Packer Template for `Ops Network - Secure: Security Onion`

[rylagek]

Implementing #99

Configured to run

• [x] Working ELK Stack (Elasticsearch, Logstash, Kibana)
• [x] Bro/Zeek traffic analyzer working
• [ ] Moloch/Arkime - configured to listen on the ops router
• [x] Snort IDS – configured to listen on the ops router
• [x] Nmap

[rylagek]

Hardware Requirements (Airgapped standalone) 12 Gb RAM 105 Gb Disk 2+ NIC

[rylagek]

Base system needs two static ip addresses prior to full installation

[rylagek]

Qs through installation: Optional components: grafana osquery wazuh thehive playbook strelka

number of zeek processes & suricata processes?

[rylagek]

Default eval services - eval is recommended for classroom/small lab Missing - logstash, Arkime, Snort, Nmap Logstash might be included but not shown Snort functionality might be included based on installation config Qs (rule list) but isn't explicitly running or configured Arkime and Nmap definitely need installed

[rylagek]

Logstash is included in Security Onion but not used in the eval installation. Only in the standalone and distributed This is explained in the Architecture documentation

[rylagek]

Snort is included in v16 but only mentioned in v2.3 The default NIDS for v2.3 is Suricata

[rylagek]

https://resources.infosecinstitute.com/topic/open-source-ids-snort-suricata/

[rylagek]

Rebuilt as standalone

[rylagek]

Arkime for Centos 7

[rylagek]

Install nmap for centos: sudo yum install nmap -y Install open-vm-tools for centos: sudo yum install open-vm-tools -y

[rylagek]

Qs through installation: Optional components: grafana osquery wazuh thehive playbook strelka

number of zeek processes & suricata processes?

None of the optional components are necessary

3 and 1 respectfully for now

[rylagek]

Snort is unnecessary as Suricata can use the Snort rules we would have students write

[rylagek]

Explicit differences according to the Suricata Docs

[rylagek]

Helpful commands finding middle ground b/w airgap and standard install methods - might still need open-vm-tools

vi /etc/sysconfig/network-scripts/ifcfg-ensXXX // location of dhcp variable
systemctl restart network // restart for settings to take effect
vi /etc/resolve.conf // add preferred dns server
route add default gw x.x.x.x ensXXX // add default route
rpm -vhU https://nmap.org/dist/nmap-7.92-1.x86_64.rpm
yum reinstall centos-release // fix dependency installation issues from airgapped install
sudo yum install -y https://s3.amazonaws.com/files.molo.ch/builds/centos-7/arkime-3.3.1-1.x86_64.rpm // install arkime and dependencies

[rylagek]

Elasticsearch is 7.9.3 by default - needs to be greater than 7.10.0 to support Arkime

[rylagek]

https://www.elastic.co/guide/en/elasticsearch/reference/7.17/rolling-upgrades.html

[rylagek]

Airgapped config is tricky - set up route for internet access and then: yum reinstall http://mirror.centos.org/centos/7/updates/x86_64/Packages/centos-release-7-9.2009.1.el7.centos.x86_64.rpm

[rylagek]

then yum install <whatever> should work if it's included in the base repo

[rylagek]

After a reboot the vsphere registers that the tools are installed

[rylagek]

Just noticed our security onion iso version is 2.3.21 and the newest is 2.3.100 - rebuilding with newer iso should resolve the issue with arkime

[rylagek]

https://github.com/Security-Onion-Solutions/securityonion/blob/master/VERIFY_ISO.md

[rylagek]

Security Onion 2.3.100 Setup sign in pw again [ENTER] enter (install) standalone seconion no description management nic static ip w/ cidr mask gw dns addresses (default) dns search domain (default) airgap monitor nic (remaining one) home networks (non-internet) basic manageer install zeek etopen no osquery, wazuh, playbook or strelka default docker range email pw, confirm pw ip to access set soremote user pw confirm basic zeek processes (3) suricata processes (3) ntp servers - no nodebasic search node allow web access ip address confirm config options let setup run

[rylagek]

has to be set up with static addressing that matches assigned addressing (can't be contacted by dhcp server) then switched over to internet acces

sudo ip a add 192.168.100.xx/22 dev ens192
sudo ip route add default via 192.168.103.254 dev ens192
rpm -q centos-release
sudo yum reinstall http://mirror.centos.org/centos/7/updates/x86_64/Packages/centos-release-7-9.2009.1.el7.cnetos.x86_64.rpm
sudo yum install -y open-vm-tools, nmap
sudo yum install -7 https://s3.amazonaws.com/files.molo.ch/builds/centos-7/arkime-3.3.1-1.x86_64.rpm

[rylagek]

once all internet dependencies are fulfilled, remove non-airgap artifacts

sudo ip a del 192.168.100.xx/22 dev ens192
sudo ip route del default via 192.168.103.254 dev ens192

[rylagek]

set up arkime /opt/arkime/db/db.pl http://ESHOST:9200 init

[rylagek]

https://docs.securityonion.net/en/16.04/setup.html use this for setup automation

[rylagek]

/opt/arkime/db/db.pl http://ESHOST:9200 init wasn't finding ES running, trying to give access with sudo so-allow followed by the e option

[rylagek]

That didn't change the inability to run the arkime command so-elasticsearch-query works but unsure why anything else is not working

[rylagek]

Looking likely that it is from security updates in the new version https://stackoverflow.com/questions/35921195/curl-52-empty-reply-from-server-timeout-when-querying-elastiscsearch

[rylagek]

Something like this might do it curl -X GET "https://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=50s&pretty" --key certificates/elasticsearch-ca.pem -k -u elasticuser

[rylagek]

Security Onion is in fact using self signed certificates

[rylagek]

curl -X GET "https://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=50s&pretty" --key certificates/elasticsearch-ca.pem -k -u seconion@mail.mil and then typing the password when prompted worked

[rylagek]

need to update the arkime setup db file to use the snake oil ssl and creds

[rylagek]

global options seem to have the options we need, but might need to actually edit arkime config file

[marissaeinhorn]

• Followed this guide to install arkime. Did not install geo database Changes in /opt/arkime/.etc/config.ini
• line 19 https
• line 26 certFile
• line 33 keyFile

[marissaeinhorn]

Syntax opt/arkime/db/db.pl --clientkey <key> --esuser <user> https://localhost:9200 init - still doesnt find elasticsearch running

[marissaeinhorn]

Modifying /opt/so/conf/elasticsearch/elasticsearch.yml

• disable xpack.security.enabled
• transport.ssl.enabled - false
• http.ssl.enabled - false

[marissaeinhorn]

Tried disabling authentication for elasticsearch sudo so-elastic-auth false Elastic-auth allows kibana, elastic search and other services to authenticate with the same set of credentials. Renabled the service

[marissaeinhorn]

Followed this guide to install arkime and elasticsearch on ubuntu article

no ssl certs and arkime inits to database

[rylagek]

That article uses arkime version 2.7. Does it work with the current version 3? @marissaeinhorn

[marissaeinhorn]

Yes you just have to change the package names at install

[marissaeinhorn]

Arkime installed on ubuntu 20

su root
apt-get update -y
apt-get install gnupg2 curl wget -y
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch --no-check-certificate | apt-key add -
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-7.x.list
apt-get update -y
apt-get install elasticsearch -y
systemctl enable --now elasticsearch
wget https://s3.amazonaws.com/files.molo.ch/builds/ubuntu-20.04/arkime_3.4.0-1_amd64.deb
apt install -y ./arkime_3.4.0-1_amd64.deb
/opt/arkime/bin/Configure

Last command will be harder to automate, Configure script has prompts. May be easier to replace /opt/arkime/etc/configure.ini file

1. set listener interface - ens160;ens192
2. default - press enter
3. default - press enter
4. password - arkime
5. geo files default - press enter

/opt/arkime/db/db.pl http://localhost:9200 init
/opt/arkime/bin/arkime_add_user.sh admin "SuperAdmin" admin --admin
crontab -e
@reboot sleep 120 && systemctl start arkimecapture.service
@reboot sleep 120 && systemctl start arkimeviewer.service

Set static ip 172.16.50.3/24 Manual configuration complete & tested creating template for terraform testing