ESET PROTECT - Server

该容器提供ESET PROTECT的Server组件。Web控制台组件请参见eset-protect-console页面。源代码可在Github获取。

快速启动

方式1：手动部署

首先，创建数据库容器：

shell
docker run --name mysql -e MYSQL_ROOT_PASSWORD=eraadmin -d mysql \
--default-authentication-plugin=mysql_native_password \
--innodb-log-file-size=100M \
--innodb-log-files-in-group=2 \
--max-allowed-packet=30M \
--bind-address=* \
--log_bin_trust_function_creators=1

然后，创建服务器容器：

shell
docker run --name eset-protect-server --link mysql --rm --tty --interactive --publish 2222:2222 --env DB_ADMIN_USERNAME=root --env DB_ADMIN_PASSWORD=eraadmin esetnederland/eset-protect-server

可选地，创建控制台容器：

shell
docker run --rm --tty --interactive --publish 8080:8080 --link eset-protect-server esetnederland/eset-protect-console

方式2：使用docker-compose

将以下内容复制到名为docker-compose.yml的文件中：

yaml
version: '3'

services:
    mysql:
        image: mysql:8.0.17
        command: |
            --default-authentication-plugin=mysql_native_password
            --innodb-log-file-size=100M
            --innodb-log-files-in-group=2
            --max-allowed-packet=30M
            --bind-address=*
            --log_bin_trust_function_creators=1
        restart: unless-stopped
        environment:
            - MYSQL_ROOT_USER=root
            - MYSQL_ROOT_PASSWORD=eraadmin
        volumes:
            - mysql:/var/lib/mysql

    eset-protect-server:
        image: esetnederland/eset-protect-server
        depends_on: 
            - mysql
        restart: unless-stopped
        environment:
            - DB_ADMIN_USERNAME=root
            - DB_ADMIN_PASSWORD=eraadmin
        volumes:
            - eset-protect-server-config:/config
            - eset-protect-server-data:/data
            - eset-protect-server-logs:/logs
        ports: 
            - 2222:2222

    eset-protect-console:
        image: esetnederland/eset-protect-console
        depends_on: 
            - eset-protect-server
        restart: unless-stopped
        volumes:
            - eset-protect-console:/config
        ports: 
            - 8080:8080

volumes:
    mysql:
    eset-protect-server-config:
    eset-protect-server-data:
    eset-protect-server-logs:
    eset-protect-console:

然后运行：

shell
docker-compose up

现在可通过浏览器访问[***]，使用凭据Administrator / eraadmin登录。

配置

可通过以下环境变量进行配置：

同样的设置也可通过以下Docker Secrets配置：

卷

该容器使用以下卷：

• /config
• /data
• /logs

生产环境部署

以下Compose文件使用现有数据库部署服务栈，并以Traefik作为反向代理：

.env

shell
# 通用设置
HOSTNAME=esetprotect.domain.nl

# Let's Encrypt设置
ACME_EMAIL=***

# 密码
SERVER_ROOT_PASSWORD=eraadmin
CERT_AUTH_PASSWORD=eraadmin

# 证书设置
CERT_AUTH_COMMON_NAME=ESET Protect Server Certification Authority
CERT_COUNTRY=NL
CERT_LOCALITY=Sliedrecht
CERT_ORGANIZATION=ESET Nederland
CERT_ORGANIZATIONAL_UNIT=IT
CERT_STATE=ZH

# 数据库设置
DB_HOSTNAME=db.domain.nl
DB_PORT=3306
DB_NAME=era_db
DB_USER_USERNAME=era_db_user
DB_USER_PASSWORD=eraadmin

# 控制台设置
HSTS_ENABLE=true
REMOTE_ADDRESS_SOURCE=x-forwarded-for-last

docker-compose.yml

yaml
version: '3'

services:
    traefik:
        image: traefik:2.2
        restart: unless-stopped
        command:
            #- --api.insecure=true # 取消注释以在8080端口启用仪表盘
            - --providers.docker=true
            - --providers.docker.exposedbydefault=false
            - --entrypoints.http.address=:80
            - --entrypoints.https.address=:443
            - --entrypoints.em-agent.address=:2222
            - --certificatesResolvers.le.acme.email=${ACME_EMAIL}
            - --certificatesResolvers.le.acme.httpChallenge.entryPoint=http
            - --certificatesResolvers.le.acme.storage=/etc/traefik/acme.json
            #- --providers.file.directory=/etc/traefik/dynamic # 取消注释以使用动态配置
        ports:
            - 80:80
            - 443:443
            - 2222:2222
            - 8080:8080
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock:ro
            - traefik:/etc/traefik

    eset-protect-server:
        image: esetnederland/eset-protect-server:latest
        restart: unless-stopped
        environment:
            - CERT_AUTH_COMMON_NAME=${CERT_AUTH_COMMON_NAME}
            - CERT_AUTH_PASSWORD=${CERT_AUTH_PASSWORD}
            - CERT_COUNTRY=${CERT_COUNTRY}
            - CERT_HOSTNAME=${HOSTNAME}
            - CERT_LOCALITY=${CERT_LOCALITY}
            - CERT_ORGANIZATION=${CERT_ORGANIZATION}
            - CERT_ORGANIZATIONAL_UNIT=${CERT_ORGANIZATIONAL_UNIT}
            - CERT_STATE=${CERT_STATE}
            - DB_HOSTNAME=${DB_HOSTNAME}
            - DB_PORT=${DB_PORT}
            - DB_NAME=${DB_NAME}
            - DB_USER_USERNAME=${DB_USER_USERNAME}
            - DB_USER_PASSWORD=${DB_USER_PASSWORD}
            - SERVER_ROOT_PASSWORD=${SERVER_ROOT_PASSWORD}
        volumes:
            - eset-protect-server-config:/config
            - eset-protect-server-data:/data
            - eset-protect-server-logs:/logs
        labels:
            - traefik.enable=true
            - traefik.tcp.routers.em-agent.rule=HostSNI(`*`)
            - traefik.tcp.routers.em-agent.entrypoints=em-agent
            - traefik.tcp.routers.em-agent.service=em-agent
            - traefik.tcp.routers.em-agent.tls=true
            - traefik.tcp.routers.em-agent.tls.passthrough=true
            - traefik.tcp.services.em-agent.load***.server.port=2222

    eset-protect-console:
        image: esetnederland/eset-protect-console:latest
        restart: unless-stopped
        environment:
            - HSTS_ENABLE=${HSTS_ENABLE}
            - REMOTE_ADDRESS_SOURCE=${REMOTE_ADDRESS_SOURCE}
        volumes:
            - eset-protect-console:/config
        labels:
            - traefik.enable=true
            - traefik.http.routers.eset-protect-console.rule=Host(`${HOSTNAME}`)
            - traefik.http.routers.eset-protect-console.entrypoints=http
            - traefik.http.routers.eset-protect-console.middlewares=eset-protect-console-redirect
            - traefik.http.routers.eset-protect-console-secure.rule=Host(`${HOSTNAME}`)
            - traefik.http.routers.eset-protect-console-secure.entrypoints=https
            - traefik.http.routers.eset-protect-console-secure.tls=true
            - traefik.http.routers.eset-protect-console-secure.tls.certresolver=le
            # - traefik.http.routers.eset-protect-console-secure.tls.options=intermediate@file # 取消注释以使用中级SSL配置，需动态配置文件
            - traefik.http.routers.eset-protect-console-secure.middlewares=eset-protect-console-secure-headers,eset-protect-console-secure-redirect
            - traefik.http.middlewares.eset-protect-console-redirect.redirectscheme.scheme=https
            - traefik.http.middlewares.eset-protect-console-secure-headers.headers.customFrameOptionsValue=SAMEORIGIN
            - traefik.http.middlewares.eset-protect-console-secure-headers.headers.sslredirect=true
            - traefik.http.middlewares.eset-protect-console-secure-headers.headers.stsSeconds=63072000
            - traefik.http.middlewares.eset-protect-console-secure-redirect.redirectregex.regex=^(https:\/\/[^:\/]+(:\\d+)?)\/$$
            - traefik.http.middlewares.eset-protect-console-secure-redirect.redirectregex.replacement=$${1}/era/webconsole/
            - traefik.http.middlewares.eset-protect-console-secure-redirect.redirectregex.permanent=true

volumes:
    traefik:
    eset-protect-server-config:
    eset-protect-server-data:
    eset-protect-server-logs:
    eset-protect-console:

若需在Qualys SSL服务器测试中获得A级评分，取消上述配置中“动态配置”和“中级SSL”相关行的注释，并将以下内容写入/etc/traefik/dynamic/ssl.toml（或直接写入其卷）：

toml
[tls.options]
  [tls.options.modern]
    minVersion = "VersionTLS13"

  [tls.options.intermediate]
    minVersion = "VersionTLS12"
    cipherSuites = [
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
    ]

  [tls.options.default]
    minVersion = "VersionTLS12"