societe-generale / octane

Securize the exposure of web applications through cloud service provider (currently AWS)

AWS cIAP OCTANE

What is OCTANE ?

OCTANE is:

• A cIAP (cloud Internet Access Point). Mainly, it is a security product between Internet and your public application hosted in your private zone
• The acronym (with imagination and goodwill) of Opensource cIAP Nextgen
• A Societe Generale Open Source project developped by Eric BOUTEVILLE within Public Cloud Feature Team (Cloud Center Of Excellence) of Societe Generale
• Compatible on AWS but can be modified to use another Cloud Service Provider (Azure, OpenStack, Vmware...) or bare-metal, most of components are Linux-based softwares

Why OCTANE ?

OCTANE can:

• Securly expose a WebSite to Internet
• Protect you against intrusions (SQL injection, cross-site scripting (XSS), file inclusion...) & virus
• Limit you against deny of service
• Detect malicious activities or policy violations
• Securly connect your external users to your internal zone
• Collect all the logs and provide metrics, search and analytics
• Be easly derivated on other x86 (Azure, OpenStack, Bare-Metal) platform in order to have the same Internet Access Point in a multi-cloud context

How (Architecture) ?

There are several layers (from the most exposed -Internet- to the less exposed -Internal-):

• redundant load-balancers
• redundant filtering layer
• redundant reverse-proxies
• redundant proxies with SSL terminaison
• redundant WAF or TCP relay (it depends on the protocol used)
• redundant Antivirus & IDS
• (not yet redundant) VPN
• redundant firewalls
• AWS private link or VPC peering (what suits you)

Those functionnalities are deployed by:

• The cloudformation template aims to build the AWS infrastructure (EC2, ELB...)
• The ansible playbook will configure all software components (inside EC2)

For further details, a more complete READme is available in each directory.

Detailed documentation

Architecture

• Detailled architecture
• Ansible
• CloudFormation

Run & Installation

• Run book
• Installation guide

Roadmap

• Azure version
• Autoscaling group implementation
• Common referential (LDAP/other), this will permit to link users to domains/VPN.
• API to manage web exposition
• WEB server choice: apache/nginx
• IDS choice: suricata/snort
• VPN choice: ipsec(strongswam)/wireguard/openvpn
• OpenStack version (idea)

License

GPLv2

Authors

This project has been created in 2018 by Eric BOUTEVILLE and Product Owner by Yannick NEFF

Contributors

• Anthony GEA
• Lucas BARRIERE
• Pierre LEVESQUE
• Yannick NEFF

Softwares / Used components

Sponsorship

octane's Issues

Azure Version

Build the Azure version of OCTANE

AWS API

APIs to manage (CRUD) :

• Web Exposition
• VPN Exposition

Typos, removed phantom tasks, added pip requirements.txt

No PROXY for Browsing

Make proxy for browsing not mandatory (use Public IP on Azure or Internet Gateway on AWS)

AWS AutoScallingGroup

Add AWS AutoScallinGroup