diff --git a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md index 0acd696b0e2..7867571094e 100644 --- a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md +++ b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/index.md @@ -3,7 +3,7 @@ order: 0 pcx-content-type: navigation --- -# Setup +# Get started To create and manage Tunnels, you'll first need to install and authenticate [`cloudflared`](/glossary#cloudflared) on your machine. `cloudflared` runs alongside or on your origin servers to connect to Cloudflare's network, as well as client devices for non-HTTP traffic from user endpoints. diff --git a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/installation.md b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/installation.md index 876208ab36b..0ae533e7469 100644 --- a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/installation.md +++ b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/installation.md @@ -3,7 +3,7 @@ order: 1 pcx-content-type: reference --- -# Install `cloudflared` +# Download `cloudflared` Cloudflare Tunnel requires the installation of a lightweight server-side daemon, `cloudflared`, to connect your infrastructure to Cloudflare. `cloudflared` is an [open source project](https://github.com/cloudflare/cloudflared) maintained by Cloudflare. @@ -23,54 +23,9 @@ Binary | [Download](https://github.com/cloudflare/cloudflared/releases/latest/do -### `.deb` install - -Use the `deb` package manager to install `cloudflared` on compatible machines. `amd64 / x86-64` package in this example. - -```bash -wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb -dpkg -i cloudflared-linux-amd64.deb -``` - -### `.rpm` install - -Use the `rpm` package manager to install `cloudflared` on compatable machines. `amd64 / x86-64` is used in this example. - -```bash -wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm -rpm -ivh cloudflared-linux-x86_64.rpm -``` - -### Build from source - -You can also build the latest version of `cloudflared` from source with the following steps. - -```sh -$ git clone https://github.com/cloudflare/cloudflared.git -$ cd cloudflared -$ make cloudflared -$ go install github.com/cloudflare/cloudflared/cmd/cloudflared -``` - -Depending on where you installed `cloudflared`, you can move it to a known path as well. - -```bash -mv /root/cloudflared/cloudflared /usr/bin/cloudflared -``` - -## Docker - -A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.com/r/cloudflare/cloudflared). - ## macOS -You can install `cloudflared` on macOS systems via Homebrew: - -```sh -$ brew install cloudflare/cloudflare/cloudflared -``` - -Alternatively, you can [download the latest Darwin amd64 release directly](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-amd64.tgz). +You can [download the latest Darwin amd64 release directly](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-amd64.tgz). ## Windows @@ -78,35 +33,17 @@ Type | 32-bit | 64-bit | -------|----------------|-----| Executable | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-386.exe) | [Download](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe) | -1. Open PowerShell. -1. Change to your Downloads directory. -1. (Optional) Rename the executable to `cloudflared.exe`. -1. Run `.\cloudflared.exe --version`. It should output the version of `cloudflared`. Note that `cloudflared.exe` could be `cloudflared-windows-amd64.exe` or `cloudflared-windows-386.exe` if you haven't renamed it. - -## Build from source - -You can also build the latest version of `cloudflared` from source with the following steps. - -```sh -$ git clone https://github.com/cloudflare/cloudflared.git -$ cd cloudflared -$ make cloudflared -$ go install github.com/cloudflare/cloudflared/cmd/cloudflared -``` - -Depending on where you installed `cloudflared`, you can move it to a known path as well. +## Docker -```bash -mv /root/cloudflared/cloudflared /usr/bin/cloudflared -``` +A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.com/r/cloudflare/cloudflared). -## Updating `cloudflared` +## Update `cloudflared` You can update cloudflared by running the following command. @@ -135,7 +72,6 @@ If you are not using Cloudflare's Load Balancer, you can use multiple instances 3. In the Cloudflare DNS dashboard, [replace](/connections/connect-apps/routing-to-tunnel/dns) the address of the current instance of `cloudflared` with the address of the new instance. Save the record. 4. Remove the now-inactive instance of `cloudflared`. - #### Running multiple instances in Windows Windows systems require services to have a unique name and display name. You can run multiple instances of `cloudflared` by creating `cloudflared` services with unique names. diff --git a/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md new file mode 100644 index 00000000000..3a03d50175a --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-apps/install-and-setup/tunnel-guide.md @@ -0,0 +1,187 @@ +--- +order: 3 +title: Tunnel guide +pcx-content-type: how-to +--- + +# Set up your first tunnel + +Follow this step-by-step guide to getting your first tunnel up and running. Before you start, make sure you: +1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website) +1. [Change your domain nameservers to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/205195708) + +## 1. Download and install `cloudflared` + +
+Windows +
+ +First, download `cloudflared` on your machine. Visit the [downloads](/connections/connect-apps/install-and-setup/installation) page to find the right package for your OS. + +Next, rename the executable to `cloudflared.exe`, and then open PowerShell. Change directory to your Downloads folder and run `.\cloudflared.exe --version`. It should output the version of `cloudflared`. Note that `cloudflared.exe` could be `cloudflared-windows-amd64.exe` or `cloudflared-windows-386.exe` if you haven't renamed it. + +Replace the path in the example with the specifics of your Downloads directory: + +```text +PS C:\Users\Administrator\Downloads\cloudflared-stable-windows-amd64> .\cloudflared.exe --version +``` + +### Build from source + +You can also build the latest version of `cloudflared` from source with the following steps: + +```bash +$ git clone https://github.com/cloudflare/cloudflared.git +$ cd cloudflared +$ make cloudflared +$ go install github.com/cloudflare/cloudflared/cmd/cloudflared +``` + +Depending on where you installed `cloudflared`, you can move it to a known path as well. + +```bash +mv /root/cloudflared/cloudflared /usr/bin/cloudflared +``` + +
+
+ +
+macOS +
+ +The first step to creating a tunnel is to download and install `cloudflared` on your machine. + +```sh +$ brew install cloudflare/cloudflare/cloudflared +``` + +Alternatively, you can [download the latest Darwin amd64 release](/connections/connect-apps/install-and-setup/installation) directly. + +
+
+ +
+Linux +
+ +First, download `cloudflared` on your machine. Visit the [downloads](/connections/connect-apps/install-and-setup/installation) page to find the right package for your OS. + +Next, install `cloudflared`. + +### .deb install +Use the deb package manager to install `cloudflared` on compatible machines. `amd64 / x86-64` is used in this example. + +```sh +wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb dpkg -i cloudflared-linux-amd64.deb +``` + +### ​.rpm install +Use the rpm package manager to install `cloudflared` on compatible machines. `amd64 / x86-64` is used in this example. + +```sh +wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-x86_64.rpm +``` + +### Build from source + +You can also build the latest version of `cloudflared` from source with the following steps. + +```sh +$ git clone https://github.com/cloudflare/cloudflared.git +$ cd cloudflared +$ make cloudflared +$ go install github.com/cloudflare/cloudflared/cmd/cloudflared +``` + +Depending on where you installed `cloudflared`, you can move it to a known path as well. + +```bash +mv /root/cloudflared/cloudflared /usr/bin/cloudflared +``` + +
+
+ +## 2. Authenticate `cloudflared` + +```bash +$ cloudflared tunnel login +``` + +Running this command will: + +* Open a browser window and prompt you to log into your Cloudflare account. After logging into your account, select your hostname. +* Generate a [cert.pem file](/connections/connect-apps/tunnel-useful-terms#cert-pem). The `cert.pem` file contains account-wide credentials. + +## 3. Create a tunnel and give it a name + +```bash +$ cloudflared tunnel create +``` + +Running this command will: +* Create a tunnel by establishing a persistent relationship between the [name you provide](/connections/connect-apps/tunnel-useful-terms#tunnel-name) and a [UUID](/connections/connect-apps/tunnel-useful-terms#tunnel-uuid) for your tunnel. At this point, no connection is active within the tunnel yet. +* Generate a [credentials file](/connections/connect-apps/tunnel-useful-terms#credentials-file). +* Create a subdomain of `.cfargotunnel.com`. + +From the output of the command, take note of the tunnel’s UUID and the path to your tunnel’s credentials file. + +## 4. Create a configuration file + +Create a [configuration file](/connections/connect-apps/tunnel-useful-terms#configuration-file) in your `.cloudflared` directory using any text editor. This file will configure the tunnel to route traffic from a given origin to the hostname of your choice. + +Add the following fields to the file: + +**If you’re connecting an application** + +```txt +url: http://localhost:8000 +tunnel: +credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json +``` + +**If you’re connecting a network** + +```txt +tunnel: +credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json +``` + +## 5. Start routing traffic + +Now assign a CNAME record that points traffic to your tunnel subdomain. This record will be easier to remember and share. + +```bash +$ cloudflared tunnel route dns +``` + +You can confirm that the route has been successfully established by running: + +```bash +$ cloudflared tunnel route ip show +``` + +## 6. Run the tunnel + +Run the tunnel to proxy incoming traffic from the Tunnel to any number of services running locally on your origin. + +```bash +$ cloudflared tunnel --config path/config.yaml run +``` + +You can also run the tunnel without a configuration file. To do that, run it by adding the necessary [flags](/connections/connect-apps/configuration/config#arguments) after the `run` command and before the name or UUID. For example, running your tunnel with this command way will route all traffic to the given URL: + +```bash +$ cloudflared tunnel run --url localhost:3000 +``` + +Cloudflare Tunnel can install itself as a system service on Linux and Windows and as a launch agent on macOS. For more information, refer to [Run as a service](/connections/connect-apps/run-tunnel/run-as-service). + +## 7. Check the tunnel + +Your tunnel configuration is complete! Navigate to **Access** > **Tunnels** on the Teams Dashboard to see your tunnel listed as active. If you want to see a list of active tunnels directly from your CLI, you can run: + +```bash +$ cloudflared tunnel list +``` \ No newline at end of file diff --git a/products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md b/products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md new file mode 100644 index 00000000000..0023efa18c4 --- /dev/null +++ b/products/cloudflare-one/src/content/connections/connect-apps/tunnel-useful-terms.md @@ -0,0 +1,30 @@ +--- +order: 2 +pcx-content-type: reference +--- + +# Useful terms + +## Tunnel +A tunnel is a secure, outbound-only pathway you can establish between your origin and the Cloudflare edge. Each tunnel you create will be assigned a [name](#tunnel-name) and a [UUID](#tunnel-uuid). + +## Tunnel UUID +A tunnel UUID is an alpha-numeric, unique ID assigned to a tunnel. The tunnel UUID can be used in [configuration files](#configuration-file), and in general, whenever you need to reference a specific tunnel. + +## Tunnel name +The `cloudflared tunnel create ` command creates a tunnel and assigns it a name. Once named, a tunnel is a persistent pathway within which you can stop and start as many [connectors](#connector) as needed, adding stability and ease of use to your tunnel experience. Tunnel names do not need to be hostnames; for example, you can assign your tunnel a name that represents your application/network, a particular server, or the cloud environment where it runs. A human-readable identifier lets you easily reference a tunnel whenever you need. + +## Connector +Users can create and configure a tunnel once and run it as multiple different `cloudflared` processes. These processes are known as connectors, or replicas. DNS records and Cloudflare Load Balancers can still point to the tunnel and its UUID, while that tunnel sends traffic to the multiple instances of cloudflared that run through it. Using multiple connectors provides tunnels with high availability, scalability, and elasticity. + +## Configuration file +This is a `.yaml` file that functions as the operating manual for `cloudflared`. By creating a configuration file, you can have fine-grained control over how their instance of cloudflared will operate. This includes operations like what you want `cloudflared` to do with traffic (for example, proxy websockets to port `xxxx`, or ssh to port `yyyy`), where `cloudflared` should search for authorization (credentials file, tunnel token), and what mode it should run in (for example, [`warp-routing`](/connections/connect-networks/private-net/create-tunnel#configure-the-tunnel)). In the absence of a configuration file, cloudflared will proxy outbound traffic through port `8080`. + +## Cert.pem +This is the certificate file issued by Cloudflare when you run `cloudflared tunnel login`. This file is required when you create new tunnels, delete existing tunnels, change DNS records, or configure tunnel routing from cloudflared. This file is not required to perform actions such as running an existing tunnel or managing tunnel routing from the Cloudflare dashboard. The cert.pem origin certificate is valid for at least 10 years, and the service token it contains is valid until revoked. + +## Credentials file +This file is created when you run `cloudflared tunnel create `. It stores your tunnel’s credentials in a `.json` format, and is unique to each tunnel. This file functions as a token authenticating the tunnel it is associated with. + +## Ingress rule +Ingress rules let users specify which local services traffic should be proxied to. If a rule doesn't specify a path, all paths will be matched. Ingress rules can be listed in your [configuration file](#configuration-file) or when running `cloudflared tunnel ingress`. \ No newline at end of file diff --git a/products/cloudflare-one/src/content/identity/devices/application-check.md b/products/cloudflare-one/src/content/identity/devices/application-check.md index 4b165d6db3b..60c7e4cc4e4 100644 --- a/products/cloudflare-one/src/content/identity/devices/application-check.md +++ b/products/cloudflare-one/src/content/identity/devices/application-check.md @@ -24,11 +24,6 @@ You can create multiple instances of the Application Check for each operating sy The Application Check device posture attribute checks that a specific application process is running on a device. -| Prerequisites | -| ------------- | -| This check is supported on: Windows, macOS, Linux| -| This check is not supported on: Chrome, Android, or iOS | - To enable Application Check: 1. On the Teams Dashboard, navigate to **My Team** > **Devices** > **Device posture**. diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-block-page.png b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-block-page.png new file mode 100644 index 00000000000..ffe5ac55502 Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-block-page.png differ diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-domains.png b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-domains.png new file mode 100644 index 00000000000..2e19eeaedae Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-domains.png differ diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-list.png b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-list.png new file mode 100644 index 00000000000..c9ee8e47a73 Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-list.png differ diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-policy.png b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-policy.png new file mode 100644 index 00000000000..90ac7731293 Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/microsoft-mcas/mcas-policy.png differ diff --git a/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/gateway-analytics.png b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/gateway-analytics.png new file mode 100644 index 00000000000..cb4581b1150 Binary files /dev/null and b/products/cloudflare-one/src/content/static/secure-web-gateway/secure-dns-network/gateway-analytics.png differ diff --git a/products/cloudflare-one/src/content/tutorials/integrate-microsoft-mcas-teams.md b/products/cloudflare-one/src/content/tutorials/integrate-microsoft-mcas-teams.md new file mode 100644 index 00000000000..17afe962236 --- /dev/null +++ b/products/cloudflare-one/src/content/tutorials/integrate-microsoft-mcas-teams.md @@ -0,0 +1,92 @@ +--- +updated: 2021-08-19 +category: 🔐 Zero Trust +pcx-content-type: tutorial +--- + +# Integrate Microsoft MCAS with Teams + +Many security teams rely on Microsoft MCAS (Microsoft Cloud App Security), Microsoft's CASB solution, to identify and block threats on the Internet, as well as allow or block access to cloud applications. This tutorial covers how to integrate MCAS with Cloudflare for Teams, and create Gateway HTTP policies to ensure visibility and control over data. + +Microsoft provides an MCAS API endpoint to allow queries to see which applications have been marked as blocked or allowed. With an MCAS API call, you can manage a URL category that contains the blocked URLs returned by the API query, and use the output to create a Hostname List that can be used by Gateway HTTP policies to block them. + + +**⏲️ Time to complete:** + +20 minutes + +## Basic configuration + +In your Microsoft account, you first need to create an API token and URL endpoint to use to query the URLs blocked by MCAS. +Follow the guide for [Managing API tokens for Microsoft Cloud App Security](https://docs.microsoft.com/en-us/cloud-app-security/api-authentication) to generate a new API token and a custom API URL for the API endpoint. + +## Using the API to query banned applications + +Once you have the API token and API URL, use curl to get the list of banned applications from Microsoft MCAS: + +```txt +curl -v "https:///api/discovery_block_scripts/?format=120&type=banned" -H "Authorization: Token " +``` + +This will return a list of banned hostnames. In this case, Angie's List is the banned application. + +![Banned hostnames](../static/secure-web-gateway/microsoft-mcas/mcas-domains.png) + +### Processing the output + +As you can see, the banned hostnames are preceded by a `.`. To use this output for a Teams List, we need to do some text processing. + +1. Run the curl API call and direct the output to a file, in this case `mcas.txt`: + + ```txt + curl -v "https:///api/discovery_block_scripts/?format=120&type=banned" -H "Authorization: Token " > mcas.txt + ``` + +1. Remove the leading `.`, for example by running `sed` from the CLI: + + ```txt + sed -i 's/^.//' mcas.txt + ``` + +1. This will give you the list of hostnames without leading `.`. + +1. Replace the file's `.txt` extension with `.csv`. The file can now be imported into Teams as a Hostname list. + + +## Using the API to query allowed applications + +If you would like to get a list of all of the MCAS allowed applications, you can use the same API query, but instead of using `type=banned`, use `type=allowed`. This will return a much larger list. + +```sh +curl -v "https:///api/discovery_block_scripts/?format=120&type=allowed" -H "Authorization: Token " +``` + +## Adding a hostname list in the Teams Dashboard + +1. In the Teams Dashboard, navigate to **My Team** > **Lists** +1. Click on **Upload CSV**. Even though the hostname list is not really in CSV format, it will work with no issues. +1. Add a name for the list, specify "Hostnames" as the list type, and give it a description. +1. Drag and drop your MCAS output file created via the API call, or you can click **Select a file**. +1. Click **Create**. You will see the list of hostnames that have been added to the list. +1. Save the list. + +Your list is now ready to be referenced by Gateway HTTP policies. + +![List of hostnames](../static/secure-web-gateway/microsoft-mcas/mcas-list.png) + +## Creating an HTTP policy + +1. Navigate to **Gateway** > **Policies** > **HTTP policies**. +1. Click **Create a policy**. + + ![List of hostnames](../static/secure-web-gateway/microsoft-mcas/mcas-policy.png) + +1. Set the expression to: + * Selector: `Host` + * Operator: `In List` + * Value: your newly created list name. +1. Set the Action to `Block`. + +Now when trying to visit one of the MCAS defined sites, the user will be blocked. + +![List of hostnames](../static/secure-web-gateway/microsoft-mcas/mcas-block-page.png) \ No newline at end of file