diff --git a/package.json b/package.json index 3539da44..88ea5f6b 100644 --- a/package.json +++ b/package.json @@ -45,7 +45,7 @@ "lodash": "^4.17.21", "mdast-util-to-string": "^3.2.0", "mdx-annotations": "^0.1.1", - "next": "13.4.1", + "next": "^13.4.1", "openapi-types": "^12.1.0", "postcss-focus-visible": "^8.0.2", "react": "18.2.0", diff --git a/src/pages/how-to/manage-posture-checks.mdx b/src/pages/how-to/manage-posture-checks.mdx index 68fe00d3..011c3500 100644 --- a/src/pages/how-to/manage-posture-checks.mdx +++ b/src/pages/how-to/manage-posture-checks.mdx @@ -1,41 +1,49 @@ # Manage access with posture checks -NetBird allows administrators to effectively manage network access through the creation of access policies. -These policies specify which peer groups are allowed to interact with one another, based on port, protocol and network traffic direction. +NetBird helps administrators control who can access their network by creating policies. These policies decide which groups of peers are allowed to interact with one another, based on criteria like port, protocol and traffic direction. -Posture checks augment access policies by enabling administrators to enforce additional access restrictions based on predefined criteria -like operating system version, geolocation, NetBird client version, and more. By integrating posture checks seamlessly -into policy-based ACLs, NetBird evaluates various machine attributes to determine the eligibility of peers to -connect to the network. +Administrators can further refine access control through posture checks to enhance their existing policies. For example, they can verify whether a peer is using a specified version of NetBird, has the necessary version of the operating system, and is located within a permitted geolocation before allowing it to join the network. + +By adding these posture checks to the policies, NetBird makes sure only devices that meet certain security requirements can access the network. This helps keep the network safe and follows the Zero Trust approach, which means not trusting any device by default. -This seamless integration of posture checks into policy-based Access Control Lists (ACLs) ensures that only machines -complying with the defined security posture criteria can access network resources, enhancing overall network security and aligning -with the Zero Trust principles. ## Concepts -There is a number of posture checks that you can choose to enforce network access restrictions. -NetBird currently supports the following posture checks: NetBird client version check, operating system version check, and geolocation check. + +While we plan to expand the range of posture checks, these are the checks currently available for you to enforce: + +- NetBird Client Version Check +- Country & Region Check +- Operating System Check +

high-level-dia

-### NetBird client version check +### NetBird Client Version Check -The NetBird client version check verifies the version of the NetBird software installed on the device attempting to connect to the -network. This check ensures that only devices running a specified version of NetBird can gain access, -thus preventing outdated or incompatible clients from compromising network security. +The NetBird client version check ensures that only devices with the specified version of NetBird installed can connect to the network, preventing security risks from outdated or incompatible versions. -### Operating system version check +### Geolocation (Country & Region) Check + +The geolocation check examines the connecting device's geographical location based on its IP address. +This check allows administrators to either block or allow access from certain geographic regions, +offering country-wide and city-level granularity. + + + When you allow access from specific locations in the network settings, all other locations are automatically blocked. Conversely, blocking certain locations means only those are blocked, while access remains open for all other locations. + + +### Operating System Check The operating system version check evaluates the operating system (OS) version running on the connecting device. This check allows for enforcing minimum OS requirements, ensuring that only devices with up-to-date and secure operating systems can access network resources. - This check requires NetBird version [0.26.0](https://github.com/netbirdio/netbird/releases) or newer. + The Operating System Check requires NetBird version [0.26.0](https://github.com/netbirdio/netbird/releases) or newer. The check evaluates the actual `OS version` for Android, macOS, and iOS, while for Linux and Windows, it assesses the `kernel version`. @@ -51,16 +59,11 @@ Below are some examples of OS versions for each operating system: * Windows 11, version 23H2: `10.0.22631` * Windows Server 2022, Version 21H2: `10.0.20348` -### Geolocation check - -The geolocation check examines the connecting device's geographical location based on its IP address. -This check allows administrators to enforce access restrictions based on geographic regions, -offering country-wide and city-level granularity. ## Managing posture checks Posture checks are dynamic, and you can create a policy with multiple posture checks. A single posture -check can also be reused across different policies. When managing posture checks, you can update them as +check can also be applied across multiple policies. When managing posture checks, you can update them as per your requirements. Deleting a posture check is only possible if it's not currently used in any policy. If a posture check is in use, @@ -79,13 +82,14 @@ Access the `Access Control` tab, then the `Posture Checks` section, and click `C high-level-dia

-That will open a posture checks configuration screen where you can configure the checks. + +This will bring up a screen for configuring posture checks, where you can do your configurations.

high-level-dia

-Select the `NetBird Client Version` check option and set it with the following information: +Select the `NetBird Client Version` check option and Type in the desired NetBird version; for this example, we are using : - Version: `0.25.0`