diff --git a/public/docs-static/img/how-to-guides/add-posture-check.png b/public/docs-static/img/how-to-guides/add-posture-check.png new file mode 100644 index 00000000..c6d2650e Binary files /dev/null and b/public/docs-static/img/how-to-guides/add-posture-check.png differ diff --git a/public/docs-static/img/how-to-guides/netbird-version-check.png b/public/docs-static/img/how-to-guides/netbird-version-check.png new file mode 100644 index 00000000..8f82e93f Binary files /dev/null and b/public/docs-static/img/how-to-guides/netbird-version-check.png differ diff --git a/public/docs-static/img/how-to-guides/policies-list.png b/public/docs-static/img/how-to-guides/policies-list.png new file mode 100644 index 00000000..a6be5b35 Binary files /dev/null and b/public/docs-static/img/how-to-guides/policies-list.png differ diff --git a/public/docs-static/img/how-to-guides/policy-new-posture-check.png b/public/docs-static/img/how-to-guides/policy-new-posture-check.png new file mode 100644 index 00000000..a9775e13 Binary files /dev/null and b/public/docs-static/img/how-to-guides/policy-new-posture-check.png differ diff --git a/public/docs-static/img/how-to-guides/policy-posture-checks-assigned.png b/public/docs-static/img/how-to-guides/policy-posture-checks-assigned.png new file mode 100644 index 00000000..6dae216f Binary files /dev/null and b/public/docs-static/img/how-to-guides/policy-posture-checks-assigned.png differ diff --git a/public/docs-static/img/how-to-guides/policy-posture-checks-select.png b/public/docs-static/img/how-to-guides/policy-posture-checks-select.png new file mode 100644 index 00000000..6b101769 Binary files /dev/null and b/public/docs-static/img/how-to-guides/policy-posture-checks-select.png differ diff --git a/public/docs-static/img/how-to-guides/posture-check-create-list.png b/public/docs-static/img/how-to-guides/posture-check-create-list.png new file mode 100644 index 00000000..5b1f6254 Binary files /dev/null and b/public/docs-static/img/how-to-guides/posture-check-create-list.png differ diff --git a/public/docs-static/img/how-to-guides/posture-check-netbird-version-enabled.png b/public/docs-static/img/how-to-guides/posture-check-netbird-version-enabled.png new file mode 100644 index 00000000..9154858d Binary files /dev/null and b/public/docs-static/img/how-to-guides/posture-check-netbird-version-enabled.png differ diff --git a/public/docs-static/img/how-to-guides/posture-check-post-config.png b/public/docs-static/img/how-to-guides/posture-check-post-config.png new file mode 100644 index 00000000..5770e9e1 Binary files /dev/null and b/public/docs-static/img/how-to-guides/posture-check-post-config.png differ diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx index 62294cce..8c2dab57 100644 --- a/src/components/NavigationDocs.jsx +++ b/src/components/NavigationDocs.jsx @@ -62,6 +62,7 @@ export const docsNavigation = [ { title: 'CLI', href: '/how-to/cli' }, { title: 'Delete your NetBird account', href: '/how-to/delete-account' }, { title: 'IdP sync', href: '/how-to/idp-sync' }, + { title: 'Manage access with posture checks', href: '/how-to/manage-posture-checks' }, { title: 'Report bugs and issues', href: '/how-to/report-bug-issues' }, { title: 'Troubleshooting client issues', href: '/how-to/troubleshooting-client' }, ], diff --git a/src/pages/how-to/manage-posture-checks.mdx b/src/pages/how-to/manage-posture-checks.mdx new file mode 100644 index 00000000..3e2a4adb --- /dev/null +++ b/src/pages/how-to/manage-posture-checks.mdx @@ -0,0 +1,120 @@ +# Manage access with posture checks + +NetBird enables administrators to manage network access by creating access policies that dictate +which peer groups can interact with other peers in your network. +Posture checks extend these policies, augmenting their capabilities by allowing administrators to +enforce access restrictions based on specified criteria. By integrating posture checks seamlessly +into policy-based ACLs, NetBird evaluates various attributes to determine the eligibility of peers to +connect to the network. + +## Concepts + +### NetBird client version check + +The NetBird client version check verifies the version of NetBird installed on the device attempting to connect to the +network. This check ensures that only devices running a specified version of NetBird can gain access, +thus preventing outdated or incompatible clients from compromising network security. + +### Operating system version check + +The operating system version check evaluates the operating system (OS) version running on the connecting device. +This check allows for enforcing minimum OS requirements, ensuring that only devices with up-to-date and +secure operating systems can access network resources. + + + This check requires NetBird version [0.26.0](https://github.com/netbirdio/netbird/releases) or newer. + + +The check evaluates the actual `OS version` for Android, macOS, and iOS, while for Linux and Windows, it assesses +the `kernel version`. + +Below are some examples of OS versions for each operating system: + +* Android 14 Upside Down Cake: `14`, `14.3` +* macIS 13 Ventura: `13`, `13.6.4` +* macOS 14 Sonoma: `14`, `14.3.1` +* iOS 16 / iPadOS 16: `16`, `16.7.5` +* Linux kernel: `6`, `6.7.5` +* Windows 10, version 22H2: `10.0.19045` +* Windows 11, version 23H2: `10.0.22631` +* Windows Server 2022, Version 21H2: `10.0.20348` + +### Geolocation check + +The geolocation check examines the connecting device's geographical location based on its IP address. +This check allows administrators to enforce access restrictions based on geographic regions, +offering country-wide and city-level granularity. + +## Managing Posture Checks + +Posture Checks are dynamic, and you can create a policy with multiple posture checks. A single posture +check can also be reused across different policies. When managing posture checks, you can update them as +per your requirements. + +However, deleting a posture check is only possible if it's not currently used in any policy. If a posture +check is in use, you need to unassigned it from the respective policy before you can delete it. +This precaution ensures the continuity and integrity of your security setup. + +Here are some steps to help you create and manage your posture checks effectively: + +In the example below, we are creating a posture check that will only allow clients running NetBird version 0.25.0 or +higher to connect and access network resources. + +### Creating posture checks +Access the `Access Control` tab, the `Posture Checks` section and click `Create Posture Check`. + +

+ high-level-dia +

+ +That will open a posture checks configuration screen where you can configure the checks. + +

+ high-level-dia +

+ +Select the `NetBird Client Version` check option and set it with the following information: +- Version: `0.25.0` + +

+ high-level-dia +

+ +Click `Save`, and the `NetBird Client Version` check will be enabled. +

+ high-level-dia +

+ +Click `Continue`, fill out the form with the following information, and click `Create Posture Check` to save: +- Name of the posture check: `Netbird Version` +- Description: `Allow Netbird client with version 0.25.0 or greater` + +

+ high-level-dia +

+ +### Adding posture checks to policy + +Navigate to the `Access Control` tab and select the `Policies` section. + +

+ high-level-dia +

+ +Choose the policy to which you want to assign the posture check. This will open the policy update screen. Then, +select the `Posture Checks` tab. +

+ high-level-dia +

+ +Click `Browse Checks` and select the posture check we created earlier, `Netbird Version`. Then, click `Add Posture Checks`. + +

+ high-level-dia +

+ +The `Netbird Version` check will be assigned to the policy. Click `Save Changes` to save the policy updates. +

+ high-level-dia +

+