CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev' of https://github.com/Security-Onion-Solutions/securityonion into dev

Browse Source
This commit is contained in:
m0duspwnens
2021-01-13 10:47:13 -05:00
parent cc0697cefa 9b060fb2d1
commit 489f702e47
10 changed files with 56 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
salt/strelka/init.sls
View File

@@ -1,4 +1,4 @@
# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC # Copyright 2014,2015,2016,2017,2018,2019,2020,2021 Security Onion Solutions, LLC
# #
# This program is free software: you can redistribute it and/or modify # This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by # it under the terms of the GNU General Public License as published by
@@ -17,8 +17,8 @@
{% if 'strelka' in top_states %} {% if 'strelka' in top_states %}
{%- set MANAGER = salt['grains.get']('master') %} {% set MANAGER = salt['grains.get']('master') %}
{%- set MANAGERIP = salt['pillar.get']('global:managerip', '') %} {% set MANAGERIP = salt['pillar.get']('global:managerip', '') %}
{% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %} {% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %}
{% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %} {% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
{% set STRELKA_RULES = salt['pillar.get']('strelka:rules', '1') %} {% set STRELKA_RULES = salt['pillar.get']('strelka:rules', '1') %}
@@ -47,7 +47,7 @@ strelkasync:
- group: 939 - group: 939
- template: jinja - template: jinja
{%- if STRELKA_RULES == 1 %} {% if STRELKA_RULES == 1 %}
strelkarules: strelkarules:
file.recurse: file.recurse:
@@ -56,13 +56,15 @@ strelkarules:
- user: 939 - user: 939
- group: 939 - group: 939
{% if grains['role'] in ['so-eval','so-managersearch', 'so-manager', 'so-standalone', 'so-import'] %}
strelkarepos: strelkarepos:
file.managed: file.managed:
- name: /opt/so/saltstack/default/salt/strelka/rules/repos.txt - name: /opt/so/saltstack/default/salt/strelka/rules/repos.txt
- source: salt://strelka/rules/repos.txt.jinja - source: salt://strelka/rules/repos.txt.jinja
- template: jinja - template: jinja
{%- endif %} {% endif %}
{% endif %}
strelkadatadir: strelkadatadir:
file.directory: file.directory:

10
salt/telegraf/scripts/suriloss.sh
View File

@@ -33,20 +33,20 @@ if [ $CHECKIT == 2 ]; then
CURRENTDROP=${RESULT[4]} CURRENTDROP=${RESULT[4]}
PASTDROP=${RESULT[14]} PASTDROP=${RESULT[14]}
DROPPED=$(($CURRENTDROP - $PASTDROP)) DROPPED=$((CURRENTDROP - PASTDROP))
if [ $DROPPED == 0 ]; then if [ $DROPPED == 0 ]; then
LOSS=0 LOSS=0
echo "suridrop drop=0" echo "suridrop drop=0"
else else
CURRENTPACKETS=${RESULT[9]} CURRENTPACKETS=${RESULT[9]}
PASTPACKETS=${RESULT[19]} PASTPACKETS=${RESULT[19]}
TOTALCURRENT=$(($CURRENTPACKETS + $CURRENTDROP)) TOTALCURRENT=$((CURRENTPACKETS + CURRENTDROP))
TOTALPAST=$(($PASTPACKETS + $PASTDROP)) TOTALPAST=$((PASTPACKETS + PASTDROP))
TOTAL=$(($TOTALCURRENT - $TOTALPAST)) TOTAL=$((TOTALCURRENT - TOTALPAST))
LOSS=$(echo 4 k $DROPPED $TOTAL / p | dc) LOSS=$(echo 4 k $DROPPED $TOTAL / p | dc)
echo "suridrop drop=$LOSS" echo "suridrop drop=$LOSS"
fi fi
else else
echo "suridrop drop=0" echo "suridrop drop=0"
fi fi

17
salt/telegraf/scripts/zeekloss.sh
View File

@@ -29,15 +29,22 @@ echo $$ > $lf
ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2) ZEEKLOG=$(tac /host/nsm/zeek/logs/packetloss.log | head -2)
declare RESULT=($ZEEKLOG) declare RESULT=($ZEEKLOG)
CURRENTDROP=${RESULT[3]} CURRENTDROP=${RESULT[3]}
PASTDROP=${RESULT[9]} # zeek likely not running if this is true
DROPPED=$((CURRENTDROP - PASTDROP)) if [[ $CURRENTDROP == "rcvd:" ]]; then
if [ $DROPPED == 0 ]; then CURRENTDROP=0
PASTDROP=0
DROPPED=0
else
PASTDROP=${RESULT[9]}
DROPPED=$((CURRENTDROP - PASTDROP))
fi
if [[ "$DROPPED" -le 0 ]]; then
LOSS=0 LOSS=0
echo "zeekdrop drop=0" echo "zeekdrop drop=0"
else else
CURRENTPACKETS=${RESULT[5]} CURRENTPACKETS=${RESULT[5]}
PASTPACKETS=${RESULT[11]} PASTPACKETS=${RESULT[11]}
TOTAL=$((CURRENTPACKETS - PASTPACKETS)) TOTAL=$((CURRENTPACKETS - PASTPACKETS))
LOSS=$(echo $DROPPED $TOTAL / p | dc) LOSS=$(echo 4 k $DROPPED $TOTAL / p | dc)
echo "zeekdrop drop=$LOSS" echo "zeekdrop drop=$LOSS"
fi fi

14
setup/automation/distributed-ami-forwardnode
View File

@@ -23,8 +23,8 @@ ADMINPASS1=onionuser
ADMINPASS2=onionuser ADMINPASS2=onionuser
#ALLOW_CIDR=0.0.0.0/0 #ALLOW_CIDR=0.0.0.0/0
#ALLOW_ROLE=a #ALLOW_ROLE=a
BASICZEEK=1 BASICZEEK=2
BASICSURI=1 BASICSURI=2
# BLOGS= # BLOGS=
BNICS=ens6 BNICS=ens6
ZEEKVERSION=ZEEK ZEEKVERSION=ZEEK
@@ -70,9 +70,9 @@ PATCHSCHEDULENAME=auto
SKIP_REBOOT=0 SKIP_REBOOT=0
SOREMOTEPASS1=onionuser SOREMOTEPASS1=onionuser
SOREMOTEPASS2=onionuser SOREMOTEPASS2=onionuser
STRELKA=1 #STRELKA=1
#THEHIVE=1 #THEHIVE=1
WAZUH=1 #WAZUH=1
WEBUSER=onionuser@somewhere.invalid # WEBUSER=onionuser@somewhere.invalid
WEBPASSWD1=0n10nus3r # WEBPASSWD1=0n10nus3r
WEBPASSWD2=0n10nus3r # WEBPASSWD2=0n10nus3r

4
setup/automation/distributed-ami-manager
View File

@@ -23,8 +23,8 @@ ADMINPASS1=onionuser
ADMINPASS2=onionuser ADMINPASS2=onionuser
ALLOW_CIDR=0.0.0.0/0 ALLOW_CIDR=0.0.0.0/0
ALLOW_ROLE=a ALLOW_ROLE=a
BASICZEEK=7 BASICZEEK=2
BASICSURI=7 BASICSURI=2
# BLOGS= # BLOGS=
BNICS=ens6 BNICS=ens6
ZEEKVERSION=ZEEK ZEEKVERSION=ZEEK

10
setup/automation/distributed-ami-searchnode
View File

@@ -22,7 +22,7 @@ ADMINUSER=onionuser
ADMINPASS1=onionuser ADMINPASS1=onionuser
ADMINPASS2=onionuser ADMINPASS2=onionuser
#ALLOW_CIDR=0.0.0.0/0 #ALLOW_CIDR=0.0.0.0/0
ALLOW_ROLE=a #ALLOW_ROLE=a
#BASICZEEK=7 #BASICZEEK=7
#BASICSURI=7 #BASICSURI=7
# BLOGS= # BLOGS=
@@ -72,7 +72,7 @@ SOREMOTEPASS1=onionuser
SOREMOTEPASS2=onionuser SOREMOTEPASS2=onionuser
#STRELKA=1 #STRELKA=1
#THEHIVE=1 #THEHIVE=1
WAZUH=1 #WAZUH=1
WEBUSER=onionuser@somewhere.invalid # WEBUSER=onionuser@somewhere.invalid
WEBPASSWD1=0n10nus3r # WEBPASSWD1=0n10nus3r
WEBPASSWD2=0n10nus3r # WEBPASSWD2=0n10nus3r

8
setup/automation/distributed-iso-search
View File

@@ -72,7 +72,7 @@ SOREMOTEPASS1=onionuser
SOREMOTEPASS2=onionuser SOREMOTEPASS2=onionuser
# STRELKA=1 # STRELKA=1
# THEHIVE=1 # THEHIVE=1
WAZUH=1 # WAZUH=1
WEBUSER=onionuser@somewhere.invalid # WEBUSER=onionuser@somewhere.invalid
WEBPASSWD1=0n10nus3r # WEBPASSWD1=0n10nus3r
WEBPASSWD2=0n10nus3r # WEBPASSWD2=0n10nus3r

14
setup/automation/distributed-iso-sensor
View File

@@ -23,8 +23,8 @@ ADMINPASS1=onionuser
ADMINPASS2=onionuser ADMINPASS2=onionuser
# ALLOW_CIDR=0.0.0.0/0 # ALLOW_CIDR=0.0.0.0/0
# ALLOW_ROLE=a # ALLOW_ROLE=a
BASICZEEK=7 BASICZEEK=2
BASICSURI=7 BASICSURI=2
# BLOGS= # BLOGS=
BNICS=eth1 BNICS=eth1
ZEEKVERSION=ZEEK ZEEKVERSION=ZEEK
@@ -70,9 +70,9 @@ PATCHSCHEDULENAME=auto
# SKIP_REBOOT= # SKIP_REBOOT=
SOREMOTEPASS1=onionuser SOREMOTEPASS1=onionuser
SOREMOTEPASS2=onionuser SOREMOTEPASS2=onionuser
STRELKA=1 # STRELKA=1
# THEHIVE=1 # THEHIVE=1
WAZUH=1 # WAZUH=1
WEBUSER=onionuser@somewhere.invalid # WEBUSER=onionuser@somewhere.invalid
WEBPASSWD1=0n10nus3r # WEBPASSWD1=0n10nus3r
WEBPASSWD2=0n10nus3r # WEBPASSWD2=0n10nus3r

6
setup/so-functions
View File

@@ -1982,9 +1982,9 @@ set_ssh_cmds() {
local automated=$1 local automated=$1
if [ $automated == yes ]; then if [ $automated == yes ]; then
sshcmd='sshpass -p "$SOREMOTEPASS1" ssh -o StrictHostKeyChecking=no' sshcmd="sshpass -p $SOREMOTEPASS1 ssh -o StrictHostKeyChecking=no"
sshcopyidcmd='sshpass -p "$SOREMOTEPASS1" ssh-copy-id -o StrictHostKeyChecking=no' sshcopyidcmd="sshpass -p $SOREMOTEPASS1 ssh-copy-id -o StrictHostKeyChecking=no"
scpcmd='sshpass -p "$SOREMOTEPASS1" scp -o StrictHostKeyChecking=no' scpcmd="sshpass -p $SOREMOTEPASS1 scp -o StrictHostKeyChecking=no"
else else
sshcmd='ssh' sshcmd='ssh'
sshcopyidcmd='ssh-copy-id' sshcopyidcmd='ssh-copy-id'

5
setup/so-setup
View File

@@ -594,6 +594,8 @@ set_redirect >> $setup_log 2>&1
set_progress_str 8 'Initializing Salt minion' set_progress_str 8 'Initializing Salt minion'
configure_minion "$minion_type" >> $setup_log 2>&1 configure_minion "$minion_type" >> $setup_log 2>&1
update_sudoers_for_testing >> $setup_log 2>&1
if [[ $is_manager || $is_helix || $is_import ]]; then if [[ $is_manager || $is_helix || $is_import ]]; then
set_progress_str 9 'Configuring Salt master' set_progress_str 9 'Configuring Salt master'
{ {
@@ -606,7 +608,6 @@ set_redirect >> $setup_log 2>&1
set_progress_str 10 'Updating sudoers file for soremote user' set_progress_str 10 'Updating sudoers file for soremote user'
update_sudoers >> $setup_log 2>&1 update_sudoers >> $setup_log 2>&1
update_sudoers_for_testing >> $setup_log 2>&1
set_progress_str 11 'Generating manager global pillar' set_progress_str 11 'Generating manager global pillar'
#minio_generate_keys #minio_generate_keys
@@ -851,7 +852,7 @@ if [[ -n $SO_ERROR ]]; then
else else
echo "Successfully completed setup! Continuing with post-installation steps" >> $setup_log 2>&1 echo "Successfully completed setup! Continuing with post-installation steps" >> $setup_log 2>&1
{ {
[ -n "$TESTING" ] && logCmd so-test [[ -n "$TESTING" && $is_sensor ]] && logCmd so-test
export percentage=95 # set to last percentage used in previous subshell export percentage=95 # set to last percentage used in previous subshell
if [[ -n $ALLOW_ROLE && -n $ALLOW_CIDR ]]; then if [[ -n $ALLOW_ROLE && -n $ALLOW_CIDR ]]; then