Add posture checks doc (#144)
BIN
public/docs-static/img/how-to-guides/add-posture-check.png
Normal file
|
After Width: | Height: | Size: 164 KiB |
BIN
public/docs-static/img/how-to-guides/netbird-version-check.png
Normal file
|
After Width: | Height: | Size: 36 KiB |
BIN
public/docs-static/img/how-to-guides/policies-list.png
Normal file
|
After Width: | Height: | Size: 73 KiB |
|
After Width: | Height: | Size: 47 KiB |
|
After Width: | Height: | Size: 41 KiB |
|
After Width: | Height: | Size: 38 KiB |
|
After Width: | Height: | Size: 52 KiB |
|
After Width: | Height: | Size: 56 KiB |
|
After Width: | Height: | Size: 51 KiB |
@@ -62,6 +62,7 @@ export const docsNavigation = [
|
|||||||
{ title: 'CLI', href: '/how-to/cli' },
|
{ title: 'CLI', href: '/how-to/cli' },
|
||||||
{ title: 'Delete your NetBird account', href: '/how-to/delete-account' },
|
{ title: 'Delete your NetBird account', href: '/how-to/delete-account' },
|
||||||
{ title: 'IdP sync', href: '/how-to/idp-sync' },
|
{ title: 'IdP sync', href: '/how-to/idp-sync' },
|
||||||
|
{ title: 'Manage access with posture checks', href: '/how-to/manage-posture-checks' },
|
||||||
{ title: 'Report bugs and issues', href: '/how-to/report-bug-issues' },
|
{ title: 'Report bugs and issues', href: '/how-to/report-bug-issues' },
|
||||||
{ title: 'Troubleshooting client issues', href: '/how-to/troubleshooting-client' },
|
{ title: 'Troubleshooting client issues', href: '/how-to/troubleshooting-client' },
|
||||||
],
|
],
|
||||||
|
|||||||
120
src/pages/how-to/manage-posture-checks.mdx
Normal file
@@ -0,0 +1,120 @@
|
|||||||
|
# Manage access with posture checks
|
||||||
|
|
||||||
|
NetBird enables administrators to manage network access by creating access policies that dictate
|
||||||
|
which peer groups can interact with other peers in your network.
|
||||||
|
Posture checks extend these policies, augmenting their capabilities by allowing administrators to
|
||||||
|
enforce access restrictions based on specified criteria. By integrating posture checks seamlessly
|
||||||
|
into policy-based ACLs, NetBird evaluates various attributes to determine the eligibility of peers to
|
||||||
|
connect to the network.
|
||||||
|
|
||||||
|
## Concepts
|
||||||
|
|
||||||
|
### NetBird client version check
|
||||||
|
|
||||||
|
The NetBird client version check verifies the version of NetBird installed on the device attempting to connect to the
|
||||||
|
network. This check ensures that only devices running a specified version of NetBird can gain access,
|
||||||
|
thus preventing outdated or incompatible clients from compromising network security.
|
||||||
|
|
||||||
|
### Operating system version check
|
||||||
|
|
||||||
|
The operating system version check evaluates the operating system (OS) version running on the connecting device.
|
||||||
|
This check allows for enforcing minimum OS requirements, ensuring that only devices with up-to-date and
|
||||||
|
secure operating systems can access network resources.
|
||||||
|
|
||||||
|
<Note>
|
||||||
|
This check requires NetBird version [0.26.0](https://github.com/netbirdio/netbird/releases) or newer.
|
||||||
|
</Note>
|
||||||
|
|
||||||
|
The check evaluates the actual `OS version` for Android, macOS, and iOS, while for Linux and Windows, it assesses
|
||||||
|
the `kernel version`.
|
||||||
|
|
||||||
|
Below are some examples of OS versions for each operating system:
|
||||||
|
|
||||||
|
* Android 14 Upside Down Cake: `14`, `14.3`
|
||||||
|
* macIS 13 Ventura: `13`, `13.6.4`
|
||||||
|
* macOS 14 Sonoma: `14`, `14.3.1`
|
||||||
|
* iOS 16 / iPadOS 16: `16`, `16.7.5`
|
||||||
|
* Linux kernel: `6`, `6.7.5`
|
||||||
|
* Windows 10, version 22H2: `10.0.19045`
|
||||||
|
* Windows 11, version 23H2: `10.0.22631`
|
||||||
|
* Windows Server 2022, Version 21H2: `10.0.20348`
|
||||||
|
|
||||||
|
### Geolocation check
|
||||||
|
|
||||||
|
The geolocation check examines the connecting device's geographical location based on its IP address.
|
||||||
|
This check allows administrators to enforce access restrictions based on geographic regions,
|
||||||
|
offering country-wide and city-level granularity.
|
||||||
|
|
||||||
|
## Managing Posture Checks
|
||||||
|
|
||||||
|
Posture Checks are dynamic, and you can create a policy with multiple posture checks. A single posture
|
||||||
|
check can also be reused across different policies. When managing posture checks, you can update them as
|
||||||
|
per your requirements.
|
||||||
|
|
||||||
|
However, deleting a posture check is only possible if it's not currently used in any policy. If a posture
|
||||||
|
check is in use, you need to unassigned it from the respective policy before you can delete it.
|
||||||
|
This precaution ensures the continuity and integrity of your security setup.
|
||||||
|
|
||||||
|
Here are some steps to help you create and manage your posture checks effectively:
|
||||||
|
|
||||||
|
In the example below, we are creating a posture check that will only allow clients running NetBird version 0.25.0 or
|
||||||
|
higher to connect and access network resources.
|
||||||
|
|
||||||
|
### Creating posture checks
|
||||||
|
Access the `Access Control` tab, the `Posture Checks` section and click `Create Posture Check`.
|
||||||
|
|
||||||
|
<p>
|
||||||
|
<img src="/docs-static/img/how-to-guides/add-posture-check.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
That will open a posture checks configuration screen where you can configure the checks.
|
||||||
|
|
||||||
|
<p>
|
||||||
|
<img src="/docs-static/img/how-to-guides/posture-check-create-list.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
Select the `NetBird Client Version` check option and set it with the following information:
|
||||||
|
- Version: `0.25.0`
|
||||||
|
|
||||||
|
<p>
|
||||||
|
<img src="/docs-static/img/how-to-guides/netbird-version-check.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
Click `Save`, and the `NetBird Client Version` check will be enabled.
|
||||||
|
<p>
|
||||||
|
<img src="/docs-static/img/how-to-guides/posture-check-netbird-version-enabled.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
Click `Continue`, fill out the form with the following information, and click `Create Posture Check` to save:
|
||||||
|
- Name of the posture check: `Netbird Version`
|
||||||
|
- Description: `Allow Netbird client with version 0.25.0 or greater`
|
||||||
|
|
||||||
|
<p>
|
||||||
|
<img src="/docs-static/img/how-to-guides/posture-check-post-config.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
### Adding posture checks to policy
|
||||||
|
|
||||||
|
Navigate to the `Access Control` tab and select the `Policies` section.
|
||||||
|
|
||||||
|
<p>
|
||||||
|
<img src="/docs-static/img/how-to-guides/policies-list.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
Choose the policy to which you want to assign the posture check. This will open the policy update screen. Then,
|
||||||
|
select the `Posture Checks` tab.
|
||||||
|
<p>
|
||||||
|
<img src="/docs-static/img/how-to-guides/policy-new-posture-check.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
Click `Browse Checks` and select the posture check we created earlier, `Netbird Version`. Then, click `Add Posture Checks`.
|
||||||
|
|
||||||
|
<p>
|
||||||
|
<img src="/docs-static/img/how-to-guides/policy-posture-checks-select.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
The `Netbird Version` check will be assigned to the policy. Click `Save Changes` to save the policy updates.
|
||||||
|
<p>
|
||||||
|
<img src="/docs-static/img/how-to-guides/policy-posture-checks-assigned.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
</p>
|
||||||
|
|
||||||