Skip to content

Hosting

Package name: intrudect-hosting

The Intrudect Hosting package is intended for MSSPs and organizations that operate multiple separate Intrudect installations. It provides a central place to manage hosted Intrudect services while keeping each customer or environment isolated.

Note

Command examples shown on page need to be executed in root shell

Note

If mariadb & rsyslog were installed as dependencies, they need to be enabled and started 

systemctl --now enable mariadb
systemctl --now enable rsyslog

Docker

It is recommended to install the docker.com repository.

But using OS bundled components is also OK.

systemctl --now enable docker

MaxMind GeoIP

Install

Setup

  • Create free account in https://www.maxmind.com/

  • Add your AccountID and License key into /etc/GeoIP.conf 

    AccountID xxxx
LicenseKey xxxx

  • Add Editions to /etc/GeoIP.conf: 

    EditionIDs GeoLite2-Country GeoLite2-City GeoLite2-ASN

  • Execute geoipupdate (NB it will take 1-2 minutes for your maxmind AccountID and LicenseKey values to populate inside their infrastructure) 
    geoipupdate -v
  • Add it to crontab as well 
    ( crontab -l ; echo "30 05  *  *  * geoipupdate" ) | crontab -

Note

The host GeoIP database folder is bind-mounted into every hosted container, so all containers share the same database files. Set the host path in the Site settings UI ("Maxmind GeoIP database folder on host") — on Ubuntu it is /var/lib/GeoIP/, on RedHat /usr/share/GeoIP/.

IOC Proxy

IOC and Tor feeds are provided by the separate intrudect-iocfeed service. It can be configured in the Site settings page for all containers.

Database setup

MariaDB server should be already installed as a dependency.

The hosting stack uses the database in two roles, and they need different privilege levels:

  • The hosting application has one database of its own (intrudect_hosting); its user only needs privileges on that single database.
  • The hosted containers each get their own database and database user, provisioned automatically by the hosting app. Creating and dropping those databases and users requires an administrative (DBA) user on whichever server holds the container databases.

The container databases can live on the same machine as the hosting database (reached over localhost) or on one or more separate, dedicated database servers (see CLIENTDBSERVERS). Either placement needs the DBA user described below.

Hosting application database

Create the database and its limited user: 

mysql

MariaDB> CREATE DATABASE intrudect_hosting CHARACTER SET utf8mb4  COLLATE utf8mb4_unicode_ci;
MariaDB> GRANT ALL PRIVILEGES ON intrudect_hosting.* TO 'intrudect_hosting'@'localhost' IDENTIFIED BY 'PASSWORD';
MariaDB> FLUSH PRIVILEGES;

Container database administrator

Create the administrative user the hosting app uses to provision the per-container databases and users. It needs full privileges with grant option so it can create databases and grant each container's user access to its own database: 

mysql

MariaDB> CREATE USER 'intrudect_dba'@'localhost' IDENTIFIED BY 'PASSWORD';
MariaDB> GRANT ALL PRIVILEGES ON *.* TO 'intrudect_dba'@'localhost' WITH GRANT OPTION;
MariaDB> FLUSH PRIVILEGES;

  • Grant the user for the address the hosting app connects from. On a single-machine install that is localhost, as above. When the container databases run on a separate server, create this user there and grant it for the hosting host's address instead of localhost.
  • This is a privileged account — give it a strong, unique password, and do not reuse the hosting application user's credentials.

These credentials are what each CLIENTDBSERVERS entry's USERNAME / PASSWORD refers to.

MariaDB tuning

Apply the following on every machine running MariaDB — the hosting database and any separate container database server.

  • Allocate as much memory as possible to database.
    In /etc/mysql/mariadb.conf.d/50-server.cnf or /etc/my.cnf.d/mariadb-server.cnf (RedHat) 

    [mysqld]
max_allowed_packet=200M
innodb_buffer_pool_size = XXG

  • Restart MariaDB server after config change 

    systemctl restart mariadb.service

  • Ensure start on boot 

    systemctl enable mariadb.service

  • Load timezone tables into MariaDB 

    mysql_tzinfo_to_sql /usr/share/zoneinfo | mysql -u root mysql
    Verify that output is > 0 
    mysql -e 'SELECT COUNT(*) FROM mysql.time_zone;'
+----------+
| COUNT(*) |
+----------+
|      498 |
+----------+

Configuration

Configuration file is in /opt/intrudect-hosting/config.json. It holds only the bootstrap settings needed to start the service — most runtime configuration is done in the Site settings UI after first login (see Site settings below).

  • LISTEN parameter specifies the IP address and port where the hosting web UI listens, and you should forward your reverse proxy traffic to this location. Since the web UI itself does not have support for TLS, you must set up a reverse proxy, like Nginx or Caddy, in front of it in a production environment.

The hosting app uses two separate database connections, which serve different purposes:

  • DB is the hosting application's own database — the intrudect_hosting database created in Database setup above. It stores the hosting portal's own data (accounts, container definitions, site settings, statistics) and is unrelated to the data of the hosted containers. Fields:
    • SERVER — address of the MariaDB server.
    • USERNAME / PASSWORD — credentials for the hosting database.
    • DATABASE — database name.
  • CLIENTDBSERVERS is a list of one or more database servers used by the hosted containers. Every hosted Intrudect instance is given its own database on one of these servers. A server listed here can be the same machine as the hosting app's DB (e.g. localhost), or a separate, dedicated database host — list several to spread hosted containers across machines. Each entry has:
    • NAME — a label identifying this database server (referenced by CLIENTDBASSIGNMENT).
    • SERVER — the address the hosting app uses to reach this server in order to create and manage the per-container databases and users.
    • CONTAINERHOST — the address the hosted containers use to reach this server. This is often different from SERVER: when the database runs on the same host, containers connect over the Docker bridge (e.g. 172.17.0.1) rather than localhost.
    • USERNAME / PASSWORD — the administrative (DBA) credentials the hosting app uses on this server to create the per-container databases and users. This is the container database administrator created in Database setup, not the limited hosting application user.
    • GRANTHOST — the MariaDB host pattern used when granting each container's database user access (e.g. 172.% permits connections from the Docker subnet).
  • CLIENTDBASSIGNMENT controls how new hosted containers are assigned to the servers listed in CLIENTDBSERVERS. default is the standard assignment.

Note

When a CLIENTDBSERVERS entry is a separate machine from the hosting app, repeat the Database setup on that machine: install and tune MariaDB, load the timezone tables, and create the container database administrator (granted for the address the hosting app connects from, not localhost). It must also accept connections from the container network — reachable at the entry's CONTAINERHOST address and granting each container's user from the GRANTHOST pattern (e.g. 172.%).

  • HTTPS set to true when the hosting web UI is behind a TLS-terminating reverse proxy. Ensures secure cookie flags and correct protocol handling. Note: with this enabled, session cookies are marked Secure and will only work over HTTPS — accessing the web UI over plain HTTP will prevent login/sessions from working.
  • REALIPHEADER and TRUSTEDPROXIES are two different ways to recover the client's real IP address when the hosting app runs behind a reverse proxy (used for the login rate-limit key and the audit log). They are not the same — set the one that matches how your proxy passes the client IP:
    • REALIPHEADER — the name of a single header your proxy sets with the real client IP (e.g. X-Real-Ip, or CF-Connecting-IP behind Cloudflare). Its value is trusted verbatim and checked first, so the app must be reachable only through that proxy. Leave empty if unused.
    • TRUSTEDPROXIES — the list of proxy addresses/CIDRs whose X-Forwarded-For header may be trusted. Only hops coming from these addresses are believed, so clients cannot spoof their IP. When empty, all proxies are trusted.
  • UPDATESTATSINTERNVAL how often, in seconds, container/usage statistics are refreshed (300 = 5 minutes).
  • DEBUGMODE enables verbose debug logging. Leave false in production.
  • RESOURCELOGGING when true, periodically writes a [resource] line (host memory/load, database pool state, and container health summary) to the log file. A lightweight alternative to external metrics scraping.
  • RESOURCELOGINTERVAL sampling period for resource logging, in minutes.
  • WEBAUTHN enables passkey/hardware key authentication. RPID is your domain name, RPORIGINS lists the allowed origins, and RPDISPLAYNAME is shown to users during registration.
{
  "LISTEN": "0.0.0.0:8090",
  "DB": {
    "SERVER" : "localhost",
    "USERNAME" : "intrudect_hosting",
    "PASSWORD" : "PASSWORD",
    "DATABASE" : "intrudect_hosting"

  },
  "CLIENTDBASSIGNMENT": "default",
  "CLIENTDBSERVERS": [
    {
      "NAME": "db-1",
      "SERVER": "localhost",
      "CONTAINERHOST": "172.17.0.1",
      "USERNAME": "intrudect_dba",
      "PASSWORD" : "PASSWORD",
      "GRANTHOST": "172.%"
    }
  ],
  "HTTPS": true,
  "REALIPHEADER": "",
  "TRUSTEDPROXIES": ["127.0.0.1"],
  "UPDATESTATSINTERNVAL" : 300,
  "DEBUGMODE" : false,
  "RESOURCELOGGING" : true,
  "RESOURCELOGINTERVAL" : 5,
  "WEBAUTHN": {
    "RPID": "intrudect.example.com",
    "RPORIGINS": ["https://intrudect.example.com/"],
    "RPDISPLAYNAME": "Megacorp LLC"
  }  
}

Start & enable service

systemctl restart intrudect-hosting
systemctl enable intrudect-hosting

Logfile

Web server writes additional info to /var/log/intrudect-hosting.log

Initial user

Before launching the web UI, an initial user and password must be created using the command-line utility.

cd /opt/intrudect-hosting
./intrudect-cli user add -username <username> -password <password>

Site settings

Most runtime configuration lives here rather than in config.json. After first login, navigate to the Site settings page and review:

  • Public address suffix — the domain suffix under which hosted services are published (e.g. .intrudect.example.com).
  • Service port range — the host port range allocated to hosted containers.
  • Maxmind GeoIP database folder on host — the folder bind-mounted into each container (see MaxMind GeoIP).
  • IOC proxy URL — base URL of the shared intrudect-iocfeed service used by all containers.
  • Metadata & alert retention — per-protocol retention periods (TCP, DNS, HTTP, DHCP) and device/alert retention, in days.
  • Container health watchdog — whether to auto-restart containers that stay unhealthy, and after how many minutes.