cisagov / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
https://cisagov.github.io/Malcolm/
Other
1.96k stars 327 forks source link

Adds initial support for building Hedgehog RPI images #294

Closed aut0exec closed 9 months ago

aut0exec commented 10 months ago

πŸ—£ Description

Initial support for creating an RPI Hedgehog image.

πŸ’­ Motivation and context

There was a request for this functionality and an open issue tracked on the INL Malcolm repo.

Raspberry Pi's are cheap and readily available these days and resources on the RPI 4 8GB are likely sufficient to support running a Hedgehog sensor. The Debian process used to build base Debian RPI images was used and then the necessary additions to build Debian into Hedgehog were added/installed via a chroot.

Raspberry Pi, Hedghehog ARM sensor

πŸ§ͺ Testing

Full builds were done and tested on a RPI 4 8GB model. An actual RPI 4 sensor was setup and connected to a Malcolm instance via the guide here. No further testing beyond the E2E guide has been performed thus far. More testing recommended to ensure that the RPI image contains all the necessary configurations to function properly in a production setup.

βœ… Pre-approval checklist

βœ… Pre-merge checklist

βœ… Post-merge checklist

mmguero commented 9 months ago

I've pulled the commit(s) from this branch into my development fork, when it's included in the next Malcolm release I'll come back here and close this PR.

aut0exec commented 9 months ago

Added a fix for the console not displaying UTF-8 properly and ensure that the sd-card is re-partitioned on first boot of the pi.

mmguero commented 9 months ago

Thanks I've pulled your update into my release testing branch and will test it out first thing Monday.

mmguero commented 9 months ago

commits included in and superceded by #297