BSD Portssecurity/imds-filterd 0.1 FreeBSD
Provides per user/group access controls to the EC2 IMDS
- System
- FreeBSD
- Repository
- FreeBSD ports
- Maintainer
- [email protected]
- License
- BSD2CLAUSE
- Categories
- security
- Package size
- 35.7 KiB, 90.0 KiB installed
Description
imds-filterd (pronounced "I M D S Filter D") is a pair of utilities which work together to intercept and filter requests to the EC2 Instance Metadata Service -- or theoretically any other service at 169.254.169.254:80.
It validates requests against a configured ruleset which specifies whether given users and groups should be allowed or denied access to certain prefixes in the Instance Metadata Service. For example, "root" could be granted access to everything; most unprivileged users granted access to everything except IAM role credentials; but the www user denied access to the entire Instance Metadata Service in order to guard against SSRF and similar attacks.
Install
Binary package:
pkg install imds-filterdFrom the ports tree:
cd /usr/ports/security/imds-filterd/ && make install cleanTo depend on this port in another port's Makefile:
RUN_DEPENDS= imds-filterd>0:security/imds-filterdPackages
The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.
| Repository | aarch64 | amd64 | armv6 | armv7 | i386 |
|---|---|---|---|---|---|
| FreeBSD:14:latest | 0.1 | 0.1 | 0.1 | 0.1 | 0.1 |
| FreeBSD:14:quarterly | 0.1 | 0.1 | n/a | 0.1 | 0.1 |
| FreeBSD:15:latest | 0.1 | 0.1 | n/a | 0.1 | 0.1 |
| FreeBSD:15:quarterly | 0.1 | 0.1 | n/a | n/a | n/a |
| FreeBSD:16:latest | 0.1 | 0.1 | n/a | n/a | n/a |
| FreeBSD:16:quarterly | n/a | n/a | n/a | n/a | n/a |
Dependencies
The Makefile names none itself; they come from USES and USE_*.
The full lists below include those, and their dependencies in turn.
No port depends on this one.
Configuration
Options name: security_imds-filterd
| Option | Default | Description |
|---|---|---|
| DOCS | off | Build and/or install documentation |
- Service scripts
- none
Message after installing
To enable imds-filterd, add imds_filterd_enable=YES to /etc/rc.conf.
To configure imds-filterd, edit /usr/local/etc/imds.conf.
imds-filterd ships with configurations for syslogd and newsyslog which log
accesses to the Instance Metadata Service to /var/log/imds.log and rotate
this file upon reaching 1 MB; these settings can be modified via
/usr/local/etc/{syslog.d, newsyslog.conf.d}/imds.conf.
Files
distinfo 1
| File | Size | SHA256 |
|---|---|---|
| cperciva-imds-filterd-0.1_GH0.tar.gz | 64011 | e0e8b28046b2a917e110d1313242947aa6901635e81552107ab2f6a2fba83441 |
Commit history 0
No commits in the history this site was built from.