IntelOwl behind restrictive proxy.

[mboaisha]

NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

Linux redacted 3.10.0-1160.el7.x86_64 #1 SMP Mon Oct 19 16:18:59 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

Docker: Docker version 19.03.13, build 4484c46d9d
Docker Compose: docker-compose version 1.27.4, build 40524192

So far IntelOwl is working well, looks like I am able to use "local" analyzers i.e. yara scans but not the ones requiring external API calls i.e. Pulsedive and AbuseIPDB.

I think it's something that has to do with the containers not having the proxy settings. Here is IntelOwl failing to get results from AbuseIPDB:

HTTPSConnectionPool(host='api.abuseipdb.com', port=443): Max retries exceeded with url: /api/v2/check?ipAddress=70.32.0.65&maxAgeInDays=180&verbose=True (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f64581e52d0>: Failed to establish a new connection: [Errno 101] Network is unreachable'))

Is there a way I could get the containers to "talk" with the proxy? Not sure how to edit the docker-compose.yml file to "save" the proxy settings.

[mlodic]

Hey @mboaisha, this issue is not related to IntelOwl but to your infrastructure. I should close this.

However check this docs and let me know: https://docs.docker.com/network/proxy/#configure-the-docker-client

[mboaisha]

I reconfigured Docker's proxy settings and now I get SSL errors.... I added the proxy's certificate to the host machine's store and it still would not work....

edit: Here is an example from an AbuseIPDB API call: HTTPSConnectionPool(host='api.abuseipdb.com', port=443): Max retries exceeded with url: /api/v2/check?ipAddress=164.52.24.162&maxAgeInDays=180&verbose=True (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1091)')))

Also started getting this error.

Not sure where to proceed from here.

[mlodic]

The message you found is related to an open issue intelowlproject/IntelOwl-ng#61, nothing to worry about. The application still works correctly.

Check this to resolve the SSL certificate issue: https://stackoverflow.com/questions/20267339/docker-behind-proxy-that-changes-ssl-certificate.

As said before this is not related to IntelOwl issue so I am closing this.