Install with Docker (Centrally Managed)

Prerequisites

• Access to a SaaS tenant on my.openappsec.io (WebUI for SaaS management) Follow the instructions available here:

pageSign-Up and Login to Portal

• Agent profile created for open-appsec Docker deployment in SaaS tenant Follow the instructions available here. Once done, don't forget to copy the profile token after policy installation as this is needed in the installation steps further below:

pageCreate a Profile

• Linux machine with:

  • Docker software installed (or similar compatible Container runtime)

  • Root Permissions

Installation

NGINX

Make sure to meet the prerequisites on top of this page and to have the profile token available. Make sure you enforce the policy after profile creation.

Follow these steps to install an NGINX with open-appsec using containers (e.g. on Docker) or using your deployment CI:

Step 1: Pull the open-appsec agent image or add/use it as part of the deployment CI’s container management system:

docker pull ghcr.io/openappsec/agent:latest

Step 2: The volume mounts set in the next step with-v are optional but recommended for the persistence of the agent information (data, config, logs). If you want to use those parameters create the following empty directories to be used later for volume mounts in the docker run command for the agent.

<path-to-persistent-location-for-agent-config>
<path-to-persistent-location-for-agent-data-files>
<path-to-persistent-location-for-agent-debugs-and-logs>

Step 3: Run the open-appsec agent container with this command:

docker run --name=open-appsec-agent \
--ipc=host \
-v=<path-to-persistent-location-for-agent-config>:/etc/cp/conf \
-v=<path-to-persistent-location-for-agent-data-files>:/etc/cp/data \
-v=<path-to-persistent-location-for-agent-debugs-and-logs>:/var/log/nano_agent \
-it \
-e registered_server='NGINX Server' \
-e user_email=<your-email-address> \
-e https_proxy=<user:password@proxy address:port> \
-d ghcr.io/openappsec/agent:latest /cp-nano-agent --token <token>

Replace the <token> parameter with the token you copied from the profile in the WebUI before (see Prerequisites section above).

The https_proxy environment variable allows you to configure an HTTP(S) proxy server to be used by the agent. It is optional and can be removed if not needed.

The volume mounts set with-v are optional but recommended for the persistence of the agent information (data, config, logs). If you use those parameters create the following empty directories to be used later for volume mounts in the docker run command for the agent.

<path-to-persistent-location-for-agent-config>
<path-to-persistent-location-for-agent-data-files>
<path-to-persistent-location-for-agent-debugs-and-logs>

The optional user_email environment variable allows you to associate your email address with your specific deployment by replacing <your-email-address> with your own email address.

This allows us to provide you easy assistance in case of any issues you might have with your specific deployment in the future and also to provide you information proactively regarding open-appsec in general or regarding your specific deployment. This is an optional parameter and can be removed. If we send automatic emails there will also be an opt-out option included for receiving similar communication in the future.

Step 3: Create (or replace) the NGINX container by first pulling the open-appsec NGINX container, which already contains the open-appsec attachment. Alternatively, add/use it as part of the deployment CI’s container management system:

docker pull ghcr.io/openappsec/nginx-attachment:latest

Step 4: Run the open-appsec NGINX container, make sure to add the --ipc=host parameter, here’s an example command:

docker run --name open-appsec-nginx \
--ipc=host \
-p 80:80 \
-d ghcr.io/openappsec/nginx-attachment:latest

For general NGINX configuration please check the relevant NGINX documentation

Step 5: Make sure both containers are running, use docker ps to verify.

Step 6: Navigate to the Agents tab and ensure the new Agent is successfully connected.

Step 7: Create one or more assets defining the specific resources that open-appsec should protect and don't forget to install the policy afterward. All required steps are explained here:

pageProtect Additional Assets

Kong Gateway

Make sure to meet the prerequisites on top of this page and to have the profile token available. Make sure you enforced the policy after profile creation.

Follow these steps to install Kong with open-appsec using containers (e.g. on Docker) or using your deployment CI:

Step 1: Pull the open-appsec agent image or add/use it as part of the deployment CI’s container management system:

docker pull ghcr.io/openappsec/agent:latest

Step 2: The volume mounts set in the next step with-v are optional but recommended for the persistence of the agent information (data, config, logs). If you want to use those parameters create the following empty directories to be used later for volume mounts in the docker run command for the agent.

<path-to-persistent-location-for-agent-config>
<path-to-persistent-location-for-agent-data-files>
<path-to-persistent-location-for-agent-debugs-and-logs>

Step 3: Run the open-appsec agent container with this command:

docker run --name=open-appsec-agent \
--ipc=host \
-v=<path-to-persistent-location-for-agent-config>:/etc/cp/conf \
-v=<path-to-persistent-location-for-agent-data-files>:/etc/cp/data \
-v=<path-to-persistent-location-for-agent-debugs-and-logs>:/var/log/nano_agent \
-it \
-e registered_server='Kong Server' \
-e user_email=<your-email-address> \
-e https_proxy=<user:password@proxy address:port> \
-d ghcr.io/openappsec/agent:latest /cp-nano-agent --token <token>

Replace the <token> parameter with the token you copied from the profile in the WebUI before (see Prerequisites section above).

The https_proxy environment variable allows you to configure an HTTP(S) proxy server to be used by the agent. It is optional and can be removed if not needed.

The volume mounts set with-v are optional but recommended for the persistence of the agent information (data, config, logs). If you use those parameters create the following empty directories to be used later for volume mounts in the docker run command for the agent.

<path-to-persistent-location-for-agent-config>
<path-to-persistent-location-for-agent-data-files>
<path-to-persistent-location-for-agent-debugs-and-logs>

The optional user_email environment variable allows you to associate your email address with your specific deployment by replacing <your-email-address> with your own email address.

This allows us to provide you easy assistance in case of any issues you might have with your specific deployment in the future and also to provide you information proactively regarding open-appsec in general or regarding your specific deployment. This is an optional parameter and can be removed. If we send automatic emails there will also be an opt-out option included for receiving similar communication in the future.

Step 3: Create (or replace) the Kong container by pulling the enhanced open-appsec Kong container, which already contains the open-appsec attachment. Alternatively, add/use it as part of the deployment CI’s container management system:

For Kong (open-source version):

docker pull ghcr.io/openappsec/kong-attachment:latest

For Kong Gateway (enterprise version):

docker pull ghcr.io/openappsec/kong-gateway-attachment:latest

Step 4: Run the open-appsec Kong container, make sure to add the --ipc=host parameter, here’s an example command:

For Kong (open-source version):

docker run \
--name kong \
--ipc=host \
-p 8000:8000 -p 8443:8443 -p 127.0.0.1:8001:8001 -p 127.0.0.1:8444:8444 \
-d ghcr.io/openappsec/kong-attachment:latest

For Kong Gateway (enterprise version):

docker run \
--name kong-gateway \
--ipc=host \
-p 8000:8000 -p 8443:8443 -p 127.0.0.1:8001:8001 -p 127.0.0.1:8444:8444 \
-d ghcr.io/openappsec/kong-gateway-attachment:latest

For general Kong configuration details please check the Kong documentation

Step 5: Make sure both containers are running, use docker ps to verify.

Step 6: Navigate to the Agents tab and ensure the new Agent is successfully connected.

Step 7: Create one or more assets defining the specific resources that open-appsec should protect and don't forget to enforce the policy afterward. All required steps are explained here:

pageProtect Additional Assets

Now your open-appsec installation on Docker is completed and your configured web app or API assets are protected!