WAF Chaitin

https://docs.waf.chaitin.com/en/
Admin
WAF Chaitin is a Web Application Firewall designed to protect web applications from various cyber...
Tokens:12,111
Snippets:94
Trust Score:7.8
Update:1 year ago
Show doc for...
Tokens:
Raw
### Keycloak Client Configuration Example

Source: https://docs.waf.chaitin.com/en/reference/articles/Auth-OIDC

Demonstrates the required configuration for a client within Keycloak when setting up OIDC authentication. This includes specifying redirect URIs and web origins.

```text
Valid Redirect URIs: `https://example.com/.safeline/auth/api/callback/oidc`
Web Origins: `https://example.com`
```

--------------------------------

### Install Docker

Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy

Installs the latest version of Docker on the system. This is a prerequisite for manual SafeLine deployment if Docker is not already installed.

```bash
curl -sSL "https://get.docker.com/" | bash
```

--------------------------------

### Install Docker

Source: https://docs.waf.chaitin.com/en/faq/home

Command to install Docker using a script from get.docker.com. This is a one-line installation script.

```bash
curl -fLsS https://get.docker.com/ | sh
```

--------------------------------

### Launch SafeLine Service

Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy

Starts the SafeLine service using Docker Compose. This process may take several minutes to complete.

```bash
docker compose up -d
```

--------------------------------

### Enable SSO

Source: https://docs.waf.chaitin.com/en/reference/articles/Auth-SSO

Enables Single Sign-On and configures its core parameters for unified authentication.

```APIDOC
## POST /websites/waf_chaitin_en/Auth-Settings

### Description
Enables SSO and configures the domain, port, SSL, login methods, and TOTP enforcement.

### Method
POST

### Endpoint
/websites/waf_chaitin_en/Auth-Settings

### Parameters
#### Request Body
- **Domain** (string) - Required - The domain name for users to access the unified authentication center.
- **Port** (integer) - Required - An available port number.
- **SSL** (boolean) - Optional - Enables or disables SSL for the SSO center.
- **Login Methods** (array) - Optional - Specifies the supported login methods.
- **Force Enable TOTP** (boolean) - Optional - If true, all users will require TOTP for 2FA.

### Request Example
```json
{
  "Domain": "home.in.example.cn",
  "Port": 8443,
  "SSL": true,
  "Login Methods": ["Password", "TOTP"],
  "Force Enable TOTP": false
}
```

### Response
#### Success Response (200)
- **message** (string) - Confirmation message indicating SSO has been enabled and configured.

#### Response Example
```json
{
  "message": "SSO enabled successfully."
}
```
```

--------------------------------

### Example Code Injection Attack

Source: https://docs.waf.chaitin.com/en/GetStarted/AddApplication

Provides an example of a Code Injection attack, aiming to execute arbitrary code on the server through vulnerable input fields.

```text
https://chaitin.com/?id=phpinfo();system('id')
```

--------------------------------

### Navigate to SafeLine Installation Directory

Source: https://docs.waf.chaitin.com/en/faq/home

This command changes the current directory to the SafeLine installation path, which is typically /data/safeline. This is often the first step in managing or uninstalling SafeLine.

```bash
cd /data/safeline
```

--------------------------------

### Example HTTP Request with Chained X-Forwarded-For (Multiple Proxies)

Source: https://docs.waf.chaitin.com/en/reference/articles/correct-obtain-attack-ip

Illustrates an HTTP GET request showcasing the chained nature of the X-Forwarded-For header, which records IPs from multiple proxy layers. The first IP is the client, followed by proxy IPs.

```http
GET / HTTP/1.1
Host: demo.waf.chaitin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36
X-Forwarded-For: 1.2.3.4, 11.12.13.14, 21.22.23.24
```

--------------------------------

### Get Administrator Account Credentials

Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy

Retrieves the initial username and password for the SafeLine administrator account. This command should be executed after SafeLine is running.

```bash
docker exec safeline-mgt resetadmin
```

--------------------------------

### False Positive Examples (Regex)

Source: https://docs.waf.chaitin.com/en/reference/articles/syntax-analysis

Examples of legitimate text that can be mistakenly identified as malicious by traditional regex patterns, leading to false positives.

```string
The union select members from each department to form a committee
```

```string
Her down on the alert(for the man) and walked into a world of rivers
```

--------------------------------

### Example SQL Injection Attack

Source: https://docs.waf.chaitin.com/en/GetStarted/AddApplication

Demonstrates a common SQL Injection attack pattern used to test application security against database manipulation.

```text
https://chaitin.com/?id=1+and+1=2+union+select+1
```

--------------------------------

### Add Application to SSO

Source: https://docs.waf.chaitin.com/en/reference/articles/Auth-SSO

Adds a specific application to the SSO configuration, defining its redirect and callback URLs.

```APIDOC
## POST /websites/waf_chaitin_en/Applications/{application_id}/AUTH

### Description
Adds an application to the SSO system by switching its authentication status and configuring its redirect and callback URLs.

### Method
POST

### Endpoint
/websites/waf_chaitin_en/Applications/{application_id}/AUTH

### Parameters
#### Path Parameters
- **application_id** (string) - Required - The unique identifier of the application to be added to SSO.

#### Request Body
- **Application Redirect URL** (string) - Required - The URL to redirect users to after authentication within the SSO center. Use `*` for any valid URL, but this requires manual entry in this field.
- **Auth Callback URL** (string) - Required - The URL used to pass user authentication information to the application server.

### Request Example
```json
{
  "Application Redirect URL": "https://myapp.example.com/callback",
  "Auth Callback URL": "https://auth.example.com/sso/callback"
}
```

### Response
#### Success Response (200)
- **message** (string) - Confirmation message indicating the application has been added to SSO.

#### Response Example
```json
{
  "message": "Application added to SSO successfully."
}
```
```

--------------------------------

### Example XSS Attack

Source: https://docs.waf.chaitin.com/en/GetStarted/AddApplication

Illustrates a Cross-Site Scripting (XSS) attack, designed to inject malicious scripts into web pages viewed by other users.

```text
https://chaitin.com/?id=<img+src=x+onerror=alert()>
```

--------------------------------

### Example HTTP Request with X-Forwarded-For (Single Proxy)

Source: https://docs.waf.chaitin.com/en/reference/articles/correct-obtain-attack-ip

Demonstrates a typical HTTP GET request where the X-Forwarded-For header is used to indicate the client's originating IP address when traffic passes through a single proxy.

```http
GET / HTTP/1.1
Host: demo.waf.chaitin.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36
X-Forwarded-For: 1.2.3.4
```

--------------------------------

### Example XXE Attack

Source: https://docs.waf.chaitin.com/en/GetStarted/AddApplication

Demonstrates an XML External Entity (XXE) attack, exploiting XML parsers to access local files or perform network requests.

```text
https://chaitin.com/?id=<?xml+version="1.0"?><!DOCTYPE+foo+SYSTEM+"">
```

--------------------------------

### Fluentd Dockerfile with Plugins

Source: https://docs.waf.chaitin.com/en/faq/home

A Dockerfile to build a Fluentd image, including necessary plugins for SQL and remote syslog forwarding. It installs Ruby dependencies and required gems.

```dockerfile
FROM fluent/fluentd:v1.16-1

# Use root account to use apk
USER root

# below RUN includes plugin as examples elasticsearch is not required
# you may customize including plugins as you wish
RUN apk add --no-cache --update --virtual .build-deps \
        sudo build-base ruby-dev \
 && apk add libpq-dev \
 && sudo gem install pg --no-document \
 && sudo gem install fluent-plugin-remote_syslog \
 && sudo gem sources --clear-all \
 && apk del .build-deps libpq-dev \
 && rm -rf /tmp/* /var/tmp/* /usr/lib/ruby/gems/*/cache/*.gem

COPY fluent.conf /fluentd/etc/fluent.conf

USER fluent
```

--------------------------------

### Safeline WAF OIDC Configuration Parameters

Source: https://docs.waf.chaitin.com/en/reference/articles/Auth-OIDC

Lists the essential OIDC parameters required for configuring Safeline WAF to connect with an identity provider.

```text
* OIDC Discovery URL
* Client ID
* Client Secret
```

--------------------------------

### Remove SafeLine Installation Files

Source: https://docs.waf.chaitin.com/en/faq/home

This command recursively removes the SafeLine installation directory and all its contents. It's the final step in completely uninstalling SafeLine from the system.

```bash
rm -rf /data/safeline
```

--------------------------------

### Restart SafeLine Service with Docker Compose

Source: https://docs.waf.chaitin.com/en/GetStarted/Upgrade

Restarts the SafeLine service by stopping existing containers and starting new ones using Docker Compose.

```bash
cd <safeline-directory>
docker compose down --remove-orphans && docker compose up -d
```

--------------------------------

### Safeline WAF OIDC Settings Table

Source: https://docs.waf.chaitin.com/en/reference/articles/Auth-OIDC

Details the fields available in the Safeline WAF console for configuring OIDC third-party login.

```text
Field | Description  
---|---
OIDC Server URL | The configuration discovery URL of the OIDC provider; Safeline will automatically append `.well-known/openid-configuration` at the end  
Client ID | The client ID obtained from the OIDC provider  
Client Secret | The client secret obtained from the OIDC provider  
Title Name | The title name shown on the blocking page，default is identity Sign In - OIDC  
Use Proxy to Access | Check this option if proxy access is required  
Auto Merge Account | Option to automatically log in to existing user accounts by email or phone number field matching
```

--------------------------------

### Semantic-based Detection Example

Source: https://docs.waf.chaitin.com/en/tutorials/advanced

Illustrates SafeLine's semantic-based detection by contrasting a natural language sentence with potential SQL injection keywords against its ability to distinguish based on formal language semantics, unlike traditional WAFs.

```text
The union select members from each department to form a committee.
```

--------------------------------

### Example Path Traversal Attack

Source: https://docs.waf.chaitin.com/en/GetStarted/AddApplication

Shows a Path Traversal (or Directory Traversal) attack, attempting to access files and directories outside of the web root folder.

```text
https://chaitin.com/?id=../../../../etc/passwd
```

--------------------------------

### Manage Application Details in SSO

Source: https://docs.waf.chaitin.com/en/reference/articles/Auth-SSO

Allows modification of an application's name and logo within the SSO center.

```APIDOC
## PUT /websites/waf_chaitin_en/SSO/Applications/{application_id}/details

### Description
Updates the name and logo of an application displayed in the SSO center.

### Method
PUT

### Endpoint
/websites/waf_chaitin_en/SSO/Applications/{application_id}/details

### Parameters
#### Path Parameters
- **application_id** (string) - Required - The unique identifier of the application whose details are to be updated.

#### Request Body
- **name** (string) - Optional - The new name for the application in the SSO center.
- **logo_url** (string) - Optional - The URL for the new application logo.

### Request Example
```json
{
  "name": "My Updated Application",
  "logo_url": "https://cdn.example.com/new_logo.png"
}
```

### Response
#### Success Response (200)
- **message** (string) - Confirmation message indicating the application details have been updated.

#### Response Example
```json
{
  "message": "Application details updated successfully."
}
```
```

--------------------------------

### SafeLine BlazeHTTP Sample HTTP Requests

Source: https://docs.waf.chaitin.com/en/tutorials/Effect

Demonstrates example HTTP requests for testing SafeLine's effectiveness. Includes a normal sample to check for false positives and a malicious sample to test detection of SQL injection vulnerabilities.

```http
# Normal sample: testcases/00/02/5ebf56a710da27b73a9ad59219f0.white
GET /rc-virtual-list@3.5.2/lib/hooks/useHeights.js HTTP/1.1
Host: npm.staticblitz.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Accept: */*
Origin: https://stackblitz.com
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://stackblitz.com/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7

# Malicious sample: testcases/8a/36/0bbc7685860c526e33f3cbd83f9c.black
GET /vulnerabilities/sqli_blind/?id=1%27+or+%27%27%3D%27&Submit=Submit HTTP/1.1
Host: 10.10.3.128
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://10.10.3.128/vulnerabilities/sqli_blind/?id=1%27+and+%27%27%3D%27&Submit=Submit
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
```

--------------------------------

### Reset MGT Certificate with CLI

Source: https://docs.waf.chaitin.com/en/faq/home

Execute the `reset-cert` command via the management CLI to resolve MGT certificate errors that may prevent the WAF from starting.

```bash
docker exec safeline-mgt reset-cert
```

--------------------------------

### Cloudflare Recommended SSL Cipher Combination

Source: https://docs.waf.chaitin.com/en/reference/articles/SSLProtocolConfigurationReference

This example presents a recommended SSL cipher suite by Cloudflare, emphasizing ECDHE and ChaCha20-Poly1305 for modern security and performance.

```text
[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]:ECDHE+AES128:RSA+AES128:ECDHE+AES256:RSA+AES256:ECDHE+3DES:RSA+3DES
```

--------------------------------

### Valid SQL Syntax Fragments

Source: https://docs.waf.chaitin.com/en/reference/articles/syntax-analysis

Examples of syntactically valid SQL statement fragments that SafeLine WAF analyzes to detect SQL injection.

```sql
union select xxx from xxx where
```

```sql
1 + 1 = 2
```

--------------------------------

### SQL Injection Bypass Techniques (Regex)

Source: https://docs.waf.chaitin.com/en/reference/articles/syntax-analysis

Examples demonstrating how attackers can bypass simple regex-based detection by inserting comments or encoding characters.

```string
union /**/ select
```

```string
window'\x61lert'
```

--------------------------------

### Invalid SQL Syntax Fragments

Source: https://docs.waf.chaitin.com/en/reference/articles/syntax-analysis

Examples of syntactically invalid SQL statement fragments that SafeLine WAF can identify as non-malicious.

```sql
union select xxx from xxx xxx xxx xxx xxx where
```

```sql
1 + 1 is 2
```

--------------------------------

### SafeLine Syslog Connectivity Test Message

Source: https://docs.waf.chaitin.com/en/reference/articles/Syslog

This is an example of the message expected to be received by the Syslog server to confirm a successful configuration. It follows the RFC-5424 format, indicating a connectivity test request.

```syslog
<30>1 2024-03-20T20:02:38+08:00 55ae65e87e75 /matio/mario 1 safeline_event - Connectivity test requested.
```

--------------------------------

### Reset Tengine Configuration

Source: https://docs.waf.chaitin.com/en/faq/home

This command executes a script to reset the Tengine container configuration. It's used as a recovery measure when Tengine fails to start due to invalid configurations, often after restarts or upgrades.

```bash
./reset_tengine.sh
```

--------------------------------

### Upgrade to SafeLine LTS Version 9.1.0

Source: https://docs.waf.chaitin.com/en/GetStarted/Upgrade

Command to install or upgrade to the 9.1.0 LTS version of SafeLine. This command should not be used for versions higher than 9.1.0 to avoid data corruption.

```bash
bash -c "$(curl -fsSLk https://waf-ce.chaitin.cn/release/latest/manager.sh)" -- --en --lts
```

--------------------------------

### SQL Injection Attack Patterns (Regex)

Source: https://docs.waf.chaitin.com/en/reference/articles/syntax-analysis

Examples of traditional regex patterns used to detect SQL injection attacks. These patterns are shown to be easily bypassed by attackers.

```regex
union[\w\s]?select
```

```regex
\balert\s\(
```

--------------------------------

### Nginx Official SSL Cipher Example

Source: https://docs.waf.chaitin.com/en/reference/articles/SSLProtocolConfigurationReference

This snippet shows a common SSL cipher combination used in Nginx official configurations. It specifies AES128-SHA, AES256-SHA, RC4-SHA, DES-CBC3-SHA, and RC4-MD5.

```text
AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
```

--------------------------------

### Create SafeLine Directory

Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy

Creates a directory named '/data/safeline' to store SafeLine's configuration and data. Requires at least 5GB of disk space.

```bash
mkdir -p "/data/safeline"
```

--------------------------------

### Create and Configure .env File

Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy

Creates a '.env' file in '/data/safeline' and sets essential environment variables for SafeLine configuration, including directory paths, ports, and image tags.

```bash
cd "/data/safeline"
touch ".env"
```

```properties
SAFELINE_DIR=/data/safeline
IMAGE_TAG=latest
MGT_PORT=9443
POSTGRES_PASSWORD={postgres-password}
SUBNET_PREFIX=172.22.222
IMAGE_PREFIX=chaitin
ARCH_SUFFIX=
RELEASE=
REGION=-g
MGT_PROXY=0
```

--------------------------------

### Check Server Configuration

Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy

Commands to verify server specifications like architecture, Docker version, CPU, memory, and disk space, ensuring compatibility with SafeLine.

```bash
uname -m                                # view Instruction architecture
docker version                          # view Docker version
docker compose version                  # view Docker Compose version
cat /proc/cpuinfo| grep "processor"     # view CPU info
free -h                                 # view memory info
df -h                                   # view disk info
lscpu | grep ssse3                      # Check CPU ssse3 instruction
```

--------------------------------

### Download Docker Compose Script

Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy

Downloads the latest 'compose.yaml' file into the '/data/safeline' directory, which is used to define and run the SafeLine services.

```bash
cd "/data/safeline"
wget "https://waf.chaitin.com/release/latest/compose.yaml"
```

--------------------------------

### Configure ARM Architecture or LTS Release

Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy

Optional configurations for the '.env' file. Sets 'ARCH_SUFFIX' to '-arm' for ARM servers or 'RELEASE' to '-lts' for the Long-Term Support version.

```bash
ARCH_SUFFIX=-arm
```

```bash
RELEASE=-lts
```

--------------------------------

### Uninstall SafeLine

Source: https://docs.waf.chaitin.com/en/GetStarted/Deploy

Steps to completely uninstall SafeLine, including stopping the services, removing container data, and cleaning up the SafeLine directory.

```bash
cd <safeline-directory>
```

```bash
docker compose down
```

```bash
rm -rf <safeline-directory>
```

--------------------------------

### Check SafeLine .env File

Source: https://docs.waf.chaitin.com/en/GetStarted/Upgrade

Displays the content of the .env file to verify necessary configuration fields for SafeLine.

```bash
cd <safeline-directory>
cat .env
```

--------------------------------

### Manual Upload Path for Large Files (Bash)

Source: https://docs.waf.chaitin.com/en/reference/articles/static_files

Provides the directory path on the WAF server for manually uploading files that exceed the default limit. It shows how to construct the path using environment variables and site-specific IDs.

```Bash
`${WAF_INSTALL_DIR}/resources/nginx/static/static_${SITE_ID}`
```

--------------------------------

### POST /api/open/site

Source: https://docs.waf.chaitin.com/en/reference/articles/openapi

This endpoint allows for the creation or configuration of a website or site within the SafeLine WAF. It requires an API token for authentication and accepts a JSON payload specifying ports, server names, upstream servers, and load balancing configuration.

```APIDOC
## POST /api/open/site

### Description
Configures a website or site within the SafeLine WAF, specifying network details and load balancing strategy.

### Method
POST

### Endpoint
https://IP:9443/api/open/site

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **ports** (array of strings) - Required - The ports to associate with the site (e.g., ["80"]).
- **server_names** (array of strings) - Required - The server names for the site (e.g., ["*"]).
- **upstreams** (array of strings) - Required - The upstream server addresses (e.g., ["http://127.0.0.1:9443"]).
- **comment** (string) - Optional - A comment for the site configuration.
- **load_balance** (object) - Required - Load balancing configuration.
  - **balance_type** (integer) - Required - The type of load balancing algorithm to use (e.g., 1 for round-robin).

### Request Example
```json
{
  "ports": ["80"],
  "server_names": ["*"],
  "upstreams": ["http://127.0.0.1:9443"],
  "comment": "",
  "load_balance": {
    "balance_type": 1
  }
}
```

### Response
#### Success Response (200)
This endpoint's success response is not detailed in the provided documentation, but typically indicates the successful creation or update of the site configuration.

#### Response Example
(No specific success response example provided in the source text)

### Authentication
Set `X-SLCE-API-TOKEN`: Your API Token in an HTTP header.
```

--------------------------------

### Nginx Target Configuration

Source: https://docs.waf.chaitin.com/en/reference/articles/Comparison-on-Six-Web-Application-Firewall

This Nginx configuration sets up a basic server that responds with 'hello WAF!' and a 200 status code to any incoming request. It's used as the target machine to receive traffic during WAF testing.

```nginx
location / {
    return 200 'hello WAF!';
    default_type text/plain;
}
```

--------------------------------

### Fluentd Configuration for SQL Input

Source: https://docs.waf.chaitin.com/en/faq/home

This Fluentd configuration defines a source to read data from the `mgt_detect_log_basic` table in a PostgreSQL database. It specifies connection details and table monitoring parameters.

```fluentd
<source>
  @type sql

  host safeline-pg // 默认数据库地址，如果在 compose.yml 中改过，请使用改后值
  port 5432
  database safeline-ce // 数据库名
  adapter postgresql
  username safeline-ce // 默认用户名，如果在 compose.yml 中改过，请使用改后值
  password POSTGRES_PASSWORD // 数据库密码，见安装目录下 .env

  select_interval 60s  // optional
  select_limit 500     // optional

  state_file /var/run/fluentd/sql_state

  <table>
    table mgt_detect_log_basic
    update_column timestamp
    time_column timestamp  // optional
  </table>

  # detects all tables instead of <table> sections
  #all_tables
</source>
```

--------------------------------

### Back up SafeLine Data using Docker Compose

Source: https://docs.waf.chaitin.com/en/GetStarted/Upgrade

Steps to back up SafeLine data before an upgrade. It involves stopping the service, copying data, and restarting the service.

```shell
cd <safeline-directory>
```

```shell
docker compose down
```

```shell
cp -r <safeline-directory> <backup-path>
```

```shell
docker compose up -d
```

--------------------------------

### Run Fluentd Container

Source: https://docs.waf.chaitin.com/en/faq/home

Command to run the built Fluentd container. It mounts a volume for state files and restarts the container automatically if it stops.

```bash
echo "" > ./sql-state
docker run -d --restart=always --name safeline-fluentd --net safeline-ce -v ./sql-state:/var/run/fluentd/sql_state safeline-flunetd:latest
```

--------------------------------

### Download Latest SafeLine Docker Compose Script

Source: https://docs.waf.chaitin.com/en/GetStarted/Upgrade

Replaces the existing compose.yaml file with the latest version from the specified URL.

```bash
cd <safeline-directory>
mv compose.yaml compose.yaml.old
wget "https://waf.chaitin.com/release/latest/compose.yaml"
```

--------------------------------

### Restart SafeLine-Tengine Container

Source: https://docs.waf.chaitin.com/en/faq/home

Command to restart the SafeLine-Tengine Docker container after resolving an IPv6 address issue in resolv.conf.

```bash
docker restart safeline-tengine
```

--------------------------------

### Add Seccomp Profile for SafeLine Management

Source: https://docs.waf.chaitin.com/en/faq/home

Configuration snippet to be added to the compose.yaml file under the management section to resolve 'Operation not permitted' errors in safelint-mgt-api, especially for older Docker versions. This requires a seccomp.json file in the working directory.

```yaml
security_opt:
  - seccomp=./seccomp.json
```

--------------------------------

### View Tengine Container Logs with docker logs

Source: https://docs.waf.chaitin.com/en/faq/home

Retrieve logs from the Tengine container using `docker logs`. This is crucial for identifying specific error messages and understanding the cause of Tengine-related problems.

```bash
docker logs -f safeline-tengine
```

--------------------------------

### Pull Latest SafeLine Docker Image

Source: https://docs.waf.chaitin.com/en/GetStarted/Upgrade

Pulls the latest Docker image for SafeLine using Docker Compose.

```bash
cd <safeline-directory>
docker compose pull
```

--------------------------------

### Test Safeline Configuration from Client

Source: https://docs.waf.chaitin.com/en/faq/home

Tests if Safeline is correctly configured and accessible from the client by sending a request to the Safeline IP and port. It requires the domain or IP, Safeline IP, and Safeline listening port.

```shell
curl -v -H "Host: <domain or IP>" http://<Safeline IP>:<Safeline listening port>
```

--------------------------------

### Check Docker Container Status

Source: https://docs.waf.chaitin.com/en/faq/home

Verifies if the SafeLine containers are running correctly. This command lists all active Docker containers, allowing users to check the status of 'safeline-mgt' and 'safeline-tengine'.

```bash
docker ps
```

--------------------------------

### Basic Authentication Form HTML

Source: https://docs.waf.chaitin.com/en/reference/articles/how-to-custom-auth-defense

Provides the basic HTML structure for an authentication form, including input fields for username and password, and a submit button. This form is essential for the custom authentication flow.

```html
<form id="form" action="#" class="form" onsubmit="return submit()">
  <input id="username" class="form-input" placeholder="Username" />
  <input id="password" class="form-input" type="password" placeholder="Password" />
  <button class="form-submit" id="form-submit">Submit</button>
</form>
```

--------------------------------

### Cipherli Recommended SSL Cipher

Source: https://docs.waf.chaitin.com/en/reference/articles/SSLProtocolConfigurationReference

This cipher suite is recommended by Cipherli, utilizing EECDH+AESGCM and EDH+AESGCM for robust encryption.

```text
EECDH+AESGCM:EDH+AESGCM
```

--------------------------------

### Check Nginx Configuration Syntax

Source: https://docs.waf.chaitin.com/en/faq/home

This command checks the syntax of the Nginx configuration files within the SafeLine Tengine container. It's a crucial step after making configuration changes to ensure they are valid before applying them.

```bash
docker exec safeline-tengine nginx -t
```

--------------------------------

### View Management Container Logs

Source: https://docs.waf.chaitin.com/en/faq/home

This command streams the logs from the 'safeline-mgt' container in real-time. It's useful for troubleshooting issues related to the SafeLine management service.

```bash
docker logs -f safeline-mgt
```

--------------------------------

### Test Nginx Configuration and Reload

Source: https://docs.waf.chaitin.com/en/faq/home

Validate the Nginx configuration syntax and apply changes by reloading the service. These commands are used after modifying Nginx configuration files to ensure correctness and activate updates.

```bash
docker exec safeline-tengine nginx -t
```

```bash
docker exec safeline-tengine nginx -s reload
```

--------------------------------

### Re-deploy SafeLine Containers with Compose

Source: https://docs.waf.chaitin.com/en/faq/home

Command to stop and then restart SafeLine containers using Docker Compose, typically after modifying configuration files like .env to resolve port conflicts or other issues.

```bash
docker compose down && docker compose up -d
```

--------------------------------

### Check Listening Ports

Source: https://docs.waf.chaitin.com/en/faq/home

Command to list all listening TCP network sockets and associated processes. Useful for identifying port conflicts before configuring SafeLine.

```bash
ss -antp | grep LISTEN
```

--------------------------------

### HTML and CSS for SafeLine WAF Auth Page

Source: https://docs.waf.chaitin.com/en/reference/articles/how-to-custom-auth-defense

This snippet contains the complete HTML structure and CSS styling for a SafeLine WAF authentication page. It includes form elements for username and password, error message display, and a submit button, all styled to achieve a specific aesthetic.

```html
<!DOCTYPE html>

<html lang="en">

<head>
  <meta charset="utf-8" />
  <title>SafeLine WAF Auth</title>
  <meta name="viewport" content="width=device-width,initial-scale=1" />
  <style>
    html {
      height: 100%;
    }

    body {
      background: #f7f8fa;
      font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI",
        Roboto, Oxygen, Ubuntu, Cantarell, "Open Sans", "Helvetica Neue",
        sans-serif;
      margin: 0;
      height: 100%;
    }

    .container {
      display: flex;
      align-items: center;
      justify-content: center;
      flex-direction: column;
      height: 100%;
    }

    .title {
      display: flex;
      align-items: center;
      font-size: 24px;
      margin-bottom: 5px;
    }

    .form {
      width: 440px;
      height: 318px;
      background: rgba(255, 255, 255, 0.8);
      box-shadow: 0px 8px 15px 0px rgba(145, 158, 171, 0.08);
      border-radius: 8px;
      border: 2px solid #ffffff;
      display: flex;
      justify-content: space-between;
      flex-direction: column;
      padding: 32px;
      box-sizing: border-box;
      font-size: 16px;
    }

    .form-field {
      width: 376px;
      height: 42px;
      background: #f7f8fa;
      border-radius: 4px;
      display: flex;
      align-items: center;
      border: 1px white solid;
    }

    .form-field-help {
      color: #FF4D4F;
    }

    .form-field svg {
      margin: 0 12px;
    }

    .form-input {
      font-size: 16px;
      border: 0;
      outline: 0;
      background: #f7f8fa;
      flex-grow: 1;
      width: 100px;
      border-radius: 4px;
    }

    .form-input-error {
      border: 1px #FF4D4F solid;
    }

    .form-submit {
      width: 376px;
      height: 42px;
      background: #0fc6c2;
      border-radius: 4px;
      border: 0;
      color: white;
      cursor: pointer;
      font-size: 16px;
    }

    .form-error {
      color: lightcoral;
      display: none;
    }

    .form-submit:hover {
      background: #09c0c0;
    }

    .footer {
      position: absolute;
      bottom: 32px;
      left: 0;
      width: 100%;
      color: #a8a8a8;
      font-size: 14px;
      text-align: center;
    }

    .footer-waflink {
      color: #0fc6c2;
      text-decoration: none;
    }
  </style>
</head>

<body>
  <div class="container">
    <form id="form" action="#" class="form" onsubmit="return submit()">
      <div class="title">
        <img style="margin-right: 15px; height: 32px; width: 30px;"
          src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAMAAABEpIrGAAAC+lBMVEUAAAAtLS0gICA7Ozs6OjopKysiJiYFAwMWFhYtLCwhISETHh5EREQTExNDS0sjJCQPISFFR0dAJigLGBguLi4xMDEbIiFAMjNDQ0MwLzAHBwc+Pj4ICAhCQkIkJCRFRkYJCgoXGhoIDQ0PHRwxMTFAQEARERFDREQxMTFGRkZGRkYrKysdHh5BQUE8PDw/Pz8ICAglJSUeHh43NzcODw8SEhJISEgNDQ01NTUjIyMPDw8uLi4SEhJKSko4ODgiIiIFBQUVFRUbGxsGBgY4ODgWFhZDQ0MJCwspKSkRERE7OztJSUknJycJCQkLCwtBQUFFRUVDQ0MiIiL///9AQEAFBAQLAAAUrao5OjpERERAQ0MxMTEPAQE0MzQRpqMApKEAoZ4SoJ0BlpM5OTk2NTUYFxcIExLw9vbn8fAFy8cVqqcSqKUQmZYYmJUAmJUAkY42NzcqMTEvLzAPCgrK4ODD3NsTxMAXvLgPsq8crKkjop8Rop8an5wAnZoTmpcAmpcPlpMQlJEsgoBKTUxKSko6Pz87PT0yNjYTNDM4HB4bHR0MHBs3FBcKCAgfAAAVAAD7/f3t9PTb6enV5uaw09KhzcyaxcQDxsKTwcALvLl9urgatLBasq9Gsa5ksK4Rr6xQq6gRq6gjqqcsqKUZp6QBp6MfpqMQnZolmJUAmJQblJEVk5AAjIgAhoIQe3kydXMQb20ybmw2W1k6UlE5LzA6KywpJycmJyclHx8gEhMaAgI0AAD0+fnj7u7R4uK41dSqzcxfyseHw8EAwb2Nv70ovbqDvLoAu7cOtrJYtbInsK0MrKkArKg5q6g5paMXn5kzm5gwmJUImJUkko8RjosQiocpiIYchoMSg4AEgH02Y2IPWFcXS0o0JyhAHyI0HB4VExMtDRASDw8qBQaRyMaixcRAwb55v70kv7txvLkgt7NEr6xaqqgLm5gQh4UpeXYmdnQWc3EZa2ksZWQQZWMpYmAzT041R0YTRUQvPT0cNjU8MjMjLy4zCxANGbKlAAAAU3RSTlMABAf7+/77+z7+/vhLKP7+/v389xn9/Pv4z8e9uod9Vf76+fbz4trQxrysqKCeln5OMiL8+PLs7Ovo6OTh3tnPz7++s7KXkY2IenRmW1pFPzsTD7TaAR0AAAN5SURBVDjLYoABRkZGIOFtZisP5kAEEZJMTCAhHs3mlpZmrQAgEygCUwVjBcprCrZICApGtghq8TAxQBQxwcwQkXdTj2zmk+ALiQQSzZHqsjwiEMOB5urL6kqrhkRGRgmJR93bHCUEoiMjQ1SldWX1/YHyISEhUVEhbczMIes3C22aXRV179ZcpAvVheFb1yurVWNvJw0NDQtq63DQmIZoZEQdGhxrYAxBD5goGy8ckZqCqAoMBDKIm4WJoJhpxrmWZ5nGk5WUgBUQAwbWJXLmEyyZYOLPZsXFlTFFLlpJTF0REMIYmJgsoLR2ZW1oA1UBw5pygICRkTT12snMp9Znl1hjm0ooDAyMDF0QTAK1zCDNwCRUWFIMFByZnJ7S4KGKhbiITi4uJARBLgAFhAoQKqoRqEViITygoKCh+fEJQ0TB08L3BBZh5Sg0JxERARzdRlYXNmASQAVDgwUKSBjHkMGoQFgCpAjpLp+ebZwIwmkKiDMOwpQGVFBlQVMQKBoAAgCZRIipBmZnEAAAAASUVORK5CYII="
          alt="Safeline" />
        <h3>SafeLine Auth</h3>
      </div>
      <div class="form-field">
        <input id="username" class="form-input" placeholder="Username" />
      </div>
      <div class="form-field">
        <input id="password" class="form-input" type="password" placeholder="Password" />
      </div>
      <div id="error" class="form-error">
        <small class="form-field-help">Wrong username or password</small>
      </div>
      <button class="form-submit" id="form-submit">Submit</button>
    </form>
    <div class="footer">

```

--------------------------------

### Automatic SafeLine Upgrade Script

Source: https://docs.waf.chaitin.com/en/GetStarted/Upgrade

Executes a script to automatically upgrade SafeLine. This is the recommended method and does not require stopping the service beforehand.

```bash
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
```

--------------------------------

### Restart Docker Daemon

Source: https://docs.waf.chaitin.com/en/faq/home

Command to restart the Docker daemon, often necessary when encountering issues with Docker networks during SafeLine deployment.

```bash
systemctl restart docker
```

--------------------------------

### Add Custom Nginx Configuration

Source: https://docs.waf.chaitin.com/en/faq/home

This snippet demonstrates how to add custom Nginx configurations to a site by including an additional parameters file. This ensures custom settings are not overwritten during site updates or service restarts. It requires modifying specific Nginx configuration files and potentially creating custom parameter files.

```nginx
server {
    location ^~ / {
        proxy_pass http://backend_1;
        include proxy_params;
        include /etc/nginx/custom_params/backend_1;
        # ...
    }
}
```

--------------------------------

### Mozilla General Recommended SSL Cipher

Source: https://docs.waf.chaitin.com/en/reference/articles/SSLProtocolConfigurationReference

This is a general recommendation from Mozilla for SSL ciphers, covering ECDHE, DHE, and ChaCha20-Poly1305 for strong security and compatibility.

```text
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
```

--------------------------------

### Test Safeline Loopback Configuration

Source: https://docs.waf.chaitin.com/en/faq/home

Tests Safeline's internal configuration by sending a request to its loopback address and listening port. This helps isolate issues when client-to-Safeline communication works but Safeline-to-upstream does not. It requires the domain or IP and Safeline listening port.

```shell
curl -H "Host: <domain or IP>" http://127.0.0.1:<Safeline listening port>
```

--------------------------------

### Rebind Dynamic Password

Source: https://docs.waf.chaitin.com/en/faq/home

Rebinds the dynamic password for SafeLine. This involves executing a command to reset the TOTP settings and then reconfiguring on the SafeLine page.

```bash
docker exec safeline-mgt resettotp
```

--------------------------------

### SafeLine Log File Structure

Source: https://docs.waf.chaitin.com/en/reference/articles/SafeLineTechnicalArchitecture

Illustrates the directory structure for SafeLine persistent data and logs, specifying the location of logs for detection, management, and NGINX services.

```tree
root@user:/path/to/safeline-ce/logs# tree
.
├── detector
│   └── snserver.log    # Output logs from the detection container
├── management
│   ├── nginx.log     # NGINX logs from the Tengine container
│   └── webserver.log    # safeline-mgt-api container logs
└── nginx
    ├── error.log  # NGINX error logs
    └── tcd.log  # tcd is a network proxy process that Tengine uses to communicate with safeline-mgt-api; this file stores communication logs between them
```

--------------------------------

### Send POST request to SafeLine OpenAPI with API Token

Source: https://docs.waf.chaitin.com/en/reference/articles/openapi

This Python snippet demonstrates how to send a POST request to the SafeLine OpenAPI endpoint to configure site settings. It includes setting the API token in the request headers and constructing the JSON payload. The 'requests' library is used for making HTTP requests, and 'json' is used for payload serialization. Note that SSL verification is disabled (`verify=False`).

```python
import requests
import json

header = {
       "X-SLCE-API-TOKEN": "Your API Token"
}

url = 'https://IP:9443/api/open/site'

request_playload = {
                "ports":["80"],"server_names":["*"],
                "upstreams":["http://127.0.0.1:9443"],"comment":"",
                "load_balance":{"balance_type":1}
}

request_playload = json.dumps(request_playload)
requests.post(url=url,headers=header,data=request_playload,verify=False)
```

--------------------------------

### High Strength SSL Cipher Suite

Source: https://docs.waf.chaitin.com/en/reference/articles/SSLProtocolConfigurationReference

This configuration defines a high-strength cipher suite, excluding weaker or less secure options like NULL encryption, export ciphers, Camellia, DES, MD5, PSK, RC4, and RSA, while prioritizing stronger algorithms.

```text
HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4:!RSA;
```

--------------------------------

### Reload Nginx Configuration

Source: https://docs.waf.chaitin.com/en/faq/home

This command reloads the Nginx configuration within the SafeLine Tengine container, applying any recent changes without interrupting active connections. It's typically used after verifying configuration syntax.

```bash
docker exec safeline-tengine nginx -s reload
```

--------------------------------

### Clear SafeLine Database Statistics and Logs

Source: https://docs.waf.chaitin.com/en/faq/home

Utilize the `cleanlogs` command on the SafeLine management container to purge all database statistics and detection logs. This action is irreversible.

```bash
docker exec safeline-mgt cleanlogs
```

--------------------------------

### Retrieve Source IP from HTTP Headers (SafeLine Configuration)

Source: https://docs.waf.chaitin.com/en/faq/home

Demonstrates how SafeLine can be configured to extract the client's source IP address from specific HTTP headers, such as 'X-Forwarded-For' or 'X-Real-IP', when proxy devices are present in the network path.

```text
GET /path HTTP/1.1
Host: waf.chaitin.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
X-Forwarded-For: 110.123.66.233, 10.10.3.15
X-Real-IP: 110.123.66.233
```
Tokens:
Raw