Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Peer approval for remote worker access #241

Merged
merged 6 commits into from
Oct 11, 2024
Merged

Peer approval for remote worker access #241

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a5ef0c9
Add DB Workload Migration
damasosanoja Oct 1, 2024
acbb2c7
Add Peer Approval for Remote Worker Access to docs
damasosanoja Oct 1, 2024
4bb7a79
Merge branch 'main' into peer-approval-for-remote-worker-access
braginini Oct 11, 2024
ec1445d
Merge branch 'main' into peer-approval-for-remote-worker-access
braginini Oct 11, 2024
05c7b5e
Fix links
braginini Oct 11, 2024
f3c790d
Fix links
braginini Oct 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/components/NavigationDocs.jsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,10 @@ export const docsNavigation = [
title: 'Access from Kubernetes',
href: '/how-to/access-internal-resources-from-autoscaled-environments'
},
{
title: 'Peer Approval for Remote Access',
href: '/how-to/peer-approval-for-remote-worker-access'
},
]
},
{
Expand Down
6 changes: 3 additions & 3 deletions src/pages/how-to/access-internal-resources-from-autoscaled-environments.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ Let's dive into the process of using NetBird to manage network access in an auto
To replicate this use case, you'll need:

* A [NetBird account](https://app.netbird.io/)
* [NetBird](https://docs.netbird.io/how-to/installation) installed on your local machine
* [NetBird](/how-to/installation) installed on your local machine
* A Kubernetes cluster (local or cloud-based)
* `kubectl` installed and configured on your local machine
* [Kubernetes metrics server](https://github.com/kubernetes-sigs/metrics-server)
Expand All @@ -40,7 +40,7 @@ This process will demonstrate how NetBird simplifies secure network access in au

## 1. Creating a NetBird Setup Key for Kubernetes

The first step in this process is [creating a NetBird setup key](https://docs.netbird.io/how-to/register-machines-using-setup-keys) for your Kubernetes cluster. This setup key serves as a secure authentication token, allowing your cluster's pods to join your NetBird network seamlessly.
The first step in this process is [creating a NetBird setup key](/how-to/register-machines-using-setup-keys) for your Kubernetes cluster. This setup key serves as a secure authentication token, allowing your cluster's pods to join your NetBird network seamlessly.

To create an appropriate setup key for this use case:

Expand Down Expand Up @@ -113,7 +113,7 @@ Once you save your policy, it is a good practice to disable or modify the defaul

This tailored access policy ensures that only authorized devices (your local machine) can communicate with the Kubernetes cluster, significantly improving your network's security posture. As your environment scales, this policy will automatically apply to new pods, maintaining consistent access control.

For more detailed information on configuring access policies, refer to the [NetBird Access Policies documentation](https://docs.netbird.io/how-to/manage-network-access).
For more detailed information on configuring access policies, refer to the [NetBird Access Policies documentation](/how-to/manage-network-access).

## 4. Deploying a Sample Application with NetBird Agent

Expand Down
50 changes: 25 additions & 25 deletions src/pages/how-to/peer-approval-for-remote-worker-access.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,15 +16,15 @@ This guide introduces NetBird's Peer Approval as a robust solution for secure re
* **Enhancing Access Control**: Offering granular control over network resources, allowing organizations to tailor access based on user roles and device status.
* **Improving Scalability**: Facilitating easy onboarding and offboarding of remote workers, including freelancers, without compromising network security.

Let's explore the step-by-step process of implementing [Peer Approval with NetBird](https://docs.netbird.io/how-to/approve-peers) to ensure that only trusted devices can access your network.
Let's explore the step-by-step process of implementing [Peer Approval with NetBird](/how-to/approve-peers) to ensure that only trusted devices can access your network.

## Prerequisites

To replicate this use case, you'll need the following prerequisites:

* An main [NetBird account](https://app.netbird.io/) with administrative privileges.
* A secondary email address not linked to any NetBird account to simulate the freelancer's email.
* [NetBird installed](https://docs.netbird.io/how-to/installation) on the main device.
* [NetBird installed](/how-to/installation) on the main device.

With these prerequisites in place, you're ready to simulate granting network access to a temporary remote worker using NetBird's Peer Approval feature by:

Expand All @@ -37,75 +37,75 @@ With these prerequisites in place, you're ready to simulate granting network acc

## 1. Setting Up NetBird's Access Control Policies For Enhanced Security

Before onboarding remote workers, ensure your organization has appropriate [access control policies](https://docs.netbird.io/how-to/manage-network-access) in place. Adhering to zero-trust principles, create or modify policies to grant new users access only to necessary resources.
Before onboarding remote workers, ensure your organization has appropriate [access control policies](/how-to/manage-network-access) in place. Adhering to zero-trust principles, create or modify policies to grant new users access only to necessary resources.

Navigate to `Access Control > Policies` in the NetBird admin console, then click `Add Policy` or edit an existing one to define these restrictions. Here's a sample policy that grant any member of the `Freelancers` group access to the resources in the group `On-Premise-DB`.

![NetBird Freelancer Access Control Policy](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-0-01.png)
![NetBird Freelancer Access Control Policy](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-0-01.png)

If necessary, you can also set [posture checks](https://docs.netbird.io/how-to/manage-posture-checks) for this policy.
If necessary, you can also set [posture checks](/how-to/manage-posture-checks) for this policy.

![NetBird Freelancer Posture Check](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-0-02.png)
![NetBird Freelancer Posture Check](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-0-02.png)

Moreover, it is a best practice to disable the `Default` policy to enforce only restrictive, custom-defined access controls.

![NetBird Access Policy View](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-0-03.png)
![NetBird Access Policy View](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-0-03.png)

With appropriate access policies in place, you're ready to enable NetBird's Peer Approval feature.

## 2. Enabling Peer Approval

To enable peer approval, go to `Settings > Authentication` and activate the `Peer approval` toggle, then click `Save Changes`.

![NetBird Freelancer Device Dashboard](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-02.png)
![NetBird Freelancer Device Dashboard](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-02.png)

With `Peer Approval` activated, new members will see an `Approval required` message when joining. Administrators must grant access, ensuring only vetted users enter the NetBird network, thus enhancing overall security.

## 3. Inviting Users to Join Your Network

To invite a new user to join your NetBird network, go to `Team > Users` and click the `Invite User` button.

![NetBird Invite Users](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-03.png)
![NetBird Invite Users](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-03.png)

A pop-up window appears for new user registration. Enter the user's name, email address, and select the `Freelancers` group from the dropdown menu. NetBird's auto-assignment feature instantly links the new user to the `Freelancers` group upon network entry, automatically applying the associated access policy you just created.

![NetBird Invite User Pop Up](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-04.png)
![NetBird Invite User Pop Up](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-04.png)

After clicking `Send Invitation`, you'll return to the `Users` dashboard. Here, the new user appears with a `Pending` status, awaiting their acceptance of the invitation and any required approvals.

![NetBird New User Pending](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-05.png)
![NetBird New User Pending](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-05.png)

## 4. Installing NetBird On The Remote Worker Device

Access the secondary email account used to mimic the freelancer. In the inbox, locate the invitation email from NetBird. This email contains a secure link to join your organization's NetBird network, initiating the freelancer's onboarding process.

![Email NetBird Invitation](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-06.png)
![Email NetBird Invitation](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-06.png)

After clicking the invitation link, you'll be directed to NetBird's secure account creation page. Follow the on-screen instructions to create a new password.

![NetBird Login](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-07.png)
![NetBird Login](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-07.png)

Upon logging in, you'll arrive at NetBird's Peers dashboard. Locate and click the `Add Peer` button to initiate the [Getting Started](https://docs.netbird.io/how-to/getting-started) Wizard, which guides you through the process of adding a new device to the network.
Upon logging in, you'll arrive at NetBird's Peers dashboard. Locate and click the `Add Peer` button to initiate the [Getting Started](/how-to/getting-started) Wizard, which guides you through the process of adding a new device to the network.

![NetBird Freelancer Peers Dashboard](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-08.png)
![NetBird Freelancer Peers Dashboard](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-08.png)

The wizard will detect your operating system and provide detailed step-by-step instructions on how to [install NetBird](https://docs.netbird.io/how-to/installation).
The wizard will detect your operating system and provide detailed step-by-step instructions on how to [install NetBird](/how-to/installation).

![NetBird Freelancer Install Client](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-09.png)
![NetBird Freelancer Install Client](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-09.png)

During your initial connection to NetBird, a system dialog will appear requesting authorization. This prompt asks for permission to access your profile and email information, which is necessary for NetBird to establish your account and network access.

![NetBird Authorize App](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-10.png)
![NetBird Authorize App](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-10.png)

After completing the installation, your device will appear in the Peers dashboard. Hover over the `+1` in the `Assigned Groups` column to confirm the device has automaticaclly assigned to the `Freelancers` group as expected.

![NetBird Freelancer Peers Listed](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-11.png)
![NetBird Freelancer Peers Listed](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-11.png)

## 5. Approving Peers

Back to your primary account, you'll notice the newly added user's status is now displayed as `Active` in the `Users` dashboard. This status update confirms that the device has successfully added to the NetBird network and is ready for secure communication.

![NetBird Peers Dashboard](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-12.png)
![NetBird Peers Dashboard](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-12.png)

However, your approval is required before the user's device can fully connect to the NetBird network. To grant network access:

Expand All @@ -114,15 +114,15 @@ However, your approval is required before the user's device can fully connect to
* Click the `Approve` button next to the device
* Confirm the action when prompted

![NetBird Approve New Peer](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-13.png)
![NetBird Approve New Peer](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-13.png)

After approval, the device is granted full access to network resources allocated to the `Freelancers` group. The freelancer can now view all accessible network resources in their `Peers` dashboard:

![NetBird Freelancer Peers View](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-16.png)
![NetBird Freelancer Peers View](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-16.png)

Likewise, as an administrator, you can click on the user's device to see which resources and peers the freelancer has access to.

![NetBird Main Account Peers View](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-17.png)
![NetBird Main Account Peers View](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-17.png)

## 6. Automating Peer Approval with EDR Integration (optional)

Expand All @@ -137,8 +137,8 @@ Key aspects of NetBird's EDR integration:

To activate this feature, navigate to `Integrations > EDR` and activate the CrowdStrike integration toggle.

![NetBird EDR Integration](/public/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-18.png)
![NetBird EDR Integration](/docs-static/img/how-to-guides/peer-approval-for-remote-worker-access/peer-a-18.png)

For more information regarding NetBird's EDR integration, refer to the [documentation](https://docs.netbird.io/how-to/endpoint-detection-and-response)
For more information regarding NetBird's EDR integration, refer to the [documentation](/how-to/endpoint-detection-and-response)


Loading