Custom s3 URL Destination

[backcountryinfosec]

I wanted to throw this in discussions as I don't think it's an issue but doesn't look like it's fully implemented. We use a custom s3 bucket hosted on-prem (minio https://min.io/) for some uploads on other forensic collectors. It would be great if I could also point KAPE to the custom s3 bucket URL. I think this might be partially supported based on documentation in the following articles that the KAPE documentation pointed to:
https://cdn.nsoftware.com/help/IUF/cs/S3ClientConfig.htm#URL
https://cdn.nsoftware.com/help/IUF/cs/S3Client_p_ServiceProvider.htm -> "spCustom"

If there is already a way to do this please let me know, I didn't see it after scanning through some of the S3 specific documentation.

[EricZimmerman]

I already support about eight different S3 providers but I haven't looked at that one you're talking about

[EricZimmerman]

You'd have to get me a pre-signed URL to try to work with or otherwise to see if we can't figure it out

[backcountryinfosec]

In that case it might be more trouble than what it's worth for a small custom one off if it would need more than just a custom URL field. I'm guessing the default spAmazonS3 option builds the url on the back based on options the user selects. That's all I would need to override.

For example, in another forensic tool the s3 configuration is the same for AWS as it is our minio endpoint hosted in house. The only thing that we change is the host URL. The custom s3 minio instance still uses the underlying AWS s3 protocol and fields (bucket, access key, region). The standard AWS S3 command line works for it too which lead me to believe that with a custom host field in KAPE I could use the already built in spAmazonS3 provider.

Currently I'm just using a small golang program using the default go AWS SDK to set the fields and upload the KAPE output:

• region
• bucket
• key prefix
• access key
• secret

[backcountryinfosec]

Now writing that out I could probably just try the "AWS S3 Presigned URL" with our custom S3 endpoint presigned url too.

[EricZimmerman]

I just don't want to guess is all. Send me those details and a custom endpoint url and I'll see what I can do to make it work. Without a test case I'd just be guessing tho.

[EricZimmerman]

This approach would work because I'm not using the AWS SDK with pre-signed urls so it would just do a put request to whatever you are all you give it

…

On Thu, Jun 24, 2021, 1:41 PM Nate ***@***.***> wrote: Now writing that out I could probably just try the "AWS S3 Presigned URL" with our custom S3 endpoint presigned url too. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#507 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABARKJTSRN5BY3WSW3Y3HO3TUNU3XANCNFSM47IJX3VA> .

[backcountryinfosec]

Yep that pre-signed URL worked. Thanks!