Skip to content

Commit

Permalink
reworked posture check docs (#154)
Browse files Browse the repository at this point in the history
  • Loading branch information
juliaroesschen authored Feb 27, 2024
1 parent 7b1b68f commit 3785524
Show file tree
Hide file tree
Showing 2 changed files with 30 additions and 26 deletions.
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@
"lodash": "^4.17.21",
"mdast-util-to-string": "^3.2.0",
"mdx-annotations": "^0.1.1",
"next": "13.4.1",
"next": "^13.4.1",
"openapi-types": "^12.1.0",
"postcss-focus-visible": "^8.0.2",
"react": "18.2.0",
Expand Down
54 changes: 29 additions & 25 deletions src/pages/how-to/manage-posture-checks.mdx
Original file line number Diff line number Diff line change
@@ -1,41 +1,49 @@
# Manage access with posture checks


NetBird allows administrators to effectively manage network access through the creation of access policies.
These policies specify which peer groups are allowed to interact with one another, based on port, protocol and network traffic direction.
NetBird helps administrators control who can access their network by creating policies. These policies decide which groups of peers are allowed to interact with one another, based on criteria like port, protocol and traffic direction.

Posture checks augment access policies by enabling administrators to enforce additional access restrictions based on predefined criteria
like operating system version, geolocation, NetBird client version, and more. By integrating posture checks seamlessly
into policy-based ACLs, NetBird evaluates various machine attributes to determine the eligibility of peers to
connect to the network.
Administrators can further refine access control through posture checks to enhance their existing policies. For example, they can verify whether a peer is using a specified version of NetBird, has the necessary version of the operating system, and is located within a permitted geolocation before allowing it to join the network.

By adding these posture checks to the policies, NetBird makes sure only devices that meet certain security requirements can access the network. This helps keep the network safe and follows the Zero Trust approach, which means not trusting any device by default.

This seamless integration of posture checks into policy-based Access Control Lists (ACLs) ensures that only machines
complying with the defined security posture criteria can access network resources, enhancing overall network security and aligning
with the Zero Trust principles.

## Concepts

There is a number of posture checks that you can choose to enforce network access restrictions.
NetBird currently supports the following posture checks: NetBird client version check, operating system version check, and geolocation check.

While we plan to expand the range of posture checks, these are the checks currently available for you to enforce:

- NetBird Client Version Check
- Country & Region Check
- Operating System Check


<p>
<img src="/docs-static/img/how-to-guides/supported-posture-checks-list.png" alt="high-level-dia" className="imagewrapper"/>
</p>

### NetBird client version check
### NetBird Client Version Check

The NetBird client version check verifies the version of the NetBird software installed on the device attempting to connect to the
network. This check ensures that only devices running a specified version of NetBird can gain access,
thus preventing outdated or incompatible clients from compromising network security.
The NetBird client version check ensures that only devices with the specified version of NetBird installed can connect to the network, preventing security risks from outdated or incompatible versions.

### Operating system version check
### Geolocation (Country & Region) Check

The geolocation check examines the connecting device's geographical location based on its IP address.
This check allows administrators to either block or allow access from certain geographic regions,
offering country-wide and city-level granularity.

<Note>
When you allow access from specific locations in the network settings, all other locations are automatically blocked. Conversely, blocking certain locations means only those are blocked, while access remains open for all other locations.
</Note>

### Operating System Check

The operating system version check evaluates the operating system (OS) version running on the connecting device.
This check allows for enforcing minimum OS requirements, ensuring that only devices with up-to-date and
secure operating systems can access network resources.

<Note>
This check requires NetBird version [0.26.0](https://github.com/netbirdio/netbird/releases) or newer.
The Operating System Check requires NetBird version [0.26.0](https://github.com/netbirdio/netbird/releases) or newer.
</Note>

The check evaluates the actual `OS version` for Android, macOS, and iOS, while for Linux and Windows, it assesses the `kernel version`.
Expand All @@ -51,16 +59,11 @@ Below are some examples of OS versions for each operating system:
* Windows 11, version 23H2: `10.0.22631`
* Windows Server 2022, Version 21H2: `10.0.20348`

### Geolocation check

The geolocation check examines the connecting device's geographical location based on its IP address.
This check allows administrators to enforce access restrictions based on geographic regions,
offering country-wide and city-level granularity.

## Managing posture checks

Posture checks are dynamic, and you can create a policy with multiple posture checks. A single posture
check can also be reused across different policies. When managing posture checks, you can update them as
check can also be applied across multiple policies. When managing posture checks, you can update them as
per your requirements.

Deleting a posture check is only possible if it's not currently used in any policy. If a posture check is in use,
Expand All @@ -79,13 +82,14 @@ Access the `Access Control` tab, then the `Posture Checks` section, and click `C
<img src="/docs-static/img/how-to-guides/add-posture-check.png" alt="high-level-dia" className="imagewrapper"/>
</p>

That will open a posture checks configuration screen where you can configure the checks.

This will bring up a screen for configuring posture checks, where you can do your configurations.

<p>
<img src="/docs-static/img/how-to-guides/posture-check-create-list.png" alt="high-level-dia" className="imagewrapper"/>
</p>

Select the `NetBird Client Version` check option and set it with the following information:
Select the `NetBird Client Version` check option and Type in the desired NetBird version; for this example, we are using :
- Version: `0.25.0`

<p>
Expand Down

0 comments on commit 3785524

Please sign in to comment.