You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/user/intelmq-api.rst
+21-20Lines changed: 21 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,8 +25,8 @@ No additional set-up steps are needed if you use these packages.
25
25
26
26
The `intelmq-api` provides the route ``/v1/api`` for managing the IntelMQ installation.
27
27
28
-
For development purposes and testing you can also run `intelmq-api` using development script
29
-
from its `repository <https://github.com/certtools/intelmq-api>`_:
28
+
For development purposes and testing, you can also run `intelmq-api` using development script
29
+
from this `repository <https://github.com/certtools/intelmq-api>`_:
30
30
31
31
.. code-block:: bash
32
32
@@ -41,17 +41,17 @@ Installation using pip
41
41
.. note::
42
42
43
43
Native system packages (DEB, RPM) should automatically prepare steps described in this section. If
44
-
you wish to base on package from pip, you may need need to do them manually, as described below.
44
+
you wish to base on package from pip, you may need to do them manually, as described below.
45
45
46
46
To configure your system to serve the API for not-development purposes, you need to prepare a
47
47
configuration for IntelMQ API, a position config for the IntelMQ Manager as well as a web application
48
48
server and a (reverse)proxy. For all those steps we have prepared example configuration, intended
49
49
to work with `Gunicorn <https://gunicorn.org/>`_ as the web server and `Apache 2 <https://httpd.apache.org/>`_
50
50
as the proxy.
51
51
52
-
The `intelmq-api` packages ship following example files:
52
+
The `intelmq-api` package ships the following example files:
53
53
- ``${PREFIX}/etc/intelmq/api-config.json`` - the API configuration,
54
-
- ``${PREFIX}/etc/intelmq/manager/positions.conf`` - a positions configuration for the manager,
54
+
- ``${PREFIX}/etc/intelmq/manager/positions.conf`` - positions configuration for the manager,
55
55
- ``${PREFIX}/etc/intelmq/api-apache.conf`` - a virtualhost configuration file for Apache 2,
56
56
- ``${PREFIX}/etc/intelmq/api-sudoers.conf`` - a sudoers configuration file,
57
57
- ``${PREFIX}/etc/intelmq/intelmq-api.service`` - a systemd service unit configuration for Gunicorn,
@@ -76,24 +76,25 @@ The file ``${PREFIX}/etc/intelmq/api-apache.conf`` needs to be placed in the cor
76
76
- On Debian and Ubuntu, move the file to ``/etc/apache2/conf-available.d/api-apache.conf`` and then execute ``a2enconf api-apache``.
77
77
- On CentOS, RHEL and Fedora, move the file to ``/etc/httpd/conf.d/``.
78
78
- On openSUSE, move the file to ``/etc/apache2/conf.d/``.
79
+
79
80
Don't forget to reload the Apache2 afterwards.
80
81
81
82
The systemd configuration files (``intelmq-api.service`` and ``intelmq-api.socket``) are responsible
82
83
for instructing systemd daemon to start and keep running Gunicorn (that serves the API), and
83
84
forwarding requests between proxy and the Gunicorn instance.
84
85
85
86
- Files ``${PREFIX}/etc/intelmq/intelmq-api.service`` and ``${PREFIX}/etc/intelmq/intelmq-api.socket``
86
-
should be placed in ``/lib/systemd/system/`` directory. Then adapt the webserver user name in
87
+
should be placed in ``/lib/systemd/system/`` directory. Then adapt the webserver username in
87
88
``intelmq-api.service``.
88
89
89
90
After moving files, you can enable the service by executing ``systemctl enable intelmq-api`` to
90
91
start it on the system startup.
91
92
92
93
- The file ``${PREFIX}/etc/intelmq/api-config.json`` needs to be moved to ``/etc/intelmq/api-config.json``.
93
94
- The file ``${PREFIX}/etc/intelmq/manager/positions.conf`` needs to be moved to ``/etc/intelmq/manager/positions.conf``.
94
-
- Last but not least move the file ``${PREFIX}/etc/intelmq/api-sudoers.conf`` to ``/etc/sudoers.d/01_intelmq-api`` and adapt the webserver user name in this file. Set the file permissions to ``0o440``.
95
+
- Last but not least move the file ``${PREFIX}/etc/intelmq/api-sudoers.conf`` to ``/etc/sudoers.d/01_intelmq-api`` and adapt the webserver username in this file. Set the file permissions to ``0o440``.
95
96
96
-
Afterwards continue with the section Permissions below. When you finish the configuration,
97
+
Afterwards, continue with the section Permissions below. When you finish the configuration,
97
98
you can start the service using ``systemctl start intelmq-api``. You may need to restart the service
98
99
after any configuration change.
99
100
@@ -104,13 +105,13 @@ after any configuration change.
104
105
105
106
IntelMQ 2.3.1 comes with a tool ``intelmqsetup`` which performs these set-up steps automatically.
106
107
Please note that the tool is very new and may not detect all situations correctly. Please report us any bugs you are observing.
107
-
The tools is idempotent, you can execute it multiple times.
108
+
The tool is idempotent, you can execute it multiple times.
108
109
109
110
***********************
110
111
Configuring intelmq-api
111
112
***********************
112
113
113
-
Depending on your setup you might have to install ``sudo`` to make it possible for the ``intelmq-api`` to run the ``intelmq`` command as the user-account usually used to run ``intelmq`` (which is also often called ``intelmq``).
114
+
Depending on your setup, you might have to install ``sudo`` to make it possible for the ``intelmq-api`` to run the ``intelmq`` command as the user-account usually used to run ``intelmq`` (which is also often called ``intelmq``).
114
115
115
116
``intelmq-api`` is configured using a configuration file in ``json`` format.
116
117
``intelmq-api`` tries to load the configuration file from ``/etc/intelmq/api-config.json`` and ``${PREFIX}/etc/intelmq/api-config.json``, but you can override the path setting the environment variable ``INTELMQ_API_CONFIG``.
@@ -136,7 +137,7 @@ The default configuration which is shipped with the packages is also listed here
136
137
}
137
138
138
139
139
-
On Debian based systems, the default path for the ``session_store`` is ``/var/lib/dbconfig-common/sqlite3/intelmq-api/intelmqapi``, because the Debian package uses the Debian packaging tools to manage the database file.
140
+
On Debian based systems, the default path for the ``session_store`` is ``/var/lib/dbconfig-common/sqlite3/intelmq-api/intelmqapi`` because the Debian package uses the Debian packaging tools to manage the database file.
140
141
141
142
The following configuration options are available:
142
143
@@ -145,14 +146,14 @@ The following configuration options are available:
145
146
This means that if the command you want to use needs parameters, they have to be separate strings.
146
147
* ``allowed_path``: intelmq-api can grant **read-only** access to specific files - this setting defines the path those files can reside in.
147
148
* ``session_store``: this is an optional path to a sqlite database, which is used for session storage and authentication. If it is not set (which is the default), no authentication is used!
148
-
* ``session_duration``: the maximal duration of a session, its 86400 seconds by default
149
+
* ``session_duration``: the maximal duration of a session, it's 86400 seconds by default
149
150
* ``allow_origins``: a list of origins the responses of the API can be shared with. Allows every origin by default.
150
151
151
152
Permissions
152
153
^^^^^^^^^^^
153
154
154
155
``intelmq-api`` tries to write a couple of configuration files in the ``${PREFIX}/etc/intelmq`` directory - this is only possible if you set the permissions accordingly, given that ``intelmq-api`` runs under a different user.
155
-
The user the API run as also needs write access to the folder the ``session_store`` is located in, otherwise there will be an error accessing the session data.
156
+
The user the API run as also needs write access to the folder the ``session_store`` is located in; otherwise there will be an error accessing the session data.
156
157
If you're using the default Apache 2 setup, you might want to set the group of the files to ``www-data`` and give it write permissions (``chmod -R g+w <directoryname>``).
157
158
In addition to that, the ``intelmq-manager`` tries to store the bot positions via the API into the file ``${PREFIX}/etc/intelmq/manager/positions.conf``.
158
159
You should therefore create the folder ``${PREFIX}/etc/intelmq/manager`` and the file ``positions.conf`` in it.
@@ -191,7 +192,7 @@ To do so, first send a POST-Request with JSON-formatted data to http://localhost
191
192
192
193
{
193
194
"username": "$your_username",
194
-
"password: "$your_password"
195
+
"password": "$your_password"
195
196
}
196
197
197
198
With valid credentials, the JSON-formatted response contains the ``login_token``.
If you see the IntelMQ Manager interface and menu, but the API calls to the back-end querying configuration and status of IntelMQ fail with "Access Denied" or "Authentication Required: Please provide valid Token verification credentials" errors, you are maybe not logged in while the API requires authentication.
243
244
244
-
By default, the API requires authentication. Create user accounts and login with them or - if you have other protection means in place - deactivate the authentication requirement by removing or renaming the `session_store` parameter in the configuration.
245
+
By default, the API requires authentication. Create user accounts and login with them, or - if you have other protection means in place - deactivate the authentication requirement by removing or renaming the `session_store` parameter in the configuration.
245
246
246
247
Internal Server Error
247
248
^^^^^^^^^^^^^^^^^^^^^
248
249
249
-
There can be various reasons for internal server errors. You need to look at the error log of your web server, for example ``/var/log/apache2/error.log`` or ``/var/log/httpd/error_log`` for Apache 2. It could be that the sudo-setup is not functional, the configuration file or session database file can not be read or written or other errors in regards to the execution of the API program.
250
+
There can be various reasons for internal server errors. You need to look at the error log of your web server, for example ``/var/log/apache2/error.log`` or ``/var/log/httpd/error_log`` for Apache 2. It could be that the sudo-setup is not functional, the configuration file or session database file can not be read or written or other errors in regard to the execution of the API program.
250
251
251
252
Can I just install it from the deb/rpm packages while installing IntelMQ from a different source?
@@ -255,17 +256,17 @@ Yes, you can install the API and the Manager from the deb/rpm repositories, and
255
256
However, knowledge about Python and system administration experience is recommended if you do so.
256
257
257
258
The packages install IntelMQ to ``/usr/lib/python3*/site-packages/intelmq/``.
258
-
Installing with ``pip`` results in ``/usr/local/lib/python3*/site-packages/intelmq/`` (and some other accompaning resources) which overrides the installation in ``/usr/lib/``.
259
+
Installing with ``pip`` results in ``/usr/local/lib/python3*/site-packages/intelmq/`` (and some other accompanying resources) which overrides the installation in ``/usr/lib/``.
259
260
You probably need to adapt the configuration parameter ``intelmq_ctl_cmd`` to the ``/usr/local/bin/intelmqctl`` executable and some other tweaks.
260
261
261
262
sqlite3.OperationalError: attempt to write a readonly database
SQLite does not only need write access to the database itself, but also the folder the database file is located in. Please check that the webserver has write permissions to the folder
265
+
SQLite does not only need write access to the database itself, but also the folder the database file is located in. Please check that the webserver has `write` permissions to the folder
265
266
the session file is located in.
266
267
267
-
Can I use other web server or proxy?
268
-
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
268
+
Can I use other web servers or proxy?
269
+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
269
270
270
271
Yes, the proposed setup with Gunicorn and Apache 2 is just one of many possibilities. You can
271
272
refer to the `FastAPI documentation <https://fastapi.tiangolo.com/deployment/>`_ for another
0 commit comments