Skip to content

Commit

Permalink
Documentation updates to set up the 0.1 release.
Browse files Browse the repository at this point in the history
  • Loading branch information
iunderwood committed Dec 18, 2023
1 parent c872554 commit 14128ee
Show file tree
Hide file tree
Showing 3 changed files with 28 additions and 8 deletions.
32 changes: 25 additions & 7 deletions docs/config.rst
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ If there is a read-only version used system-wide, it should have a configuration
dbUserName: rtbh_ro
dbUserPass: timeToReadMe123!
The fields in this section are all required, and should not need further definition.

Listrunner Section
------------------
Expand All @@ -57,20 +58,36 @@ cache

As the listrunner is often charged with pulling updates from an online source, there is a section which defines where and for how long a cache file may be maintained before being considered too old.

* *location* - This is the full path where external downloads are kept. A temporary directory is recommended, though this can be placed anywhere appropriate. If you use sensitive lists, it may be preferable to specify this directory under the RTBH service account's home space.

* *age* - This is the amount of time in seconds that a cache file should be considered valid. Any files exceeding the cache time will be redownloaded.

The name of the cache file will be based on the identifier used.

lists
^^^^^

The following list types are supported:
Each list has several key value pairs that must be defined.

* *ident* - As lists go, the *ident* key-value pair must be unique for each list.

* *descr* - This is the plaintext description of the list.

* *file* - This is the full path and filename where the list content can be found. In the above example, the identifier is "STATIC", but that should not be taken to mean you cannot have more than one file for static entries.

The **v4_host** list type is a list of host IPs without a subnet mask defined. These are assumed to be /32 entries. The TOR Exit Node list the 3CoreSec Blacklist use a v4_host list.
* *type* - The following list types are supported:

The **v4_host_mask** list type is a list of subnets with the mask in bits. These are exact entries and are the format of the Team Cymru IPv4 BOGON list, and the recommended format for a locally-maintained block list.
The **v4_host** list type is a list of host IPs without a subnet mask defined. These are assumed to be /32 entries. The TOR Exit Node list the 3CoreSec Blacklist use a v4_host list.

Valid lines include an IPv4 host/mask combination. Notes may be provided on commented lines if necessary.
The **v4_host_mask** list type is a list of subnets with the mask in bits. These are exact entries and are the format of the Team Cymru IPv4 BOGON list, and the recommended format for a locally-maintained block list.

The **csv** or comma-separated value type is the most common simple table format. The first row is generally a header with a number of fields defined. These kinds of files are often found with threat intelligence feeds (e.g. ProofPoint Emerging Threats, REN-ISAC). In addition to the IP address identified, there is often a section for a category and a threat score.
Valid lines include an IPv4 host/mask combination. Notes may be provided on commented lines if necessary.

The **csv** or comma-separated value type is the most common simple table format. The first row is generally a header with a number of fields defined. These kinds of files are often found with threat intelligence feeds (e.g. ProofPoint Emerging Threats, REN-ISAC). In addition to the IP address identified, there is often a section for a category and a threat score.

* *tag* - This is a numeric tag that is used to identify the origin of the route. On route runners that support tags (e.g. Cisco), the number will be applied to the route itself. The tag is used to determine any particular rules for redistribution and/or to act as an origin community within BGP.

* *auto* - This is a boolean flag. When it is set, the list will be processed without having to be explicitly called out from the command line.

Routerunner Section
-------------------
Expand All @@ -85,7 +102,6 @@ This section is in the read-write section only, and contains the router list and
descr: Lab CSR-1000v
auto:
limits:
runsec: 3200
patchcount: 300
method: restconf
tags:
Expand All @@ -103,7 +119,9 @@ For the routerunner to work properly, there must be a routercreds.yaml file in t
pw: rtbhServicePW918!
...
This approach was taken for this module because it is the most accessible.
This approach was taken for this module because it is the most accessible to the widest audience.

For this, I recommend creating a dedicated account for running RTBH updates that only allow access to any routers that are intended for use in the RTBH system.

Query Section (Optional)
------------------------
Expand Down
2 changes: 1 addition & 1 deletion docs/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ Remote Trigger Black Hole Toolkit Documentation

This is the documentation for the Remote Trigger Black Hole Toolkit.

There are no tutorials for this project.
A tutorial and walkthrough will be part of the 0.2 release of this project.

.. toctree::
:maxdepth: 1
Expand Down
2 changes: 2 additions & 0 deletions docs/lists.rst
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ This list uses a specific file which contains a list of networks and bitmasks.
# 2021-02-06 - Ticket 31245
94.147.140.0/23
How the list is updated is up to the administrator. This can be run via a full CI/CD process, or in a periodic pull from an internal repository.

Free Address Lists
------------------

Expand Down

0 comments on commit 14128ee

Please sign in to comment.