search

sealingtech / EDCOP

Expandable Defensive Cyber Operations Platform
Apache License 2.0
43 stars 9 forks source link

Add elasticsearch user + directory permissions #24

Closed miked235 closed 6 years ago

miked235 commented 6 years ago

For now, we're using a hostpath for elasticsearch and need to have permissions to write to that directory from the container. We run as user elasticsearch with uid 2000, so here's a simple script to create the user and give the dir to elasticsearch:

useradd -r -u 2000 elasticsearch
mkdir /EDCOP/bulk/esdata
chown elasticsearch:elasticsearch /EDCOP/bulk/esdata

This script should be run on all nodes (including the master). There might be more users to create in the future until we find a better way to handle data.

miked235 commented 6 years ago

Since it's related, we also need a Moloch directory to store the raw PCAP files, it only needs to be run on the workers:

mkdir /EDCOP/bulk/moloch/ /EDCOP/bulk/moloch/raw /EDCOP/bulk/moloch/logs
dlohin commented 6 years ago

Fixed here: https://github.com/sealingtech/EDCOP/pull/28