mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
Setup Script - Re-Arrange the order
This commit is contained in:
Mike Reeves
@@ -15,105 +15,10 @@
|
|||||||
# You should have received a copy of the GNU General Public License
|
# You should have received a copy of the GNU General Public License
|
||||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
|
||||||
HOSTNAME=$(cat /etc/hostname)
|
|
||||||
|
|
||||||
# Check for prerequisites
|
|
||||||
if [ "$(id -u)" -ne 0 ]; then
|
|
||||||
echo "This script must be run using sudo!"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if (whiptail --title "Security Onion Setup" --yesno "Are you sure you want to install Security Onion over the internet?" 8 78) then
|
|
||||||
|
|
||||||
# Let folks know they need their management interface already set up.
|
|
||||||
whiptail --title "Security Onion Setup" --msgbox "Since this is a network install we assume the management interface, DNS, Hostname, etc are already set up. You must hit OK to continue." 8 78
|
|
||||||
|
|
||||||
# What kind of install are we doing?
|
|
||||||
INSTALLTYPE=$(whiptail --title "Security Onion Setup" --radiolist \
|
|
||||||
"Choose Install Type:" 20 78 4 \
|
|
||||||
"EVALMODE" "Evaluate all the things" ON \
|
|
||||||
"SENSORONLY" "Sensor join existing grid" OFF \
|
|
||||||
"MASTERONLY" "Start a new grid with no sensor running on it" OFF \
|
|
||||||
"BACKENDNODE" "Add a node to the back end" OFF 3>&1 1>&2 2>&3 )
|
|
||||||
|
|
||||||
# Get list of NICS if it isn't master only
|
|
||||||
if [ $INSTALLTYPE != 'MASTERONLY' ]; then
|
|
||||||
# Another option: cat /proc/net/dev | awk -F: '{print $1}' | grep -v 'lo\|veth\|br\|dock\|Inter\|byte'
|
|
||||||
NICS=$(ip link | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2 " \"" "Interface" "\"" " OFF"}')
|
|
||||||
|
|
||||||
# Pick which interface you want to use as the Management
|
|
||||||
MNIC=$(whiptail --title "NIC Setup" --radiolist "Please select your management NIC" 20 78 12 ${NICS[@]} 3>&1 1>&2 2>&3 )
|
|
||||||
|
|
||||||
# Filter out the management NIC from the monitor NICs
|
|
||||||
FNICS=$(ip link | grep -vw $MNIC | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2 " \"" "Interface" "\"" " OFF"}')
|
|
||||||
BNICS=$(whiptail --title "NIC Setup" --checklist "Please add NICs to the Monitor Interfave" 20 78 12 ${FNICS[@]} 3>&1 1>&2 2>&3 )
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ $INSTALLTYPE == 'SENSORONLY' ]; then
|
|
||||||
|
|
||||||
# Get the master server for the install
|
|
||||||
MASTERSRV=$(whiptail --title "Enter your Master Server IP Address" --inputbox 10 60 1.2.3.4 3>&1 1>&2 2>&3)
|
|
||||||
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Time to get asnwers to questions so we can fill out the pillar file
|
|
||||||
if [ $INSTALLTYPE != 'MASTERONLY' ]; then
|
|
||||||
NIDS=$(whiptail --title "Security Onion Setup" --radiolist \
|
|
||||||
"Choose which IDS to run:" 20 78 4 \
|
|
||||||
"Suricata" "Evaluate all the things" ON 3>&1 1>&2 2>&3 )
|
|
||||||
# Commented out until Snort releases 3.x
|
|
||||||
#"Snort" "Sensor join existing grid" OFF 3>&1 1>&2 2>&3 )
|
|
||||||
|
|
||||||
NSMSETUP=$(whiptail --title "Security Onion Setup" --radiolist \
|
|
||||||
"What type of config would you like to use?:" 20 78 4 \
|
|
||||||
"BASIC" "Install NSM components with recommended settings" ON \
|
|
||||||
"ADVANCED" "Configure each component individually" OFF 3>&1 1>&2 2>&3 )
|
|
||||||
|
|
||||||
if [ $NSMSETUP == 'BASIC' ]; then
|
|
||||||
# Calculate LB_Procs
|
|
||||||
$LBPROCS=some math
|
|
||||||
|
|
||||||
# Calculate Suricata stuff
|
|
||||||
fi
|
|
||||||
if [ $NSMSETUP == 'ADVANCED' ]; then
|
|
||||||
# Ask if this is a VM
|
|
||||||
# Display CPU list for pinning
|
|
||||||
$LBPROCS=Add the pins together that bro is using
|
|
||||||
# Pin steno
|
|
||||||
# Pin Bro
|
|
||||||
# Pin Suricata
|
|
||||||
fi
|
|
||||||
# Ask how many CPUs to use for bro
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ $INSTALLTYPE != 'SENSORONLY' ]; then
|
|
||||||
# Get pulled pork info
|
|
||||||
RULESETUP=$(whiptail --title "Security Onion Setup" --radiolist \
|
|
||||||
"What IDS rules to use?:" 20 78 4 \
|
|
||||||
"ETOPEN" "Emerging Threats Open - no oinkcode required" ON \
|
|
||||||
"ETPRO" "Emerging Threats PRO - requires ETPRO oinkcode" OFF \
|
|
||||||
"TALOSET" "Snort Subscriber (Talos) ruleset and Emerging Threats NoGPL ruleset - requires Snort Subscriber oinkcode" OFF \
|
|
||||||
"TALOS" "Snort Subscriber (Talos) ruleset only and set a Snort Subscriber policy - requires Snort Subscriber oinkcode" OFF 3>&1 1>&2 2>&3 )
|
|
||||||
|
|
||||||
# Get the code if it isn't ET Open
|
|
||||||
if [ $RULESETUP != 'ETOPEN' ]; then
|
|
||||||
# Get the code
|
|
||||||
OINKCODE=$(whiptail --title "Security Onion Setup" --inputbox \
|
|
||||||
"Enter your oinkcode" 10 60 XXXXXXX 3>&1 1>&2 2>&3)
|
|
||||||
fi
|
|
||||||
|
|
||||||
|
|
||||||
fi
|
|
||||||
|
|
||||||
#########################
|
|
||||||
## Do all the things!! ##
|
|
||||||
#########################
|
|
||||||
|
|
||||||
# Global Variable Section
|
# Global Variable Section
|
||||||
|
HOSTNAME=$(cat /etc/hostname)
|
||||||
|
TOTAL_MEM=`grep MemTotal /proc/meminfo | awk '{print $2}' | sed -r 's/.{3}$//'`
|
||||||
|
|
||||||
# Find out the total megarams
|
|
||||||
TOTAL_MEM=`grep MemTotal /proc/meminfo | awk '{print $2}' | sed -r 's/.{3}$//'`
|
|
||||||
|
|
||||||
# End Global Variable Section
|
# End Global Variable Section
|
||||||
|
|
||||||
@@ -237,6 +142,107 @@ update_sudoers () {
|
|||||||
|
|
||||||
}
|
}
|
||||||
# End Functions
|
# End Functions
|
||||||
|
|
||||||
|
# Check for prerequisites
|
||||||
|
if [ "$(id -u)" -ne 0 ]; then
|
||||||
|
echo "This script must be run using sudo!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if (whiptail --title "Security Onion Setup" --yesno "Are you sure you want to install Security Onion over the internet?" 8 78) then
|
||||||
|
|
||||||
|
# Let folks know they need their management interface already set up.
|
||||||
|
whiptail --title "Security Onion Setup" --msgbox "Since this is a network install we assume the management interface, DNS, Hostname, etc are already set up. You must hit OK to continue." 8 78
|
||||||
|
|
||||||
|
# What kind of install are we doing?
|
||||||
|
INSTALLTYPE=$(whiptail --title "Security Onion Setup" --radiolist \
|
||||||
|
"Choose Install Type:" 20 78 4 \
|
||||||
|
"EVALMODE" "Evaluate all the things" ON \
|
||||||
|
"SENSORONLY" "Sensor join existing grid" OFF \
|
||||||
|
"MASTERONLY" "Start a new grid with no sensor running on it" OFF \
|
||||||
|
"BACKENDNODE" "Add a node to the back end" OFF 3>&1 1>&2 2>&3 )
|
||||||
|
|
||||||
|
# Get list of NICS if it isn't master only
|
||||||
|
if [ $INSTALLTYPE != 'MASTERONLY' ]; then
|
||||||
|
# Another option: cat /proc/net/dev | awk -F: '{print $1}' | grep -v 'lo\|veth\|br\|dock\|Inter\|byte'
|
||||||
|
NICS=$(ip link | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2 " \"" "Interface" "\"" " OFF"}')
|
||||||
|
|
||||||
|
# Pick which interface you want to use as the Management
|
||||||
|
MNIC=$(whiptail --title "NIC Setup" --radiolist "Please select your management NIC" 20 78 12 ${NICS[@]} 3>&1 1>&2 2>&3 )
|
||||||
|
|
||||||
|
# Filter out the management NIC from the monitor NICs
|
||||||
|
FNICS=$(ip link | grep -vw $MNIC | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2 " \"" "Interface" "\"" " OFF"}')
|
||||||
|
BNICS=$(whiptail --title "NIC Setup" --checklist "Please add NICs to the Monitor Interfave" 20 78 12 ${FNICS[@]} 3>&1 1>&2 2>&3 )
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ $INSTALLTYPE == 'SENSORONLY' ]; then
|
||||||
|
|
||||||
|
# Get the master server for the install
|
||||||
|
MASTERSRV=$(whiptail --title "Enter your Master Server IP Address" --inputbox 10 60 1.2.3.4 3>&1 1>&2 2>&3)
|
||||||
|
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Time to get asnwers to questions so we can fill out the pillar file
|
||||||
|
if [ $INSTALLTYPE != 'MASTERONLY' ]; then
|
||||||
|
NIDS=$(whiptail --title "Security Onion Setup" --radiolist \
|
||||||
|
"Choose which IDS to run:" 20 78 4 \
|
||||||
|
"Suricata" "Evaluate all the things" ON 3>&1 1>&2 2>&3 )
|
||||||
|
# Commented out until Snort releases 3.x
|
||||||
|
#"Snort" "Sensor join existing grid" OFF 3>&1 1>&2 2>&3 )
|
||||||
|
|
||||||
|
NSMSETUP=$(whiptail --title "Security Onion Setup" --radiolist \
|
||||||
|
"What type of config would you like to use?:" 20 78 4 \
|
||||||
|
"BASIC" "Install NSM components with recommended settings" ON \
|
||||||
|
"ADVANCED" "Configure each component individually" OFF 3>&1 1>&2 2>&3 )
|
||||||
|
|
||||||
|
if [ $NSMSETUP == 'BASIC' ]; then
|
||||||
|
# Calculate LB_Procs
|
||||||
|
$LBPROCS=some math
|
||||||
|
|
||||||
|
# Calculate Suricata stuff
|
||||||
|
fi
|
||||||
|
if [ $NSMSETUP == 'ADVANCED' ]; then
|
||||||
|
# Ask if this is a VM
|
||||||
|
# Display CPU list for pinning
|
||||||
|
$LBPROCS=Add the pins together that bro is using
|
||||||
|
# Pin steno
|
||||||
|
# Pin Bro
|
||||||
|
# Pin Suricata
|
||||||
|
fi
|
||||||
|
# Ask how many CPUs to use for bro
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ $INSTALLTYPE != 'SENSORONLY' ]; then
|
||||||
|
# Get pulled pork info
|
||||||
|
RULESETUP=$(whiptail --title "Security Onion Setup" --radiolist \
|
||||||
|
"What IDS rules to use?:" 20 78 4 \
|
||||||
|
"ETOPEN" "Emerging Threats Open - no oinkcode required" ON \
|
||||||
|
"ETPRO" "Emerging Threats PRO - requires ETPRO oinkcode" OFF \
|
||||||
|
"TALOSET" "Snort Subscriber (Talos) ruleset and Emerging Threats NoGPL ruleset - requires Snort Subscriber oinkcode" OFF \
|
||||||
|
"TALOS" "Snort Subscriber (Talos) ruleset only and set a Snort Subscriber policy - requires Snort Subscriber oinkcode" OFF 3>&1 1>&2 2>&3 )
|
||||||
|
|
||||||
|
# Get the code if it isn't ET Open
|
||||||
|
if [ $RULESETUP != 'ETOPEN' ]; then
|
||||||
|
# Get the code
|
||||||
|
OINKCODE=$(whiptail --title "Security Onion Setup" --inputbox \
|
||||||
|
"Enter your oinkcode" 10 60 XXXXXXX 3>&1 1>&2 2>&3)
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
fi
|
||||||
|
|
||||||
|
#########################
|
||||||
|
## Do all the things!! ##
|
||||||
|
#########################
|
||||||
|
|
||||||
|
# Global Variable Section
|
||||||
|
|
||||||
|
# Find out the total megarams
|
||||||
|
TOTAL_MEM=`grep MemTotal /proc/meminfo | awk '{print $2}' | sed -r 's/.{3}$//'`
|
||||||
|
|
||||||
|
# End Global Variable Section
|
||||||
|
|
||||||
|
|
||||||
# Copy over the SSH key
|
# Copy over the SSH key
|
||||||
if [ $INSTALLTYPE == 'SENSORONLY' ] || [ $INSTALLTYPE == 'BACKENDNODE' ]; then
|
if [ $INSTALLTYPE == 'SENSORONLY' ] || [ $INSTALLTYPE == 'BACKENDNODE' ]; then
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user