drmaxnix/banjo repository overview

Source Code: git.tjdev.de/DrMaxNix/banjo⁠

⁠🪕 Banjo

Docker Web Application Firewall (WAF) to protect against Brute Force Attacks

⁠How It Works

1. Your server stack consists of these three components:
   • the reverse proxy, which will terminate SSL connections and forwards traffic to the Banjo container
   • the Banjo container, which will either forward traffic to the application container, or deny access
   • the application container, which will detect failed login attempts and log them
2. To allow Banjo to know when a failed login attempt has occurred, the application container's log must be proxied into the Banjo container.
3. If Banjo detects a certain pattern in the application log which looks like a failed login attempt, it will increment a counter for this client's IP address
4. If the counter hits a certain threshold, Banjo will show a 429 Too Many Requests page to this client instead of forwarding calls to the application container
5. After a certain time, the ban will be lifted and the client's counter reset; calls will now be forwarded to the application again

⁠Setup Instructions

⁠1. Set up Logproxy in Application Container

As described above, the application container's log must be proxied into the Banjo container. For this purpose, there is a banjo_logproxy script, which will replace the application container's entrypoint ("init script"). The banjo_logproxy script will then call the real init script (the original entrypoint) and forward all of its output not only to the docker log, but also into a named fifo pipe, which will then be mounted into the Banjo container.

Determine the original entrypoint of your application container (replace exampleorg/exampleimage with your application's image name):

$ docker inspect -f '{{ .Config.Entrypoint }}' exampleorg/exampleimage

You will see something like this, where /usr/bin/entrypoint is the original entrypoint:

[/usr/bin/entrypoint]

Now mount the banjo_logproxy script into your application's container and set it as the new entry point. Make sure to replace /usr/bin/entrypoint with the output from above!

services:
  # ...
  
  app:
    # ...
    volumes:
      # ...
      - ./banjo_logproxy:/banjo_logproxy:ro
      - banjo_logproxy_data:/banjo_logproxy_data
    entrypoint: /banjo_logproxy /usr/bin/entrypoint

volumes:
  banjo_logproxy_data:

⁠2. Set up Banjo

Add the Banjo service to your docker-compose.yml, configure the regex pattern and point it to your application container:

services:
  banjo:
    image: drmaxnix/banjo
    restart: unless-stopped
    environment:
      LOGMATCH_REGEX: '/Login failed: (?<ip>[0-9a-f\.\:]+)/'
      APPLICATION_HOST: "app"
    volumes:
      - ./data/banjo:/opt/banjo-data
      - banjo_logproxy_data:/banjo_logproxy_data
    ports:
      - 127.0.0.1:80:80
  
  # ...

volumes:
  banjo_logproxy_data:

⁠3. Configure your reverse proxy

Now point your reverse proxy at port 80 of the Banjo container.

⁠4. Final docker-compose.yml Example

services:
  banjo:
    image: drmaxnix/banjo
    restart: unless-stopped
    environment:
      LOGMATCH_REGEX: '/Login failed: (?<ip>[0-9a-f\.\:]+)/'
      APPLICATION_HOST: "app"
    volumes:
      - ./data/banjo:/opt/banjo-data
      - banjo_logproxy_data:/banjo_logproxy_data
    ports:
      - 127.0.0.1:80:80
  
  app:
    # ...
    volumes:
      # ...
      - ./banjo_logproxy:/banjo_logproxy:ro
      - banjo_logproxy_data:/banjo_logproxy_data
    entrypoint: /banjo_logproxy /usr/bin/entrypoint

volumes:
  banjo_logproxy_data:

⁠Configuration Options

Following configuration options are available by setting environment variables:

Explanation of types: