diff --git a/.gitignore b/.gitignore index 809b1d31..a8f35d5c 100644 --- a/.gitignore +++ b/.gitignore @@ -23,4 +23,5 @@ bower_components/ log/ old/ .idea/ - +source/_build +.vscode/ \ No newline at end of file diff --git a/source/images/architecture-blue-sky-business-2599538.jpg b/source/images/architecture-blue-sky-business-2599538.jpg new file mode 100644 index 00000000..f174ccfe Binary files /dev/null and b/source/images/architecture-blue-sky-business-2599538.jpg differ diff --git a/source/index.rst b/source/index.rst index 4c6aa437..8600b366 100644 --- a/source/index.rst +++ b/source/index.rst @@ -31,6 +31,7 @@ Table of Contents manual/vpnet services plugins + third_party_plugins develop relations legal diff --git a/source/plugins.rst b/source/plugins.rst index ec50156c..7a7cff34 100644 --- a/source/plugins.rst +++ b/source/plugins.rst @@ -1,5 +1,5 @@ ==================================== -Plugins +Community Plugins ==================================== .. image:: images/manual_guy.png diff --git a/source/third_party_plugins.rst b/source/third_party_plugins.rst new file mode 100644 index 00000000..a172eaf8 --- /dev/null +++ b/source/third_party_plugins.rst @@ -0,0 +1,26 @@ +==================================== +Third-party Plugins +==================================== + +.. image:: images/architecture-blue-sky-business-2599538.jpg + :width: 600px + :align: center + + +Like our community plugins in some cases software is delivered under a non-free license, the Third-party section contains +the documentation for these packages as provided by Deciso or one of its partners. + +For support on this software, please consult the vendor as found below. + +-------------------- +Sunnyvalley +-------------------- + +.. toctree:: + :maxdepth: 2 + :titlesonly: + + vendor/sunnyvalley/sensei + vendor/sunnyvalley/sensei_hardwarerequirements + vendor/sunnyvalley/sensei_prepareyourfirewall + vendor/sunnyvalley/sensei_install diff --git a/source/vendor/sunnyvalley/images/opnsense-admin-secure-shell-settings.png b/source/vendor/sunnyvalley/images/opnsense-admin-secure-shell-settings.png new file mode 100644 index 00000000..a4a6f2b2 Binary files /dev/null and b/source/vendor/sunnyvalley/images/opnsense-admin-secure-shell-settings.png differ diff --git a/source/vendor/sunnyvalley/images/opnsense-terminal-1.png b/source/vendor/sunnyvalley/images/opnsense-terminal-1.png new file mode 100644 index 00000000..1cbaeca8 Binary files /dev/null and b/source/vendor/sunnyvalley/images/opnsense-terminal-1.png differ diff --git a/source/vendor/sunnyvalley/images/opnsense-terminal-2-options.png b/source/vendor/sunnyvalley/images/opnsense-terminal-2-options.png new file mode 100644 index 00000000..f4a68ce3 Binary files /dev/null and b/source/vendor/sunnyvalley/images/opnsense-terminal-2-options.png differ diff --git a/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-1.png b/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-1.png new file mode 100644 index 00000000..b4ecd2fb Binary files /dev/null and b/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-1.png differ diff --git a/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-2.png b/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-2.png new file mode 100644 index 00000000..e8c571d5 Binary files /dev/null and b/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-2.png differ diff --git a/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-3.png b/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-3.png new file mode 100644 index 00000000..b32ac8f4 Binary files /dev/null and b/source/vendor/sunnyvalley/images/opnsense-terminal-3-getsensei-3.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-1.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-1.png new file mode 100644 index 00000000..bc72ec22 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-1.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-2-terms.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-2-terms.png new file mode 100644 index 00000000..d5e91945 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab1-welcome-2-terms.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-1.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-1.png new file mode 100644 index 00000000..5ca9d107 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-1.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-2.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-2.png new file mode 100644 index 00000000..61e49ad5 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-2.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-3.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-3.png new file mode 100644 index 00000000..afc60fbd Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab2-interface-selection-3.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-1.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-1.png new file mode 100644 index 00000000..6ae0058f Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-1.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-2.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-2.png new file mode 100644 index 00000000..6435b0ba Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab3-cloud-reputation-2.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab4-sensei-cli.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab4-sensei-cli.png new file mode 100644 index 00000000..4d042808 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab4-sensei-cli.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab5-updates-health-check.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab5-updates-health-check.png new file mode 100644 index 00000000..f64e76f5 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab5-updates-health-check.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-1.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-1.png new file mode 100644 index 00000000..0bb569b3 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-1.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-2.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-2.png new file mode 100644 index 00000000..4f840b07 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-2.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-3.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-3.png new file mode 100644 index 00000000..6122371d Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab6-deployment-size-3.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-1.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-1.png new file mode 100644 index 00000000..733aaa9e Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-1.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-2.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-2.png new file mode 100644 index 00000000..4e63ee92 Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-2.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-3.png b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-3.png new file mode 100644 index 00000000..c1b2f3ef Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-0-wizard-tab7-finish-3.png differ diff --git a/source/vendor/sunnyvalley/images/sensei-forum.png b/source/vendor/sunnyvalley/images/sensei-forum.png new file mode 100644 index 00000000..b76f81fa Binary files /dev/null and b/source/vendor/sunnyvalley/images/sensei-forum.png differ diff --git a/source/vendor/sunnyvalley/sensei.rst b/source/vendor/sunnyvalley/sensei.rst new file mode 100644 index 00000000..ce1340c3 --- /dev/null +++ b/source/vendor/sunnyvalley/sensei.rst @@ -0,0 +1,88 @@ +=================== +Sensei: Overview +=================== + +About +---------------------------- +Sensei is a plugin for firewalls complementing them with state of the art next generation features. If you are running a L4 firewall (all open source firewalls fall into this category) and looking for features like Application Control, Network Analytics and TLS Inspection, Sensei is the product you're looking for. + +.. raw:: html + + + +---------------------------- + +Features +---------------------------- +Sensei empowers your firewall with the following next generation features + +1. Application Control +2. Cloud Application Control \(Web 2.0 Controls\) +3. Advanced Network Analytics +4. All-ports full TLS Inspection \(for every TCP port, not just HTTPS\) +5. Cloud Threat Intelligence +6. Encypted Threats Prevention +7. Web Filtering & Security +8. Active Directory Integration + +---------------------------- + +Getting Started +---------------------------- + +- :doc:`sensei_hardwarerequirements` +- :doc:`sensei_prepareyourfirewall` +- :doc:`sensei_install` + +---------------------------- + +User Manual +---------------------------- + +You can get detailed *How to* documents from Sensei's Documentation Site located at https://help.sunnyvalley.io/ + +* `Dashboard `_ +* `Status `_ +* `Reports `_ +* `Security `_ +* `Application Control `_ +* `Web Control `_ +* `Configuration `_ + +---------------------------- + +Getting Support +---------------------------- + + +**Support for Freemium Edition** + +If you need help for anything; there is an active discussion about Sensei on OPNsense forum. Feel free to `click here `_ and join the conversation. + +You can also issue bug reports from `Gitlab `_ + +With its in-depth coverage, `Sensei Documentation `_ is always available for reference. + +* `OPNsense Forum `_ +* `Users' Manual `_ +* `Report a problem `_ + +**Premium Subscription Support** + +When you buy a Sensei Premium Subscription, you are entitled to Sensei Basic Support. +Additional support plans are available on demand. + +* `Compare Support Plans `_ +* `Access Support Center `_ + + +**Support Options for Channel Partners** + +Sunny Valley Networks provides Tier 3 Support Options for Sensei Channel Partners. To learn more about them, please contact **sensei-partnership -at- sunnyvalley.io** . + + +**Connect via Social Media** + +* **Twitter**: `@sunnyvalley `_ +* **Youtube**: `Sunny Valley Networks Hands-on videos `_ +* **Sunny Valley Blog**: https://sunnyvalley.io/blog/ diff --git a/source/vendor/sunnyvalley/sensei_hardwarerequirements.rst b/source/vendor/sunnyvalley/sensei_hardwarerequirements.rst new file mode 100644 index 00000000..09f43b3e --- /dev/null +++ b/source/vendor/sunnyvalley/sensei_hardwarerequirements.rst @@ -0,0 +1,55 @@ +======================================== +Sensei: Hardware Requirements +======================================== + +Due to the nature of packet analysis and granular drill-down reporting features, Sensei require more horsepower than a standard L3-L4 firewall. + +.. Note:: + + Sensei requires at least 4 GB of memory. Installer will not continue if you have less than 4 GB of RAM. + +.. Note:: + + A roadmap feature - Cloud reporting - will enable you to install Sensei to devices which have limited amount of memory. E.g. you'll be able to install Sensei to a Raspberry Pi. + +----------------------------- + +CPU & Memory +------------ + +Because the analytics module relies on Elastic Search to do Big Data processing, amount of the memory available in the system is crucial for the performance of the whole product. + +At least dual-core *(i5 or equivalent)* or preferably quad-core modern CPU *(i7 or equivalent)* would be advisable. + +Recommended minimum hardware requirements for Sensei based on the number of users and the bandwidth: + +======================= ===================== ==================== ==================================================================== + **Number of Users** **WAN Bandwith** **Min. Memory** **Min. CPU** + <25 20 Mbps 8 GB Intel Dual-Core i3 2.0 GHz (2 Cores, 4 Threads) or equivalent + 25-50 50 Mbps - 10 Kpps 8 GB Intel Dual-Core i5 2.0 GHz (2 Cores, 4 Threads) or equivalent + 50-100 100 Mbps - 20 Kpps 16 GB Intel Dual-Core i5 2.2 GHz (2 Cores, 4 Threads) or equivalent + 100-250 200 Mbps - 40 Kpps 16 GB Intel Dual-Core i7 2.0 GHz (2 Cores, 4 Threads) or equivalent + 250-1000 500 Mbps - 100 Kpps 32 GB Intel Quad-Core i7 3.40 GHz (4 Cores, 8 Threads) or equivalent +======================= ===================== ==================== ==================================================================== + +----------------------------- + +Disk Space +------------ + +.. Note:: + + Sensei uses `Elastic Search Engine `_ as its backend to process the Big Data. Please spare at least 5 MB of disk space per hour per megabit/second throughput. + +If you're running a 100 Mbps link \(about 100 users\) which is quite active during the daytime and idle rest of the day, you can calculate the space needed as follows: + +.. code-block:: none + + 5 MB x 12 hours x 100 Mbps = 6 GB per day. + 6 GB x 7 days a week = 42 GB per week. + 42 x 4 weeks a month = 164 GB per month. + + +.. Note:: + + As of 0.7.0 ::italic::(`changelog `_) , Sensei retires reports data to open up space for the new coming data. After the configured timespan, existing reports data is automatically purged to save space for fresh data. diff --git a/source/vendor/sunnyvalley/sensei_install.rst b/source/vendor/sunnyvalley/sensei_install.rst new file mode 100644 index 00000000..06922cc1 --- /dev/null +++ b/source/vendor/sunnyvalley/sensei_install.rst @@ -0,0 +1,162 @@ +===================== +Sensei: Installing +===================== + +.. Note:: + + Sensei Freemium Edition is **forever free-of-charge**. We strongly recommend you register to keep in touch with updates and new features. You can register at `https://www.sunnyvalley.io/sensei `_ + +----------------------------- + + +Connect to Your Firewall +----------------------------- + +.. code-block:: bash + + $ ssh root@your-firewall-ip + +After a successful login, enter "8" as the option to drop to the shell + +.. image:: images/opnsense-terminal-1.png + :width: 100% + +----------------------------- + +Download & Run Sensei Installer +-------------------------------- +Run the following one-liner command to download and invoke the installer script. + +.. code-block:: bash + + root@fw:~ # curl https://updates.sunnyvalley.io/getsensei | sh + + +.. image:: images/opnsense-terminal-3-getsensei-1.png + :width: 100% + +Hence we passed the downloaded script to ``sh``, it will automatically run the installer script. + +.. code-block:: bash + + Installing via OPNsense installer + Do you wish to install Sensei? y + +Install script will copy the installation files onto the filesystem and will add a menu item within the Firewall Web User Interface. +Depending on your computer setup and your internet connection speed, it might take 1-4 minutes to complete. + +.. Note:: + + You can get detailed info about suggested hardware on :doc:`sensei_hardwarerequirements` + +.. image:: images/opnsense-terminal-3-getsensei-2.png + :width: 100% + +Once the install is completed, you can disconnect from your terminal, and disable your firewall's ssh service by unchecking the checkboxes mentioned above. + +----------------------------- + +Initial Configuration Wizard +------------------------------ + +.. Note:: + + To start using Sensei, first, you need to go through the Wizard which will guide you to start with the best initial configuration. + +To start your "Initial Configuration Wizard"; + +* Log in to your OPNsense Web UI, +* Click Sensei from the left menu, +* Click on the Dashboard sub-menu. It will open up the Wizard. + +------------ +**1- EULA** +------------ + +* Accept the End User License Agreement *(Scroll & read the terms to get to the next button)*. +* Click :menuselection:`Next` and get to the :menuselection:`Interface Selection` section. + +.. image:: images/sensei-0-wizard-tab1-welcome-1.png + :width: 100% + +----------------------------- +**2- Interface Selection** +----------------------------- + +* Select the Ethernet Interfaces to protect. To do that, click on an interface and use the right/left arrow buttons to move it to protected/unprotected interfaces combo box. +* Click :menuselection:`Next` and get to the :menuselection:`Cloud Reputation` section. + +.. image:: images/sensei-0-wizard-tab2-interface-selection-2.png + :width: 100% + +-------------------------- +**3- Cloud Reputation** +-------------------------- + +The Cloud Threat Intelligence data is queried real time when anyone makes a connection through your network. It enables us to respond to malware and wireless outbreaks in real time and very fast. + +The engine processes the request, queries to **SVN Cloud** in real-time and decides whether it will be blocked or allowed. We check against 140+ Million Websites, under 120+ categories in milliseconds. + +Cloud Threat Intel settings let you; + +* Enable/Disable the cloud reputation & web categorization engine +* Set local domain settings to be excluded from cloud queries + +.. image:: images/sensei-0-wizard-tab3-cloud-reputation-2.png + :width: 100% + +-------------------------------- +**4- Sensei CLI (Security)** +-------------------------------- + +* Set your TCP Service password. This password protects the command line based CLI access to the packet engine. It is highly recommended to set this with a secure one. +* Click "Next" and get to the "Updates" . + +.. image:: images/sensei-0-wizard-tab4-sensei-cli.png + :width: 100% + +------------------------------- +**5- Updates & Health Check** +------------------------------- + +.. Note:: + Sensei uses OPNsense package system to deliver its updates. Configure the way you receive your Sensei updates as you feel convenient. + + +* **Self Health Check:** If enabled, "Self Health Check" monitors the system's memory, CPU, disk usage and core services if they're working correctly, and raises alerts if anything goes wrong. Self Health Check also stops the relevant services if they're consuming excessive system resources. +* **Check for Updates Automatically:** Checks automatically for the updates and creates a notification on the status page. +* **Update Databases and Threat Intelligence Data Automatically:** Checks automatically for the updates and creates a notification on the status page . +* **Enable Generation of Support Data:** If enabled, Sensei collects supporting data during unusual events and crashes. You can share this data while opening a ticket with us. + +.. image:: images/sensei-0-wizard-tab5-updates-health-check.png + :width: 100% + +-------------------------- +**6- Deployment Size** +-------------------------- + +Sensei supports up to 1,000 concurrent users on an everyday PC. You can set your Sensei installation's capacity here. + + +.. Note:: + You can get detailed info about suggested hardware on [Getting Started > Hardware Requirements​](getting-ready.md) + +.. image:: images/sensei-0-wizard-tab6-deployment-size-1.png + :width: 100% + +--------------- +**7- Finish** +--------------- + +Click the Finish button to save your initial configuration data and start using Sensei. + +.. image:: images/sensei-0-wizard-tab7-finish-1.png + :width: 100% + +------------------- +**Hands-on Video** +------------------- + +.. raw:: html + + diff --git a/source/vendor/sunnyvalley/sensei_prepareyourfirewall.rst b/source/vendor/sunnyvalley/sensei_prepareyourfirewall.rst new file mode 100644 index 00000000..262c67a7 --- /dev/null +++ b/source/vendor/sunnyvalley/sensei_prepareyourfirewall.rst @@ -0,0 +1,24 @@ +=============================== +Sensei: Prepare Your Firewall +=============================== + +.. Note:: + + To install Sensei on your OPNsense firewall, you need to connect to it via ``ssh`` with ``root`` privileges. + +----------------------------- + +--------------------- +Enable Secure Shell +--------------------- + +1. Login to your OPNsense firewall's dashboard +2. Head to the :menuselection:`System > Settings > Administrations` menu +3. Enable all three checkboxes + + 1. Enable Secure Shell + 2. Permit root user login + 3. Permit password login + +.. image:: images/opnsense-admin-secure-shell-settings.png + :width: 100%