mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-02-09 08:43:36 +01:00
Merge remote-tracking branch 'remotes/origin/dev' into issue/749
This commit is contained in:
m0duspwnens
75
setup/automation/pm_standalone_defaults
Normal file
75
setup/automation/pm_standalone_defaults
Normal file
@@ -0,0 +1,75 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC
|
||||
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
BASICBRO=7
|
||||
BASICSURI=7
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
BROVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
GRAFANA=1
|
||||
# HELIXAPIKEY=
|
||||
HNMASTER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=standalone
|
||||
install_type=STANDALONE
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MASTERADV=BASIC
|
||||
MASTERUPDATES=1
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NAVIGATOR=1
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MASTER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=1
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=onionuser
|
||||
WEBPASSWD2=onionuser
|
||||
2
setup/proxies/docker.conf
Normal file
2
setup/proxies/docker.conf
Normal file
@@ -0,0 +1,2 @@
|
||||
[Service]
|
||||
ExecStart=/usr/bin/dockerd /usr/bin/dockerd -H fd:// --registry-mirror "$proxy_addr"
|
||||
@@ -19,7 +19,7 @@ source ./so-whiptail
|
||||
source ./so-variables
|
||||
source ./so-common-functions
|
||||
|
||||
SOVERSION=1.3.0
|
||||
SOVERSION=1.4.0
|
||||
|
||||
accept_salt_key_remote() {
|
||||
systemctl restart salt-minion
|
||||
@@ -514,7 +514,7 @@ detect_os() {
|
||||
# Install bind-utils so the host command exists
|
||||
if ! command -v host > /dev/null 2>&1; then
|
||||
echo "Installing required packages to run installer"
|
||||
yum -y install bind-utils >> "$setup_log" 2>&1
|
||||
yum -y install bind-utils yum-plugin-versionlock >> "$setup_log" 2>&1
|
||||
fi
|
||||
|
||||
|
||||
@@ -550,6 +550,9 @@ detect_os() {
|
||||
disable_onion_user() {
|
||||
# Disable the default account cause security.
|
||||
usermod -L onion
|
||||
|
||||
# Remove the automated setup script from crontab, if it exists
|
||||
crontab -u onion -r
|
||||
}
|
||||
|
||||
disable_misc_network_features() {
|
||||
@@ -580,7 +583,9 @@ docker_install() {
|
||||
{
|
||||
yum clean expire-cache;
|
||||
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo;
|
||||
yum -y install docker-ce;
|
||||
yum -y install docker-ce-19.03.9-3.el7 containerd.io-1.2.6-3.el7;
|
||||
yum versionlock docker-ce-19.03.9-3.el7;
|
||||
yum versionlock containerd.io-1.2.6-3.el7
|
||||
} >> "$setup_log" 2>&1
|
||||
|
||||
else
|
||||
@@ -616,9 +621,10 @@ docker_registry() {
|
||||
echo "Setting up Docker Registry" >> "$setup_log" 2>&1
|
||||
mkdir -p /etc/docker >> "$setup_log" 2>&1
|
||||
# Make the host use the master docker registry
|
||||
if [ -n "$TURBO" ]; then local proxy="$TURBO"; else local proxy="https://$MSRV"; fi
|
||||
printf '%s\n'\
|
||||
"{"\
|
||||
" \"registry-mirrors\": [\"https://$MSRV:5000\"]"\
|
||||
" \"registry-mirrors\": [ \"$proxy:5000\" ]"\
|
||||
"}" > /etc/docker/daemon.json
|
||||
echo "Docker Registry Setup - Complete" >> "$setup_log" 2>&1
|
||||
|
||||
@@ -683,7 +689,7 @@ docker_seed_registry() {
|
||||
# Tag it with the new registry destination
|
||||
docker tag soshybridhunter/"$i" "$HOSTNAME":5000/soshybridhunter/"$i"
|
||||
docker push "$HOSTNAME":5000/soshybridhunter/"$i"
|
||||
docker rmi soshybridhunter/"$i"
|
||||
#docker rmi soshybridhunter/"$i"
|
||||
} >> "$setup_log" 2>&1
|
||||
done
|
||||
else
|
||||
@@ -948,6 +954,54 @@ node_pillar() {
|
||||
cat "$pillar_file" >> "$setup_log" 2>&1
|
||||
}
|
||||
|
||||
parse_options() {
|
||||
case "$1" in
|
||||
--turbo=*)
|
||||
local proxy
|
||||
proxy=$(echo "$1" | tr -d '"' | awk -F'--turbo=' '{print $2}')
|
||||
proxy_url="http://$proxy"
|
||||
TURBO="$proxy_url"
|
||||
;;
|
||||
--proxy=*)
|
||||
local proxy
|
||||
proxy=$(echo "$1" | tr -d '"' | awk -F'--proxy=' '{print $2}')
|
||||
|
||||
local proxy_protocol
|
||||
proxy_protocol=$(echo "$proxy" | awk 'match($0, /http|https/) { print substr($0, RSTART, RLENGTH) }')
|
||||
|
||||
if [[ ! $proxy_protocol =~ ^(http|https)$ ]]; then
|
||||
echo "Invalid proxy protocol"
|
||||
echo "Ignoring proxy"
|
||||
return
|
||||
fi
|
||||
|
||||
if [[ $2 == --proxy-user=* && $3 == --proxy-pass=* ]]; then
|
||||
local proxy_user
|
||||
local proxy_password
|
||||
proxy_user=$(echo "$2" | tr -d '"' | awk -F'--proxy-user=' '{print $2}')
|
||||
proxy_password=$(echo "$3" | tr -d '"' | awk -F'--proxy-pass=' '{print $2}')
|
||||
|
||||
local proxy_addr
|
||||
proxy_addr=$(echo "$proxy" | awk -F'http\:\/\/|https\:\/\/' '{print $2}')
|
||||
|
||||
export http_proxy="${proxy_protocol}://${proxy_user}:${proxy_password}@${proxy_addr}"
|
||||
|
||||
elif [[ (-z $2 || -z $3) && (-n $2 || -n $3) || ( -n $2 && -n $3 && ($2 != --proxy-user=* || $3 != --proxy-pass=*) ) ]]; then
|
||||
echo "Invalid options passed for proxy. Order is --proxy-user=<user> --proxy-pass=<password>"
|
||||
echo "Ignoring proxy"
|
||||
return
|
||||
|
||||
else
|
||||
export http_proxy="$proxy"
|
||||
fi
|
||||
|
||||
export {https,ftp,rsync,all}_proxy="$http_proxy"
|
||||
;;
|
||||
*)
|
||||
echo "Invalid option"
|
||||
esac
|
||||
}
|
||||
|
||||
patch_pillar() {
|
||||
|
||||
local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls
|
||||
@@ -1068,7 +1122,7 @@ saltify() {
|
||||
yum -y update exclude=salt*;
|
||||
systemctl enable salt-minion;
|
||||
} >> "$setup_log" 2>&1
|
||||
echo "exclude=salt*" >> /etc/yum.conf
|
||||
yum versionlock salt*
|
||||
else
|
||||
DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" upgrade >> "$setup_log" 2>&1
|
||||
|
||||
@@ -1229,8 +1283,6 @@ set_progress_str() {
|
||||
'----'\
|
||||
"$percentage% - ${progress_bar_text^^}"\
|
||||
"----" >> "$setup_log" 2>&1
|
||||
|
||||
sleep 5
|
||||
}
|
||||
|
||||
sensor_pillar() {
|
||||
@@ -1445,6 +1497,23 @@ update_packages() {
|
||||
fi
|
||||
}
|
||||
|
||||
use_turbo_proxy() {
|
||||
if [[ ! $install_type =~ ^(MASTER|EVAL|HELIXSENSOR|MASTERSEARCH|STANDALONE)$ ]]; then
|
||||
echo "turbo is not supported on this install type" >> $setup_log 2>&1
|
||||
return
|
||||
fi
|
||||
|
||||
if [[ $OS == 'centos' ]]; then
|
||||
printf '%s\n' "proxy=${TURBO}:3142" >> /etc/yum.conf
|
||||
else
|
||||
printf '%s\n'\
|
||||
"Acquire {"\
|
||||
" HTTP::proxy \"${TURBO}:3142\";"\
|
||||
" HTTPS::proxy \"${TURBO}:3142\";"\
|
||||
"}" > /etc/apt/apt.conf.d/proxy.conf
|
||||
fi
|
||||
}
|
||||
|
||||
ls_heapsize() {
|
||||
|
||||
if [ "$total_mem" -ge 32000 ]; then
|
||||
|
||||
@@ -24,12 +24,49 @@ source ./so-variables
|
||||
setup_type=$1
|
||||
export setup_type
|
||||
|
||||
automation=$2
|
||||
|
||||
automated=no
|
||||
|
||||
echo "---- Starting setup at $(date -u) ----" >> $setup_log 2>&1
|
||||
|
||||
function progress() {
|
||||
if [ $automated == no ]; then
|
||||
whiptail --title "Security Onion Install" --gauge 'Please wait while installing' 6 60 0
|
||||
fi
|
||||
}
|
||||
|
||||
if [[ -f automation/$automation && $(basename $automation) == $automation ]]; then
|
||||
echo "Preselecting variable values based on automated setup: $automation" >> $setup_log 2>&1
|
||||
source automation/$automation
|
||||
automated=yes
|
||||
|
||||
echo "Checking network configuration" >> $setup_log 2>&1g
|
||||
ip a >> $setup_log 2>&1
|
||||
|
||||
attempt=1
|
||||
attempts=60
|
||||
ip a | grep "$MNIC:" | grep "state UP" >> $setup_log 2>&1
|
||||
while [ $? -ne 0 ]; do
|
||||
ip a >> $setup_log 2>&1
|
||||
if [ $attempt -gt $attempts ]; then
|
||||
echo "Network unavailable - setup cannot continue" >> $setup_log 2>&1
|
||||
exit 1
|
||||
fi
|
||||
echo "Waiting for network to come up (attempt $attempt of $attempts)" >> $setup_log 2>&1
|
||||
attempt=$((attempt + 1))
|
||||
sleep 10;
|
||||
ip a | grep "$MNIC:" | grep "state UP" >> $setup_log 2>&1
|
||||
done
|
||||
echo "Network is up on $MNIC" >> $setup_log 2>&1
|
||||
fi
|
||||
|
||||
case "$setup_type" in
|
||||
iso | network) # Accepted values
|
||||
echo "Beginning Security Onion $setup_type install"
|
||||
echo "Beginning Security Onion $setup_type install" >> $setup_log 2>&1
|
||||
;;
|
||||
*)
|
||||
echo "Invalid install type, must be 'iso' or 'network'"
|
||||
echo "Invalid install type, must be 'iso' or 'network'" | tee $setup_log
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
@@ -37,9 +74,13 @@ esac
|
||||
# Allow execution of SO tools during setup
|
||||
export PATH=$PATH:../salt/common/tools/sbin
|
||||
|
||||
date -u > $setup_log 2>&1
|
||||
|
||||
got_root
|
||||
|
||||
if [[ $# -gt 1 ]]; then
|
||||
set -- "${@:2}"
|
||||
parse_options "$@" >> $setup_log 2>&1
|
||||
fi
|
||||
|
||||
detect_os
|
||||
|
||||
if [ "$OS" == ubuntu ]; then
|
||||
@@ -48,10 +89,10 @@ fi
|
||||
|
||||
setterm -blank 0
|
||||
|
||||
if (whiptail_you_sure); then
|
||||
if [ "$setup_type" == 'iso' ] || (whiptail_you_sure); then
|
||||
true
|
||||
else
|
||||
echo "User cancelled setup." >> $setup_log 2>&1
|
||||
echo "User cancelled setup." | tee $setup_log
|
||||
whiptail_cancel
|
||||
fi
|
||||
|
||||
@@ -241,6 +282,10 @@ fi
|
||||
|
||||
whiptail_make_changes
|
||||
|
||||
if [[ -n "$TURBO" ]]; then
|
||||
use_turbo_proxy
|
||||
fi
|
||||
|
||||
if [[ "$setup_type" == 'iso' ]]; then
|
||||
# Init networking so rest of install works
|
||||
set_hostname_iso
|
||||
@@ -485,7 +530,7 @@ fi
|
||||
set_progress_str 95 'Verifying setup'
|
||||
salt-call -l info state.highstate >> $setup_log 2>&1
|
||||
|
||||
} | whiptail --title "Hybrid Hunter Install" --gauge "Please wait while installing" 6 60 0
|
||||
} | progress
|
||||
|
||||
success=$(tail -10 $setup_log | grep Failed | awk '{ print $2}')
|
||||
if [[ "$success" = 0 ]]; then
|
||||
|
||||
@@ -958,7 +958,7 @@ whiptail_setup_complete() {
|
||||
|
||||
[ -n "$TESTING" ] && return
|
||||
|
||||
whiptail --title "Security Onion Setup" --msgbox "Finished $install_type install. Press ENTER to reboot." 8 75
|
||||
whiptail --title "Security Onion Setup" --msgbox "Finished $install_type install. Press Ok to reboot." 8 75
|
||||
install_cleanup >> $setup_log 2>&1
|
||||
|
||||
}
|
||||
@@ -967,7 +967,7 @@ whiptail_setup_failed() {
|
||||
|
||||
[ -n "$TESTING" ] && return
|
||||
|
||||
whiptail --title "Security Onion Setup" --msgbox "Install had a problem. Please see $setup_log for details. Press ENTER to reboot." 8 75
|
||||
whiptail --title "Security Onion Setup" --msgbox "Install had a problem. Please see $setup_log for details. Press Ok to reboot." 8 75
|
||||
install_cleanup >> $setup_log 2>&1
|
||||
|
||||
}
|
||||
@@ -1048,7 +1048,7 @@ whiptail_you_sure() {
|
||||
|
||||
[ -n "$TESTING" ] && return
|
||||
|
||||
whiptail --title "Security Onion Setup" --yesno "Are you sure you want to install Security Onion over the internet?" 8 75
|
||||
whiptail --title "Security Onion Setup" --yesno "Are you sure you want to continue a network install of Security Onion?" 8 75
|
||||
|
||||
local exitstatus=$?
|
||||
return $exitstatus
|
||||
|
||||
Reference in New Issue
Block a user