light wrapper around Go's argon2 package that closely mirrors with Go's standard library Bcrypt and simple-scrypt package.

# argon2-hashing
[![GoDoc](https://godoc.org/github.com/andskur/argon22-hashing?status.svg)](https://pkg.go.dev/github.com/andskur/argon2-hashing?tab=doc)
[![Build Status](https://travis-ci.org/andskur/argon2-hashing.svg?branch=master)](https://travis-ci.org/andskur/argon2-hashing)
[![Go Report Card](https://goreportcard.com/badge/github.com/andskur/argon2-hashing)](https://goreportcard.com/report/github.com/andskur/argon2-hashing)
[![codecov](https://codecov.io/gh/andskur/argon2-hashing/branch/master/graph/badge.svg)](https://codecov.io/gh/andskur/argon2-hashing)

**argon2-hashing** provides a light wrapper around Go's [argon2](https://godoc.org/golang.org/x/crypto/argon2) package.
Argon2 was the winner of the [Password Hashing](https://password-hashing.net) Competition that makes it easier to securely derive strong keys from weak
inputs (i.e. user passwords).

With this library you can:
* Generate a argon2 derived key with a crytographically secure salt and default parameters.
* Tune argon2 with you own parameters based of you hardware configuration.
* Compare a derived key with the possible cleartext equivalent (user password).

Currently supported only Argon2id function.

The API closely mirrors with Go's [Bcrypt library](https://godoc.org/golang.org/x/crypto/bcrypt)
and Alex Edwards [simple-scrypt package](https://github.com/elithrar/simple-scrypt).

## Installation

With a [Go modules](https://golang.org/doc/code.html):

```sh
go get -u github.com/andskur/argon2-hashing
```

## Example

argon2-hashing doesn't try to re-invent the wheel or do anything "special". It
wraps the `argon2.IDKey` function as thinly as possible, generates a
crytographically secure salt for you using Go's `crypto/rand` package, and
returns the derived key with the parameters prepended:

```go
package main

import(
    "fmt"
    "log"

    "github.com/andskur/argon2-hashing"
)

func main() {
    // e.g. r.PostFormValue("password")
    passwordFromForm := "qwerty123"

    // Generates a derived key with default params
    hash, err := argon2.GenerateFromPassword([]byte(passwordFromForm), argon2.DefaultParams)
    if err != nil {
        log.Fatal(err)
    }

    // Print the derived key.
    fmt.Printf("%s\n", hash)

    // Uses the parameters from the existing derived key. Return an error if they don't match.
    err = argon2.CompareHashAndPassword(hash, []byte(passwordFromForm))
    if err != nil {
        log.Fatal(err)
    }
}
```

## Argon2 introduction
The [Argon2 algorithm](https://tools.ietf.org/html/draft-irtf-cfrg-argon2-04) accepts a number of configurable parameters:

* Memory — The amount of memory used by the algorithm (in [kibibytes](https://en.wikipedia.org/wiki/Kibibyte)).
* Iterations — The number of iterations (or passes) over the memory.
* Parallelism — The number of threads (or lanes) used by the algorithm.
* Salt length — Length of the random salt. [16 bytes is recommended](https://tools.ietf.org/html/draft-irtf-cfrg-argon2-04#section-3.1) for password hashing.
* Key length — Length of the generated key (or password hash). 16 bytes or more is recommended.
* The memory and iterations parameters control the computational cost of hashing the password. The higher these figures are, the greater the cost of generating the hash. It also follows that the greater the cost will be for any attacker trying to guess the password.

But there's a balance that you need to strike. As you increase the cost, the time taken to generate the hash also increases. If you're generating the hash in response to a user action (like signing up or logging in to a website) then you probably want to keep the runtime to less than 500ms to avoid a negative user experience.

If the Argon2 algorithm is running on a machine with multiple cores, then one way to decrease the runtime without reducing the cost is to increase the parallelism parameter. This controls the number of threads that the work is spread across. There's an important thing to note here though: changing the value of the parallelism parameter changes the output of the algorithm. So — for example — running Argon2 with a parallelism parameter of 2 will result in a different password hash to running it with a parallelism parameter of 4.

### Choosing Parameters
Picking the right parameters for Argon2 depends heavily on the machine that the algorithm is running on, and you'll probably need to do some experimentation in order to set them appropriately.

The [recommended process](https://tools.ietf.org/html/draft-irtf-cfrg-argon2-04#section-4) for choosing the parameters can be paraphrased as follows:

1. Set the parallelism and memory parameters to the largest amount you are willing to afford, bearing in mind that you probably don't want to max these out completely unless your machine is dedicated to password hashing.
2. Increase the number of iterations until you reach your maximum runtime limit (for example, 500ms).
3. If you're already exceeding the your maximum runtime limit with the number of iterations = 1, then you should reduce the memory parameter.

## Thanks to
* [Alex Edwards](https://github.com/alexedwards) - For an excellent [article](https://www.alexedwards.net/blog/how-to-hash-and-verify-passwords-with-argon2-in-go), after which I was inspired to develop this package.
* [Matt Silverlock](https://github.com/elithrar) - For an great and well documented [simple-scrypt](https://github.com/elithrar/simple-scrypt) package which I took for the structural basis.

## Authors

* **Andrey Skurlatov** - [andskur](https://github.com/andskur)

## License

This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details

argon2-hashing

Enterprise-ready, modsecurity and OWASP CRS compatible WAF library.

<h1>
  <img src="https://coraza.io/images/logo_shield_only.png" align="left" height="46px" alt=""/>&nbsp;
  <span>Coraza - Web Application Firewall</span>
</h1>

[![Regression Tests](https://github.com/corazawaf/coraza/actions/workflows/regression.yml/badge.svg)](https://github.com/corazawaf/coraza/actions/workflows/regression.yml)
[![Coreruleset Compatibility](https://img.shields.io/badge/Coreruleset%20Compatibility-100%25-brightgreen)](#)
[![CodeQL](https://github.com/corazawaf/coraza/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/corazawaf/coraza/actions/workflows/codeql-analysis.yml)
[![codecov](https://codecov.io/gh/corazawaf/coraza/branch/main/graph/badge.svg?token=6570804ZC7)](https://codecov.io/gh/corazawaf/coraza)
[![Project Status: Active – The project has reached a stable, usable state and is being actively developed.](https://www.repostatus.org/badges/latest/active.svg)](https://www.repostatus.org/#active)
[![OWASP Production Project](https://img.shields.io/badge/owasp-production%20project-brightgreen)](https://owasp.org/www-project-coraza-web-application-firewall)
[![GoDoc](https://godoc.org/github.com/corazawaf/coraza?status.svg)](https://godoc.org/github.com/corazawaf/coraza/v3)

Coraza is an open source, enterprise-grade, high performance Web Application Firewall (WAF) ready to protect your beloved applications. It is written in Go, supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set v4.

* Website: <https://coraza.io>
* Forum: [Github Discussions](https://github.com/corazawaf/coraza/discussions)
* OWASP Slack Community (#coraza): <https://owasp.org/slack/invite>
* Rule testing: [Coraza Playground](https://playground.coraza.io)

<br/>

Key Features:

* ⇲ **Drop-in** - Coraza is an alternative engine that has partial compatibility with ~~Trustwave~~[OWASP ModSecurity Engine](https://github.com/owasp-modsecurity/modsecurity/) and supports industry-standard SecLang rule sets.

* 🔥 **Security** -  Coraza runs the [OWASP CRS](https://coreruleset.org) **v4** (Formerly known as Core Rule Set) to protect your web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. CRS protects from many common attack categories including: SQL Injection (SQLi), Cross Site Scripting (XSS), PHP & Java Code Injection, HTTPoxy, Shellshock, Scripting/Scanner/Bot Detection & Metadata & Error Leakages. Note that older versions of the CRS are not compatible.

* 🔌 **Extensible** - Coraza is a library at its core, with many integrations to deploy on-premise Web Application Firewall instances. Audit Loggers, persistence engines, operators, actions, create your own functionalities to extend Coraza as much as you want.

* 🚀 **Performance** - From huge websites to small blogs, Coraza can handle the load with minimal performance impact. Check our [Benchmarks](https://coraza.io/docs/reference/benchmarks)

* ﹡ **Simplicity** - Anyone is able to understand and modify the Coraza source code. It is easy to extend Coraza with new functionality.

* 💬 **Community** - Coraza is a community project, contributions are accepted and all ideas will be considered. Find contributor guidance in the [CONTRIBUTION](https://github.com/corazawaf/coraza/blob/main/CONTRIBUTING.md) document.

<br/>

## Integrations

The Coraza Project maintains implementations and plugins for the following servers:

* [Caddy Reverse Proxy and Webserver Plugin](https://github.com/corazawaf/coraza-caddy) - stable, needs a maintainer
* [Proxy WASM extension](https://github.com/corazawaf/coraza-proxy-wasm) for proxies with proxy-wasm support (e.g. Envoy) - stable, still under development
* [HAProxy SPOE Plugin](https://github.com/corazawaf/coraza-spoa) - experimental
* [Coraza C Library (For nginx, etc)](https://github.com/corazawaf/libcoraza) - experimental

## Prerequisites

* Go v1.22+ or tinygo compiler
* Linux distribution (Debian or Centos recommended), Windows or Mac.

## Coraza Core Usage

Coraza can be used as a library for your Go program to implement a security middleware or integrate it with existing application & webservers.

```go
package main

import (
	"fmt"

	"github.com/corazawaf/coraza/v3"
)

func main() {
	// First we initialize our waf and our seclang parser
	waf, err := coraza.NewWAF(coraza.NewWAFConfig().
		WithDirectives(`SecRule REMOTE_ADDR "@rx .*" "id:1,phase:1,deny,status:403"`))
	// Now we parse our rules
	if err != nil {
		fmt.Println(err)
	}

	// Then we create a transaction and assign some variables
	tx := waf.NewTransaction()
	defer func() {
		tx.ProcessLogging()
		tx.Close()
	}()
	tx.ProcessConnection("127.0.0.1", 8080, "127.0.0.1", 12345)

	// Finally we process the request headers phase, which may return an interruption
	if it := tx.ProcessRequestHeaders(); it != nil {
		fmt.Printf("Transaction was interrupted with status %d\n", it.Status)
	}
}

```

[Examples/http-server](./examples/http-server/) provides an example to practice with Coraza.

### Build tags

Go build tags can tweak certain functionality at compile-time. These are for advanced use cases only and do not
have compatibility guarantees across minor versions - use with care.

* `coraza.disabled_operators.*` - excludes the specified operator from compilation. Particularly useful if overriding
the operator with `plugins.RegisterOperator` to reduce binary size / startup overhead.
* `coraza.rule.multiphase_valuation` - enables evaluation of rule variables in the phases that they are ready, not
only the phase the rule is defined for.
* `memoize_builders` - enables memoization of builders for regex and aho-corasick
dictionaries to reduce memory consumption in deployments that launch several coraza
instances. For more context check [this issue](https://github.com/corazawaf/coraza-caddy/issues/76)
* `no_fs_access` - indicates that the target environment has no access to FS in order to not leverage OS' filesystem related functionality e.g. file body buffers.
* `coraza.rule.case_sensitive_args_keys` - enables case-sensitive matching for ARGS keys, aligning Coraza behavior with RFC 3986 specification. It will be enabled by default in the next major version.

## E2E Testing

[`http/e2e/`](./http/e2e) provides an utility to run e2e tests.
It can be used standalone against your own waf deployment:

```shell
go run github.com/corazawaf/coraza/v3/http/e2e/cmd/httpe2e@main --proxy-hostport localhost:8080 --httpbin-hostport localhost:8081
```

or as a library by importing:

```go
"github.com/corazawaf/coraza/v3/http/e2e"
```

As a reference for library usage, see [`testing/e2e/e2e_test.go`](./testing/e2e/e2e_test.go).
Expected directives that have to be loaded and available flags can be found in [`http/e2e/cmd/httpe2e/main.go`](./http/e2e/cmd/httpe2e/main.go).

## Tools

* [Go FTW](https://github.com/coreruleset/go-ftw): Rule testing engine
* [Coraza Playground](https://playground.coraza.io/): Sandbox rule testing web interface
* [OWASP Core Ruleset](https://github.com/coreruleset/coreruleset/): Awesome rule set, compatible with Coraza

## Development

Coraza only requires Go for development. You can run `mage.go` to issue development commands.

See the list of commands

```
$ go run mage.go -l
Targets:
  check        runs lint and tests.
  coverage     runs tests with coverage and race detector enabled.
  doc          runs godoc, access at http://localhost:6060
  format       formats code in this repository.
  fuzz         runs fuzz tests
  lint         verifies code quality.
  precommit    installs a git hook to run check when committing
  test         runs all tests.
```

For example, to format your code before submission, run

```shell
go run mage.go format
```

## Contribute

Contributions are welcome! Please refer to [CONTRIBUTING.md](./CONTRIBUTING.md) for guidance.

## Security

To report a security issue, please follow [this link](https://github.com/corazawaf/coraza/security/advisories/new) and add a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue.

Our vulnerability management team will respond within 3 working days of your report. If the issue is confirmed as a vulnerability, we will open a Security Advisory. This project follows a 90 day disclosure timeline.

## Thanks

* OWASP Coreruleset team for the CRS and their help
* Ivan Ristić for creating ModSecurity

### Coraza on X/Twitter

* [@corazaio](https://twitter.com/corazaio)

## Donations

For donations, see [Donations site](https://owasp.org/donate/?reponame=www-project-coraza-web-application-firewall&title=OWASP+Coraza+Web+Application+Firewall)

## Thanks to all the people who have contributed

First and foremost, huge thanks to [Juan Pablo Tosso](https://twitter.com/jptosso) for starting this project, and building an amazing community around Coraza!

Today we have lots of amazing contributors, we could not have done this without you!

<a href="https://github.com/corazawaf/coraza/graphs/contributors">
  <img src="https://contrib.rocks/image?repo=corazawaf/coraza" />
</a>

Made with [contrib.rocks](https://contrib.rocks).


Coraza

A simple, semantic and developer-friendly golang package for encoding&decoding and encryption&decryption.

dongle

A rest application to dynamically update firewalld rules on a linux server.

firewalld-rest

# ssh-vault 🌰

[![Deploy](https://github.com/ssh-vault/ssh-vault/actions/workflows/deploy.yml/badge.svg)](https://github.com/ssh-vault/ssh-vault/actions/workflows/deploy.yml)
[![test](https://github.com/ssh-vault/ssh-vault/actions/workflows/test.yml/badge.svg)](https://github.com/ssh-vault/ssh-vault/actions/workflows/test.yml)
[![codecov](https://codecov.io/gh/ssh-vault/ssh-vault/graph/badge.svg?token=cWvIQCym2l)](https://codecov.io/gh/ssh-vault/ssh-vault)
[![crates.io](https://img.shields.io/crates/v/ssh-vault.svg)](https://crates.io/crates/ssh-vault)

encrypt/decrypt using ssh keys

### Documentation

https://ssh-vault.com

> The legacy SSH RSA keys with header `-----BEGIN RSA PRIVATE KEY-----` are not any more supported, convert your key to new format with:

    ssh-keygen -p -f <path/to/your/private.key>

### Usage

    $ ssh-vault -h


```txt
encrypt/decrypt using ssh keys

Usage: ssh-vault [COMMAND]

Commands:
  create       Create a new vault [aliases: c]
  edit         Edit an existing vault [aliases: e]
  fingerprint  Print the fingerprint of a public ssh key [aliases: f]
  view         View an existing vault [aliases: v]
  help         Print this message or the help of the given subcommand(s)

Options:
  -h, --help     Print help
  -V, --version  Print version

```

Examples:


Create a vault:


```sh
$ echo "secret" | ssh-vault create -u <github.com/user>
```

View a vault:

```sh
echo "SSH-VAULT..."| ssh-vault view
```

Share a secret:

```sh
$ echo "secret" | ssh-vault create -u new
```


## Installation

### Mac OS
    brew install ssh-vault

### Using Cargo

    $ cargo install ssh-vault

## Issues

Please feel free to raise any issue, feature requirement or a simple comment [here](https://github.com/ssh-vault/ssh-vault/issues).


ssh-vault

SSL certificates made easy with a high level wrapper around acme/autocert.

# Simple Secure Server

[![Go Report Card](https://goreportcard.com/badge/github.com/adrianosela/sslmgr)](https://goreportcard.com/report/github.com/adrianosela/sslmgr)
[![Documentation](https://godoc.org/github.com/adrianosela/sslmgr?status.svg)](https://godoc.org/github.com/adrianosela/sslmgr)
[![GitHub issues](https://img.shields.io/github/issues/adrianosela/sslmgr.svg)](https://github.com/adrianosela/sslmgr/issues)
[![license](https://img.shields.io/github/license/adrianosela/sslmgr.svg)](https://github.com/adrianosela/sslmgr/blob/master/LICENSE)
[![Mentioned in Awesome Go](https://awesome.re/mentioned-badge.svg)](https://github.com/avelino/awesome-go#security)

#### Prerequisites:

* Your server must be reachable through the provided domain name, this is how LetsEncrypt verifies domain ownership and grants your server a trusted certificate

#### With Default Values:

```
ss, err := sslmgr.NewSecureServer(handler, "yourhostname.com")
if err != nil {
	log.Fatal(err)
}
ss.ListenAndServe()
```

**Note:** This option uses the file system as the certificate cache. If your use case does not have a persistent file system, you should provide a value for CertCache in the [ServerConfig](https://godoc.org/github.com/adrianosela/sslmgr#ServerConfig) as shown below.


#### With Optional Values:

(Using the [certcache](https://godoc.org/github.com/adrianosela/certcache) library to define a cache)

```
ss, err := sslmgr.NewServer(sslmgr.ServerConfig{
	Hostnames: []string{os.Getenv("CN_FOR_CERTIFICATE")},
	HTTPPort:  ":80",
	HTTPSPort: ":443",
	Handler:   h,
	ServeSSLFunc: func() bool {
		return strings.ToLower(os.Getenv("PROD")) == "true"
	},
	CertCache: certcache.NewLayered(
		certcache.NewLogger(),
		autocert.DirCache("."),
	),
	ReadTimeout:         5 * time.Second,
	WriteTimeout:        5 * time.Second,
	IdleTimeout:         25 * time.Second,
	GracefulnessTimeout: 5 * time.Second,
	GracefulShutdownErrHandler: func(e error) {
		log.Fatal(e)
	},
})
if err != nil {
	log.Fatal(err)
}

ss.ListenAndServe()
```


sslmgr

teler-waf is a Go HTTP middleware that provide teler IDS functionality to protect against web-based attacks and improve the security of Go-based web applications. It is highly configurable and easy to integrate into existing Go applications.