Ziad_Abdelgwad/ghaymah-dns-net-sec-tests
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: enforce private backend isolation, deploy live interactive SOC Gateway UI, and provide English security report

Browse Source
This commit is contained in:
Ziad_Abdelgwad
2026-10-13 00:38:12 +03:00
parent 2cea9f25ba
commit f8917dfa88
31 changed files with 1331 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+24 -5
View File
@@ -2,7 +2,19 @@
Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penetration Testing Suite for **Ghaymah Systems** (`deploy.ghaymah.systems`).
## 📋 Assessment Reports
## 🌐 Live Deployed Applications
* **Edge SOC Command Center Gateway**:
👉 **[https://ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev](https://ghaymah-soc-gateway-ac352412-web-3e953576.hosted.cumin.dev)**
*(Status: Live / Healthy — Serves the full interactive Security Operations Center dashboard)*
* **Private SOC Backend (`soc-backend`)**:
*Status: Strictly Private (Public Access: Disabled — Returns HTTP 404 externally)*
* **Private SOC Database (`soc-redis`)**:
*Status: Strictly Private (Raw TCP port 6379 only — Returns HTTP 404 externally)*
---
## 📋 Comprehensive Assessment Reports
1. 👉 **[Multi-Microservice Architecture & Security Report (Project: ghaymah-soc-microservices)](reports/GHAYMAH_MULTI_MICROSERVICES_SECURITY_REPORT.md)**
* Complete SOC multi-service topology: Edge Gateway, Private REST Backend, Private Redis Database, and Diagnostic Pod.
@@ -14,8 +26,8 @@ Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penet
## 🎯 Scope & Objectives
1. **Multi-Microservice Architecture**: Deploy a real 4-tier microservice application directly on Ghaymah:
- `soc-gateway`: Public edge ingress, reverse proxy, and UI dashboard.
- `soc-backend`: Private analysis engine listening on port 4000.
- `ghaymah-soc-gateway`: Public edge ingress, reverse proxy, and interactive UI dashboard.
- `soc-backend`: Private analysis engine listening on port 4000 (strictly internal).
- `soc-redis`: Private threat intelligence database & cache on port 6379.
- `soc-tester`: Live DevSecOps testing pod.
2. **Internal DNS Verification**: Verify container-to-container service discovery via CoreDNS (`10.43.0.10:53`) using deterministic unique names (`[name]-[hash]`).
@@ -40,13 +52,19 @@ Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penet
│ ├── ghaymah_execution.log # Baseline test execution log
│ └── uniquename_dns_tcp.log # Raw TCP test log
├── scripts/
│ ├── deploy_static_soc_gateway.js # Deploys live SOC Command Center UI
│ ├── make_backend_private.js # Enforces strict private backend isolation
│ ├── create_soc_microservices_project.js # Deploys the multi-microservice project
│ ├── run_soc_multiservice_tests.js # Automated multi-service test runner
│ ├── monitor_soc_project.js # Deployment status polling
│ ├── remote_exec.js # WebSocket terminal execution client
│ ├── test_soc_redis_tcp.js # Raw TCP protocol tester
│ └── auth_manager.js # Ghaymah authentication manager
├── soc_gateway_ui/ # Extracted SOC Dashboard static assets
│ ├── index.html # Full SOC Command Center HTML UI
│ └── app.zip # Deployment bundle
├── soc_project_topology.json # Full project resource definition & metadata
├── soc_static_gateway.json # Live Gateway metadata
└── token.json # Authenticated session token (auto-managed)
```
@@ -61,8 +79,9 @@ Comprehensive Automated QA, Internal DNS, Raw TCP, Inter-Service Mesh, and Penet
| **Internal DNS** | `soc-gateway-28cd1dc4e034`| **PASS** | Functional | Resolves to `10.42.5.101` via CoreDNS |
| **Raw TCP** | `soc-redis:6379` | **PASS** | Functional | `PING` $\rightarrow$ `+PONG`, `SET/GET` threat alerts verified |
| **Inter-Service Mesh** | `soc-gateway` $\rightarrow$ `soc-redis` | **PASS** | Functional | Edge Gateway queries Database directly over mesh |
| **Edge Ingress** | `soc-gateway` (Public URL) | **PASS** | Functional | HTTP 200 via `hosted.ghaymah.systems` |
| **Database Isolation**| `soc-redis` (Public Access) | **PASS** | Secure | HTTP 404 / Blocked from public internet |
| **Edge Ingress** | `ghaymah-soc-gateway` | **PASS** | Functional | HTTP 200 via `hosted.cumin.dev` (Full UI active) |
| **Backend Isolation** | `soc-backend` (Public URL)| **PASS** | Secure | HTTP 404 / Strictly private internal service |
| **Database Isolation**| `soc-redis` (Public URL) | **PASS** | Secure | HTTP 404 / Blocked from public internet |
| **Project Isolation**| Cross-project Redis/HTTP | **FINDING** | **Medium/High** | Projects in same account share flat mesh network |
| **Cluster Boundary** | K8s API (`10.43.0.1:443`) | **PASS** | Secure | HTTP 401 Unauthorized (RBAC enforced) |
| **SSRF / Cloud Meta** | AWS/Cloud Metadata (`169.254.169.254`) | **PASS** | Secure | Blocked / Unreachable |