Skip to content

Installation

Jump to bottom
GS McNamara, MS edited this page Jun 23, 2020 · 100 revisions

Tested on CentOS 7 VM with ~4CPU 8GB RAM
e.g. Linode 4 CPU, 160GB Storage, 8GB RAM

Let's get to it

[boot VM]

yum install git

yum install docker

#enable start on boot
systemctl enable docker
#to start docker
systemctl start docker

#needed by elastic
nano /etc/sysctl.conf
#add the following line
vm.max_map_count=262144
[save change]

#refresh with the new configuration
sysctl -p

docker-compose up

docker exec -it elk sh -c "/password-setup.exp"

#Next we configure Logstash to use basic authentication
#Log into the Kibana Web UI using your browser and the elastic user over the HTTP or HTTPS port plus your VM's IP address

  1. Use the the Management > Roles UI in Kibana to create a logstash_writer role.
  2. For Cluster privileges, add manage_index_templates and monitor.
  3. For Indices' value, use *. For its Privileges value add write, create, delete, and create_index. Save.
  4. Create a logstash_internal user and assign it the logstash_writer role. You can create users from the Management > Users UI in Kibana.
  5. Configure Logstash to authenticate as the logstash_internal user you just created. Using the password you set, within the ELK docker container (using a command such as "docker exec -it elk /bin/bash" to get a terminal) update the /etc/logstash/conf.d/30-output.conf file's "password => "qE*7Pj43Or"" value.

#More information on these steps, if needed: https://www.elastic.co/guide/en/logstash/current/ls-security.html#ls-http-auth-basic

An index should be created automatically after the first violation takes place.

Optional steps

To enable honeypot mode

create/move into a directory you will use for a git repo
git clone https://github.com/GSMcNamara/Floodspark.git
modify both references to "floodspark.com" in Floodspark/docker/tanner/snare/Dockerfile to the domain you wish to emulate
cd ..
docker-compose build
screen
docker-compose up
Press Ctrl-A then Ctrl-D
#next we change resty/nginx's routing mode from block to honeypot
docker exec -it resty /bin/bash
nano /etc/nginx/conf.d/default.conf
change 'set $mode "block";' to 'set $mode "honeypot";'
save changes
nginx -t
#if above test passes, then:
nginx -s reload

Now, the snare server may serve a 500 error because Tanner has a failure. Within the /tmp/tanner/tanner.err file in the tanner Docker container you may see an error message such as "PermissionError: [Errno 13] Permission denied: '/var/log/tanner/tanner_report.json'"

If so, you may have to do this bad workaround:
setenforce 0
docker exec -it -u 0 tanner /bin/sh
touch /var/log/tanner/tanner_report.json
chmod 777 /var/log/tanner/tanner_report.json
exit container

Hopefully this is soon fixed: https://github.com/dtag-dev-sec/tpotce/issues/517

To import the demo dashboard

go to http://[your ip address]/app/infra#/logs?_g=()
click Change source configuration
set Log indices to *
Click Update Source
Go to /app/kibana#/management/kibana/objects?_g=()
Import the JSON file from https://github.com/GSMcNamara/Floodspark/blob/master/demo/export.ndjson or https://raw.githubusercontent.com/GSMcNamara/Floodspark/master/demo/export.ndjson. You may need to remove the ".txt" extension from the downloaded file's name.
Click Done

To create dashboard-only user with only the view permission, e.g. Floodspark Demo

Go to Management > Security > Roles. Create a role with name "demo_dashboard_read". Under Index privileges add the underlying indices that you want this user to be able to view through the dashboard. Add read to Privileges.
Go to Management > Security > Users > Create user and create the username "dashboard_only", set a password you will remember, and add "kibana_dashboard_only_user" and "demo_dashboard_read" to Roles.
User this account to demo your fancy dashboard(s)

To make the dashboard demo experience really slick

#You can have resty/nginx authenticate automatically and load the dashboard URL directly, so it is all that user sees. HOWEVER, the downside is that you cannot log into Kibana using any other account (e.g. elastic) when accessed through the modified resty/nginx instance.
docker exec -it resty /bin/bash
modify /etc/nginx/conf.d/default.conf #(nano is installed)
within the "location /" block, e.g. under "proxy_set_header Host $http_host;" add "proxy_set_header Authorization "Basic ZGFzaGJvYXJkX29ubHk6cUUqN1BqNDNPcg==";" where "ZGFzaGJvYXJkX29ubHk6cUUqN1BqNDNPcg==" is the base64 encoded value for the dashboard_only:password combination. You must replace this with the base64 encoded value for dashboard_only:[the password you set]
#to block people from changing the password of the dashboard_only user, update the following nginx line with "dashboard_only" instead of "floodspark":
location /api/security/v1/users/floodspark/password {
#TODO: to have kibana load a specific dashboard directly
save changes.
#run the following to test nginx config before restarting nginx
nginx -t
#restart nginx if safe
nginx -s reload

To proxy your real website

#change the following line in /etc/nginx/conf.d/default.conf of the resty docker container:
proxy_pass http://elk:5601/;
#update the domain value in this line:
proxy_set_header Host [your domain here];
#reload the config:
nginx -s reload

To install your own SSL certificate

#This should not really differ from a standard installation in NGINX
#Installation takes place in the resty docker container
#Steps might be similar to:
docker cp private.key resty:/etc/ssl/private/
docker cp ssl-bundle.crt resty:/etc/ssl/certs/
docker exec -it resty /bin/bash
nano /etc/nginx/conf.d/default.conf
#comment out the existing SSL cert information, resulting in something like:
ssl_certificate /etc/ssl/certs/ssl-bundle.crt;
ssl_certificate_key /etc/ssl/private/private.key;
# ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
# ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
# ssl_dhparam /etc/ssl/certs/dhparam.pem;
save.
nginx -t
nginx -s reload

To generate data

#pause Redis to avoid blacklisting yourself
docker stop redis
#Wget, cURL, visit in Chrome Incognito mode, and/or Tor browser, etc to generate data
#resume redis when you're ready to start blocking people again
docker start redis

Helpful commands

...for Docker

#check status of all containers
docker ps -a

#debug a container
docker exec -it [container name] /bin/bash

#get command used to start container
docker inspect -f "{{.Name}} {{.Config.Cmd}}" $(docker ps -a -q)

#list all images
docker images

...for Redis

#run the redis-cli:
docker run -it --network backend --rm floodspark/redis:v2 redis-cli -h redis
#list all existing ip addresses in blacklist:
KEYS *
#delete all ip addresses from blacklist:
FLUSHALL

Clone this wiki locally