)
- [idsvm Further Development](ref_impl/idsvm-development.md)
- [systemd Service Hardening](ref_impl/systemd-service-config.md)
- [Ghaf as Library: Templates](ref_impl/ghaf-based-project.md)
- [Example Project](ref_impl/example_project.md)
- [Modules Options](ref_impl/modules_options.md)
Expand Down Expand Up @@ -68,7 +69,6 @@
- [Showcases](scenarios/showcases.md)
- [Running Windows VM on Ghaf](scenarios/run_win_vm.md)
- [Running Cuttlefish on Ghaf](scenarios/run_cuttlefish.md)
- [Build Your Environment]()

-----------

Expand Down
3 changes: 2 additions & 1 deletion docs/src/ref_impl/development.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ The scope of target support is updated with development progress:
* [Cross-Compilation](./cross_compilation.md)
* [Creating Application VM](./creating_appvm.md)
* [labwc Desktop Environment](./labwc.md)
* [Systemd Service Hardening](./systemd-service-config.md)
* [idsvm Further Development](./idsvm-development.md)
* [systemd Service Hardening](./systemd-service-config.md)

Once you are up and running, you can participate in the collaborative development process by building a development build with additional options. For example, with the development username and password that are defined in [accounts.nix](https://github.com/tiiuae/ghaf/blob/main/modules/common/users/accounts.nix).

Expand Down
8 changes: 4 additions & 4 deletions docs/src/ref_impl/idsvm-development.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@
SPDX-License-Identifier: CC-BY-SA-4.0
-->

# Futher Development of the idsvm
# idsvm Further Development

## About Implementation
## Implementation

The idsvm is implemented as a regular microVM with static IP.
The mitmproxy is included to demonstrative interactive proxy to enable analysis of TLS protected data on the fly. Also Snort network intrusion detection and prevention system package is included, but no dedicated UI nor proper utilization is provided.
Expand All @@ -14,7 +14,7 @@ Enforcing network traffic to go through idsvm is crucial part of the idsvm funct
It is achieved by setting the idsvm to be the gateway of other VMs in dnsmasq configuration
of netvm. There is a risk is that one could change gateway settings of the VM to bypass the idsvm. This however requires root (sudo) rights and it is assumed here that these rights are enabled only in debug build.

## About mitmproxy
## mitmproxy

"The mitmproxy is a free and open source interactive HTTPS proxy. It is your swiss-army knife for debugging, testing, privacy measurements, and penetration testing. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, WebSockets, or any other SSL/TLS-protected protocols."
https://mitmproxy.org/
Expand All @@ -25,7 +25,7 @@ Mitmproxy package also includes console tool that provides basically same functi
Mitmweb tool is run in idsvm as a systemd service. It starts automatically when idsvm boots up.
The UI it provides is accessible in the web address http://localhost:8081 so basically it is available from idsvm only. However using SSH portforwarfing it is possible to access the UI from other VMs. To that purpose the guivm has a script called mitmweb-ui. It creates a SSH tunnel between idsvm and chromium-vm, launches the Chromium and connects to the UI-address.

## About Certificates
## Certificates

Mitmproxy can decrypt encrypted traffic on the fly, as long as the client trusts mitmproxy's built-in certificate authority (CA). CA certificates are in hardcoded to the idsvm implementation which means they are same for all idsvm instances. In release version these should be randomly generated and stored securely.

Expand Down
Loading

0 comments on commit fb42e01

Please sign in to comment.