search

biggiesmallsAG / nightHawkResponse

Incident Response Forensic Framework
599 stars 139 forks source link

Changing IP after Install #2

Closed bcradster closed 8 years ago

bcradster commented 8 years ago

When changing the IP of the machine, a defaul gateway and DNS is not setup meaning it is not possible to get updates. example: #sudo /opt/nighthawk/bin/nighthawkctl set-ip 192.168.0.222 you also need to set the DNS and default gateway: #sudo nmcli con mod eth0 ipv4.gateway 192.168.0.1 ipv4.dns "8.8.8.8 8.8.4.4"

There also appears to be an issue with Elastic as Kibana is not able to connect.

biggiesmallsAG commented 8 years ago

hey mate,

understand the issue, fixing it now, be back with a reply shortly.

roshanmaskey commented 8 years ago

Hi bcradster,

I tried to replicate IP address change issue and it seems to work on my test machine. If things do not restart well you can try sudo systemctl status nighthawk or stop-start the service using following commands -- sudo systemctl stop nighthawk -- sudo systemctl start nighthawk

Could you also lets me know if you are using v1.0.2 ISO

In current release v1.0.2 we haven't added default gateway and DNS settings, which we will include in future release.

In regards to Kibana, we haven't automatically initialized it. Please use following steps to to initialize it.

step_1: https://:8443 step_2: Untick "Index contains time-based events" step_3: Replace logstash-* with investigations step_4: Create button appear, please click on it.

You can now use Discover or Sense to query elastic search.

bcradster commented 8 years ago

Yes, I am using the v1.0.2 ISO. Going to reinstall it again as I think a yum update has killed the web server.

roshanmaskey commented 8 years ago

If it is web server, you could check nginx status "sudo systemctl status nginx" also ps -ef | grep -i uwsgi. If both of them are up, nginx should serve you the content.

biggiesmallsAG commented 8 years ago

Technically the yum update should be for when a new version (of nighthawk) comes out and you want to instantiate the new code into your existing setup.

We will double check to make sure all core services are in tack after a update.