CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-14 05:02:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

[refactor] Start using lower case for variables

Browse Source
This commit is contained in:
William Wernert
2020-04-18 18:48:47 -04:00
parent ce59019967
commit 5c3a56a289
3 changed files with 1019 additions and 1098 deletions
Download Patch File Download Diff File Expand all files Collapse all files

295
setup/so-functions
View File

@@ -109,12 +109,8 @@ wait_for_file() {
return 1 return 1
} }
wait_for_identity_db_to_exist() {
return "$(wait_for_file /opt/so/conf/kratos/db/db.sqlite 30 5)"
}
add_web_user() { add_web_user() {
wait_for_identity_db_to_exist wait_for_file /opt/so/conf/kratos/db/db.sqlite 30 5
echo "Attempting to add administrator user for web interface..." echo "Attempting to add administrator user for web interface..."
echo "$WEBPASSWD1" | /usr/sbin/so-user add "$WEBUSER" echo "$WEBPASSWD1" | /usr/sbin/so-user add "$WEBUSER"
echo "Add user result: $?" echo "Add user result: $?"
@@ -123,7 +119,7 @@ add_web_user() {
# Create an secrets pillar so that passwords survive re-install # Create an secrets pillar so that passwords survive re-install
secrets_pillar(){ secrets_pillar(){
if [ ! -f /opt/so/saltstack/pillar/secrets.sls ]; then if [ ! -f /opt/so/saltstack/pillar/secrets.sls ]; then
echo "Creating Secrets Pillar" >> "$SETUPLOG" 2>&1 echo "Creating Secrets Pillar" >> "$setup_log" 2>&1
mkdir -p /opt/so/saltstack/pillar mkdir -p /opt/so/saltstack/pillar
printf '%s\n'\ printf '%s\n'\
"secrets:"\ "secrets:"\
@@ -136,9 +132,9 @@ secrets_pillar(){
# Enable Bro Logs # Enable Bro Logs
bro_logs_enabled() { bro_logs_enabled() {
echo "Enabling Bro Logs" >> "$SETUPLOG" 2>&1 echo "Enabling Bro Logs" >> "$setup_log" 2>&1
local brologs_pillar="$SCRIPTDIR/pillar/brologs.sls" local brologs_pillar="$./pillar/brologs.sls"
printf '%s\n'\ printf '%s\n'\
"brologs:"\ "brologs:"\
@@ -230,16 +226,16 @@ check_network_manager_conf() {
mv "$gmdconf" "${gmdconf}.bak" mv "$gmdconf" "${gmdconf}.bak"
touch "$gmdconf" touch "$gmdconf"
systemctl restart NetworkManager systemctl restart NetworkManager
} >> "$SETUPLOG" 2>&1 } >> "$setup_log" 2>&1
fi fi
fi fi
if test -f "$nmconf"; then if test -f "$nmconf"; then
sed -i 's/managed=false/managed=true/g' "$nmconf" >> "$SETUPLOG" 2>&1 sed -i 's/managed=false/managed=true/g' "$nmconf" >> "$setup_log" 2>&1
fi fi
if [[ ! -d "$preupdir" ]]; then if [[ ! -d "$preupdir" ]]; then
mkdir "$preupdir" >> "$SETUPLOG" 2>&1 mkdir "$preupdir" >> "$setup_log" 2>&1
fi fi
} }
@@ -266,23 +262,11 @@ check_web_pass() {
check_pass_match "$WEBPASSWD1" "$WEBPASSWD2" "WPMATCH" check_pass_match "$WEBPASSWD1" "$WEBPASSWD2" "WPMATCH"
} }
checkin_at_boot() {
echo "Enabling checkin at boot" >> "$SETUPLOG" 2>&1
echo "startup_states: highstate" >> /etc/salt/minion
}
chown_salt_master() {
echo "Chown the salt dirs on the master for socore" >> "$SETUPLOG" 2>&1
chown -R socore:socore /opt/so
}
clear_master() { clear_master() {
# Clear out the old master public key in case this is a re-install. # Clear out the old master public key in case this is a re-install.
# This only happens if you re-install the master. # This only happens if you re-install the master.
if [ -f /etc/salt/pki/minion/minion_master.pub ]; then if [ -f /etc/salt/pki/minion/minion_master.pub ]; then
echo "Clearing old master key" >> "$SETUPLOG" 2>&1 echo "Clearing old master key" >> "$setup_log" 2>&1
rm /etc/salt/pki/minion/minion_master.pub rm /etc/salt/pki/minion/minion_master.pub
service salt-minion restart service salt-minion restart
fi fi
@@ -313,17 +297,17 @@ collect_webuser_inputs() {
done done
} }
# $1 => install type # $1 => minion type
configure_minion() { configure_minion() {
local TYPE=$1 local minion_type=$1
echo "Configuring minion type as $TYPE" >> "$SETUPLOG" 2>&1 echo "Configuring minion type as $minion_type" >> "$setup_log" 2>&1
echo "role: so-$TYPE" > /etc/salt/grains echo "role: so-$minion_type" > /etc/salt/grains
local minion_config=/etc/salt/minion local minion_config=/etc/salt/minion
echo "id: $MINION_ID" > "$minion_config" echo "id: $MINION_ID" > "$minion_config"
case "$TYPE" in case "$minion_type" in
'helix') 'helix')
echo "master: $HOSTNAME" >> "$minion_config" echo "master: $HOSTNAME" >> "$minion_config"
;; ;;
@@ -347,10 +331,12 @@ configure_minion() {
printf '%s\n'\ printf '%s\n'\
"use_superseded:"\ "use_superseded:"\
" - module.run" >> /etc/salt/minion " - module.run" >> "$minion_config"
service salt-minion restart service salt-minion restart
echo "Enabling checkin at boot" >> "$setup_log" 2>&1
echo "startup_states: highstate" >> "$minion_config"
} }
copy_master_config() { copy_master_config() {
@@ -359,32 +345,31 @@ copy_master_config() {
if [ "$INSTALLMETHOD" = 'iso' ]; then if [ "$INSTALLMETHOD" = 'iso' ]; then
cp /root/SecurityOnion/files/master /etc/salt/master cp /root/SecurityOnion/files/master /etc/salt/master
else else
cp "$SCRIPTDIR"/../files/master /etc/salt/master cp "../files/master" /etc/salt/master
fi fi
# Restart the service so it picks up the changes -TODO Enable service on CentOS # Restart the service so it picks up the changes
service salt-master restart systemctl restart salt-master
} }
copy_minion_tmp_files() { copy_minion_tmp_files() {
case "$INSTALLTYPE" in case "$install_type" in
'MASTER' | 'EVAL' | 'HELIXSENSOR' | 'MASTERSEARCH') 'MASTER' | 'EVAL' | 'HELIXSENSOR' | 'MASTERSEARCH')
echo "Copying pillar and salt files in $TMP to /opt/so/saltstack" echo "Copying pillar and salt files in $temp_install_dir to /opt/so/saltstack"
cp -Rv "$TMP"/pillar/ /opt/so/saltstack/ >> "$SETUPLOG" 2>&1 cp -Rv "$temp_install_dir"/pillar/ /opt/so/saltstack/ >> "$setup_log" 2>&1
if [ -d "$TMP"/salt ] ; then if [ -d "$temp_install_dir"/salt ] ; then
cp -Rv "$TMP"/salt/ /opt/so/saltstack/ >> "$SETUPLOG" 2>&1 cp -Rv "$temp_install_dir"/salt/ /opt/so/saltstack/ >> "$setup_log" 2>&1
fi fi
;; ;;
*) *)
{ {
echo "scp pillar and salt files in $TMP to master /opt/so/saltstack"; echo "scp pillar and salt files in $temp_install_dir to master /opt/so/saltstack";
ssh -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/pillar; ssh -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/pillar;
ssh -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/schedules; ssh -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/schedules;
scp -prv -i /root/.ssh/so.key "$TMP"/pillar/minions/* soremote@"$MSRV":/tmp/"$MINION_ID"/pillar/; scp -prv -i /root/.ssh/so.key "$temp_install_dir"/pillar/minions/* soremote@"$MSRV":/tmp/"$MINION_ID"/pillar/;
scp -prv -i /root/.ssh/so.key "$TMP"/salt/patch/os/schedules/* soremote@"$MSRV":/tmp/"$MINION_ID"/schedules; scp -prv -i /root/.ssh/so.key "$temp_install_dir"/salt/patch/os/schedules/* soremote@"$MSRV":/tmp/"$MINION_ID"/schedules;
ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/salt/master/files/add_minion.sh "$MINION_ID"; ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/salt/master/files/add_minion.sh "$MINION_ID";
} >> "$SETUPLOG" 2>&1 } >> "$setup_log" 2>&1
;; ;;
esac esac
} }
@@ -403,11 +388,11 @@ copy_ssh_key() {
create_sensor_bond() { create_sensor_bond() {
echo "Setting up sensor bond" >> "$SETUPLOG" 2>&1 echo "Setting up sensor bond" >> "$setup_log" 2>&1
local nic_error=0 local nic_error=0
check_network_manager_conf >> "$SETUPLOG" 2>&1 check_network_manager_conf >> "$setup_log" 2>&1
# Set the MTU # Set the MTU
if [[ $NSMSETUP != 'ADVANCED' ]]; then if [[ $NSMSETUP != 'ADVANCED' ]]; then
@@ -420,7 +405,7 @@ create_sensor_bond() {
ipv4.method disabled \ ipv4.method disabled \
ipv6.method ignore \ ipv6.method ignore \
ethernet.mtu $MTU \ ethernet.mtu $MTU \
connection.autoconnect "yes" >> "$SETUPLOG" 2>&1 connection.autoconnect "yes" >> "$setup_log" 2>&1
fi fi
@@ -430,7 +415,7 @@ create_sensor_bond() {
# Check if specific offload features are able to be disabled # Check if specific offload features are able to be disabled
for string in "generic-segmentation-offload" "generic-receive-offload" "tcp-segmentation-offload"; do for string in "generic-segmentation-offload" "generic-receive-offload" "tcp-segmentation-offload"; do
if ethtool -k "$BONDNIC" | grep $string | grep -q "on [fixed]"; then if ethtool -k "$BONDNIC" | grep $string | grep -q "on [fixed]"; then
echo "The hardware or driver for interface ${BONDNIC} is not supported, packet capture may not work as expected." >> "$SETUPLOG" 2>&1 echo "The hardware or driver for interface ${BONDNIC} is not supported, packet capture may not work as expected." >> "$setup_log" 2>&1
nic_error=1 nic_error=1
break break
fi fi
@@ -438,7 +423,7 @@ create_sensor_bond() {
# Turn off various offloading settings for the interface # Turn off various offloading settings for the interface
for i in rx tx sg tso ufo gso gro lro; do for i in rx tx sg tso ufo gso gro lro; do
ethtool -K "$BONDNIC" $i off >> "$SETUPLOG" 2>&1 ethtool -K "$BONDNIC" $i off >> "$setup_log" 2>&1
done done
# Check if the bond slave connection has already been created # Check if the bond slave connection has already been created
@@ -446,10 +431,10 @@ create_sensor_bond() {
# Create the slave interface and assign it to the bond # Create the slave interface and assign it to the bond
nmcli con add type ethernet ifname "$BONDNIC" con-name "bond0-slave-$BONDNIC" master bond0 -- \ nmcli con add type ethernet ifname "$BONDNIC" con-name "bond0-slave-$BONDNIC" master bond0 -- \
ethernet.mtu $MTU \ ethernet.mtu $MTU \
connection.autoconnect "yes" >> "$SETUPLOG" 2>&1 connection.autoconnect "yes" >> "$setup_log" 2>&1
fi fi
nmcli con up "bond0-slave-$BONDNIC" >> "$SETUPLOG" 2>&1 # Bring the slave interface up nmcli con up "bond0-slave-$BONDNIC" >> "$setup_log" 2>&1 # Bring the slave interface up
done done
if [ $nic_error != 0 ]; then if [ $nic_error != 0 ]; then
@@ -457,11 +442,11 @@ create_sensor_bond() {
fi fi
} }
# keep ">> $SETUPLOG" syntax # keep ">> $setup_log" syntax
detect_os() { detect_os() {
# Detect Base OS # Detect Base OS
echo "Detecting Base OS" >> "$SETUPLOG" 2>&1 echo "Detecting Base OS" >> "$setup_log" 2>&1
if [ -f /etc/redhat-release ]; then if [ -f /etc/redhat-release ]; then
OS=centos OS=centos
if grep -q "CentOS Linux release 7" /etc/redhat-release; then if grep -q "CentOS Linux release 7" /etc/redhat-release; then
@@ -476,7 +461,7 @@ detect_os() {
fi fi
# Install bind-utils so the host command exists # Install bind-utils so the host command exists
yum -y install bind-utils >> "$SETUPLOG" 2>&1 yum -y install bind-utils >> "$setup_log" 2>&1
elif [ -f /etc/os-release ]; then elif [ -f /etc/os-release ]; then
@@ -494,14 +479,14 @@ detect_os() {
apt-get install -y network-manager; apt-get install -y network-manager;
systemctl enable NetworkManager; systemctl enable NetworkManager;
systemctl start NetworkManager; systemctl start NetworkManager;
} >> "$SETUPLOG" 2<&1 } >> "$setup_log" 2<&1
else else
echo "We were unable to determine if you are using a supported OS." echo "We were unable to determine if you are using a supported OS."
exit 1 exit 1
fi fi
echo "Found OS: $OS $OSVER" >> "$SETUPLOG" 2>&1 echo "Found OS: $OS $OSVER" >> "$setup_log" 2>&1
} }
@@ -511,15 +496,15 @@ disable_onion_user() {
} }
disable_misc_network_features() { disable_misc_network_features() {
for UNUSED_NIC in "${FNICS[@]}"; do for unused_nic in "${filtered_nics[@]}"; do
# Disable DHCPv4/v6 and autoconnect # Disable DHCPv4/v6 and autoconnect
nmcli con mod "$UNUSED_NIC" \ nmcli con mod "$unused_nic" \
ipv4.method disabled \ ipv4.method disabled \
ipv6.method ignore \ ipv6.method ignore \
connection.autoconnect "no" >> "$SETUPLOG" 2>&1 connection.autoconnect "no" >> "$setup_log" 2>&1
# Flush any existing IPs # Flush any existing IPs
ip addr flush "$UNUSED_NIC" >> "$SETUPLOG" 2>&1 ip addr flush "$unused_nic" >> "$setup_log" 2>&1
done done
# Disable IPv6 # Disable IPv6
{ {
@@ -537,23 +522,23 @@ docker_install() {
yum -y update yum -y update
yum -y install docker-ce yum -y install docker-ce
else else
case "$INSTALLTYPE" in case "$install_type" in
'MASTER' | 'EVAL') 'MASTER' | 'EVAL')
apt-get update >> "$SETUPLOG" 2>&1 apt-get update >> "$setup_log" 2>&1
;; ;;
*) *)
{ {
apt-key add "$TMP"/gpg/docker.pub; apt-key add "$temp_install_dir"/gpg/docker.pub;
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"; add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable";
apt-get update; apt-get update;
} >> "$SETUPLOG" 2>&1 } >> "$setup_log" 2>&1
;; ;;
esac esac
if [ $OSVER != "xenial" ]; then if [ $OSVER != "xenial" ]; then
apt-get -y install docker-ce python3-docker >> "$SETUPLOG" 2>&1 apt-get -y install docker-ce python3-docker >> "$setup_log" 2>&1
else else
apt-get -y install docker-ce python-docker >> "$SETUPLOG" 2>&1 apt-get -y install docker-ce python-docker >> "$setup_log" 2>&1
fi fi
fi fi
docker_registry docker_registry
@@ -561,23 +546,23 @@ docker_install() {
echo "Restarting Docker"; echo "Restarting Docker";
systemctl restart docker; systemctl restart docker;
systemctl enable docker; systemctl enable docker;
} >> "$SETUPLOG" 2>&1 } >> "$setup_log" 2>&1
} }
docker_registry() { docker_registry() {
echo "Setting up Docker Registry" >> "$SETUPLOG" 2>&1 echo "Setting up Docker Registry" >> "$setup_log" 2>&1
mkdir -p /etc/docker >> "$SETUPLOG" 2>&1 mkdir -p /etc/docker >> "$setup_log" 2>&1
# Make the host use the master docker registry # Make the host use the master docker registry
printf '%s\n'\ printf '%s\n'\
"{"\ "{"\
" \"registry-mirrors\": [\"https://$MSRV:5000\"]"\ " \"registry-mirrors\": [\"https://$MSRV:5000\"]"\
"}" > /etc/docker/daemon.json "}" > /etc/docker/daemon.json
echo "Docker Registry Setup - Complete" >> "$SETUPLOG" 2>&1 echo "Docker Registry Setup - Complete" >> "$setup_log" 2>&1
} }
docker_seed_registry() { docker_seed_registry() {
local VERSION="HH$SOVERSION" local VERSION="HH$so_version"
if [ ! -f /nsm/docker-registry/docker/so-dockers-"$VERSION".tar ]; then if [ ! -f /nsm/docker-registry/docker/so-dockers-"$VERSION".tar ]; then
local TRUSTED_CONTAINERS=(\ local TRUSTED_CONTAINERS=(\
@@ -591,7 +576,7 @@ docker_seed_registry() {
"so-telegraf:$VERSION" \ "so-telegraf:$VERSION" \
"so-zeek:$VERSION" "so-zeek:$VERSION"
) )
if [ "$INSTALLTYPE" != 'HELIXSENSOR' ]; then if [ "$install_type" != 'HELIXSENSOR' ]; then
TRUSTED_CONTAINERS=("${TRUSTED_CONTAINERS[@]}" \ TRUSTED_CONTAINERS=("${TRUSTED_CONTAINERS[@]}" \
"so-acng:$VERSION" \ "so-acng:$VERSION" \
"so-thehive-cortex:$VERSION" \ "so-thehive-cortex:$VERSION" \
@@ -636,34 +621,19 @@ docker_seed_registry() {
es_heapsize() { es_heapsize() {
# Determine ES Heap Size # Determine ES Heap Size
if [ "$TOTAL_MEM" -lt 8000 ] ; then if [ "$total_mem" -lt 8000 ] ; then
ES_HEAP_SIZE="600m" ES_HEAP_SIZE="600m"
elif [ "$TOTAL_MEM" -ge 100000 ]; then elif [ "$total_mem" -ge 100000 ]; then
# Set a max of 25GB for heap size # Set a max of 25GB for heap size
# https://www.elastic.co/guide/en/elasticsearch/guide/current/heap-sizing.html # https://www.elastic.co/guide/en/elasticsearch/guide/current/heap-sizing.html
ES_HEAP_SIZE="25000m" ES_HEAP_SIZE="25000m"
else else
# Set heap size to 25% of available memory # Set heap size to 25% of available memory
ES_HEAP_SIZE=$(( TOTAL_MEM / 4 ))"m" ES_HEAP_SIZE=$(( total_mem / 4 ))"m"
fi fi
} }
filter_unused_nics() {
# Set the main NIC as the default grep search string
local grep_string="$MNIC"
# If we call this function and NICs have already been assigned to the bond interface then add them to the grep search string
if [[ $BNICS ]]; then
for BONDNIC in "${BNICS[@]}"; do
grep_string="$grep_string\|$BONDNIC"
done
fi
# Finally, set FNICS to any NICs we aren't using (and ignore interfaces that aren't of use)
FNICS=$(ip link | grep -vwe "$grep_string" | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2}')
}
fireeye_pillar() { fireeye_pillar() {
local fireeye_pillar_path=/opt/so/saltstack/pillar/fireeye local fireeye_pillar_path=/opt/so/saltstack/pillar/fireeye
@@ -679,7 +649,7 @@ fireeye_pillar() {
fleet_pillar() { fleet_pillar() {
local pillar_file="$TMP"/pillar/minions/"$MINION_ID".sls local pillar_file="$temp_install_dir"/pillar/minions/"$MINION_ID".sls
# Create the fleet pillar # Create the fleet pillar
printf '%s\n'\ printf '%s\n'\
@@ -701,10 +671,6 @@ generate_passwords(){
KRATOSKEY=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1) KRATOSKEY=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1)
} }
get_filesystem_nsm(){
FSNSM=$(df /nsm | awk '$3 ~ /[0-9]+/ { print $2 * 1000 }')
}
get_log_size_limit() { get_log_size_limit() {
local DISK_DIR="/" local DISK_DIR="/"
@@ -718,11 +684,6 @@ get_log_size_limit() {
LOG_SIZE_LIMIT=$(( PERCENTAGE_DISK_SPACE / 1000000000 )) LOG_SIZE_LIMIT=$(( PERCENTAGE_DISK_SPACE / 1000000000 ))
} }
get_filesystem_root(){
FSROOT=$(df / | awk '$3 ~ /[0-9]+/ { print $2 * 1000 }')
}
get_main_ip() { get_main_ip() {
# Get the main IP address the box is using # Get the main IP address the box is using
@@ -760,18 +721,10 @@ got_root() {
install_cleanup() { install_cleanup() {
echo "Installer removing the following files:" echo "Installer removing the following files:"
ls -lR "$TMP" ls -lR "$temp_install_dir"
# Clean up after ourselves # Clean up after ourselves
rm -rf "$TMP" rm -rf "$temp_install_dir"
}
install_prep() {
# Create a tmp space that isn't in /tmp
mkdir -p /root/installtmp/pillar/minions
TMP=/root/installtmp
} }
@@ -815,7 +768,7 @@ ls_heapsize() {
master_pillar() { master_pillar() {
local pillar_file=$TMP/pillar/minions/$MINION_ID.sls local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls
# Create the master pillar # Create the master pillar
printf '%s\n'\ printf '%s\n'\
@@ -826,7 +779,7 @@ master_pillar() {
" freq: 0"\ " freq: 0"\
" domainstats: 0" >> "$pillar_file" " domainstats: 0" >> "$pillar_file"
if [ "$INSTALLTYPE" = 'EVAL' ] || [ "$INSTALLTYPE" = 'HELIXSENSOR' ] || [ "$INSTALLTYPE" = 'MASTERSEARCH' ]; then if [ "$install_type" = 'EVAL' ] || [ "$install_type" = 'HELIXSENSOR' ] || [ "$install_type" = 'MASTERSEARCH' ]; then
printf '%s\n'\ printf '%s\n'\
" ls_pipeline_batch_size: 125"\ " ls_pipeline_batch_size: 125"\
" ls_input_threads: 1"\ " ls_input_threads: 1"\
@@ -840,8 +793,8 @@ master_pillar() {
" ls_pipeline_workers: $CPUCORES"\ " ls_pipeline_workers: $CPUCORES"\
" nids_rules: $RULESETUP"\ " nids_rules: $RULESETUP"\
" oinkcode: $OINKCODE"\ " oinkcode: $OINKCODE"\
" es_port: $NODE_ES_PORT"\ " es_port: $node_es_port"\
" log_size_limit: $LOG_SIZE_LIMIT"\ " log_size_limit: $log_size_limit"\
" cur_close_days: $CURCLOSEDAYS"\ " cur_close_days: $CURCLOSEDAYS"\
" grafana: $GRAFANA"\ " grafana: $GRAFANA"\
" osquery: $OSQUERY"\ " osquery: $OSQUERY"\
@@ -860,7 +813,7 @@ master_pillar() {
REDIRECTIT=$HOSTNAME REDIRECTIT=$HOSTNAME
;; ;;
*) *)
REDIRECTIT="$REDIRECT" REDIRECTIT="$REDIRECTHOST"
;; ;;
esac esac
@@ -878,7 +831,7 @@ master_static() {
# Create a static file for global values # Create a static file for global values
printf '%s\n'\ printf '%s\n'\
"static:"\ "static:"\
" soversion: HH$SOVERSION"\ " soversion: HH$so_version"\
" hnmaster: $HNMASTER"\ " hnmaster: $HNMASTER"\
" ntpserver: $NTPSERVER"\ " ntpserver: $NTPSERVER"\
" proxy: $PROXY"\ " proxy: $PROXY"\
@@ -930,16 +883,16 @@ network_setup() {
fi fi
echo "... Copying 99-so-checksum-offload-disable"; echo "... Copying 99-so-checksum-offload-disable";
cp "$SCRIPTDIR/install_scripts/99-so-checksum-offload-disable" /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable ; cp "$./install_scripts/99-so-checksum-offload-disable" /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable ;
echo "... Modifying 99-so-checksum-offload-disable"; echo "... Modifying 99-so-checksum-offload-disable";
sed -i "s/\$MAININT/${MAININT}/g" /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable; sed -i "s/\$MAININT/${MAININT}/g" /etc/NetworkManager/dispatcher.d/pre-up.d/99-so-checksum-offload-disable;
} >> "$SETUPLOG" 2>&1 } >> "$setup_log" 2>&1
} }
node_pillar() { node_pillar() {
local pillar_file=$TMP/pillar/minions/$MINION_ID.sls local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls
# Create the node pillar # Create the node pillar
printf '%s\n'\ printf '%s\n'\
@@ -955,8 +908,8 @@ node_pillar() {
" ls_batch_count: $LSINPUTBATCHCOUNT"\ " ls_batch_count: $LSINPUTBATCHCOUNT"\
" es_shard_count: $SHARDCOUNT"\ " es_shard_count: $SHARDCOUNT"\
" node_type: $NODETYPE"\ " node_type: $NODETYPE"\
" es_port: $NODE_ES_PORT"\ " es_port: $node_es_port"\
" log_size_limit: $LOG_SIZE_LIMIT"\ " log_size_limit: $log_size_limit"\
" cur_close_days: $CURCLOSEDAYS"\ " cur_close_days: $CURCLOSEDAYS"\
"" >> "$pillar_file" "" >> "$pillar_file"
@@ -964,7 +917,7 @@ node_pillar() {
patch_pillar() { patch_pillar() {
local pillar_file=$TMP/pillar/minions/$MINION_ID.sls local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls
printf '%s\n'\ printf '%s\n'\
""\ ""\
@@ -978,7 +931,7 @@ patch_pillar() {
} }
patch_schedule_os_new() { patch_schedule_os_new() {
local OSPATCHSCHEDULEDIR="$TMP/salt/patch/os/schedules" local OSPATCHSCHEDULEDIR="$temp_install_dir/salt/patch/os/schedules"
local OSPATCHSCHEDULE="$OSPATCHSCHEDULEDIR/$PATCHSCHEDULENAME.yml" local OSPATCHSCHEDULE="$OSPATCHSCHEDULEDIR/$PATCHSCHEDULENAME.yml"
mkdir -p $OSPATCHSCHEDULEDIR mkdir -p $OSPATCHSCHEDULEDIR
@@ -1018,7 +971,7 @@ saltify() {
# Install updates and Salt # Install updates and Salt
if [ $OS = 'centos' ]; then if [ $OS = 'centos' ]; then
case "$INSTALLTYPE" in case "$install_type" in
'MASTER' | 'EVAL' | 'MASTERSEARCH' | 'FLEET') # FIXME: should this be separate? 'MASTER' | 'EVAL' | 'MASTERSEARCH' | 'FLEET') # FIXME: should this be separate?
yum instal -y mariadb-devel yum instal -y mariadb-devel
;; ;;
@@ -1034,21 +987,21 @@ saltify() {
wget --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.saltstack.com/apt/ubuntu/16.04/amd64/latest/SALTSTACK-GPG-KEY.pub wget --inet4-only -O /opt/so/gpg/SALTSTACK-GPG-KEY.pub https://repo.saltstack.com/apt/ubuntu/16.04/amd64/latest/SALTSTACK-GPG-KEY.pub
wget --inet4-only -O /opt/so/gpg/docker.pub https://download.docker.com/linux/ubuntu/gpg wget --inet4-only -O /opt/so/gpg/docker.pub https://download.docker.com/linux/ubuntu/gpg
wget --inet4-only -O /opt/so/gpg/GPG-KEY-WAZUH https://packages.wazuh.com/key/GPG-KEY-WAZUH wget --inet4-only -O /opt/so/gpg/GPG-KEY-WAZUH https://packages.wazuh.com/key/GPG-KEY-WAZUH
cp "$SCRIPTDIR/yum_repos/wazuh.repo" /etc/yum.repos.d/wazuh.repo cp "$./yum_repos/wazuh.repo" /etc/yum.repos.d/wazuh.repo
yum -y install salt-master-2019.2.3 yum -y install salt-master-2019.2.3
systemctl enable salt-master systemctl enable salt-master
;; ;;
*) *)
if [ "$MASTERUPDATES" -eq 1 ]; then if [ "$MASTERUPDATES" -eq 1 ]; then
# Create the GPG Public Key for the Salt Repo # Create the GPG Public Key for the Salt Repo
cp "$SCRIPTDIR"/public_keys/salt.pem /etc/pki/rpm-gpg/saltstack-signing-key cp "$./public_keys/salt.pem" /etc/pki/rpm-gpg/saltstack-signing-key
# Add the Wazuh Key # Add the Wazuh Key
cp "$SCRIPTDIR"/public_keys/wazuh.pem /etc/pki/rpm-gpg/GPG-KEY-WAZUH cp "$./public_keys/wazuh.pem" /etc/pki/rpm-gpg/GPG-KEY-WAZUH
# Copy repo files over # Copy repo files over
cp "$SCRIPTDIR"/yum_repos/salt-latest.repo /etc/yum.repos.d/salt-latest.repo cp "$./yum_repos/salt-latest.repo" /etc/yum.repos.d/salt-latest.repo
cp "$SCRIPTDIR"/yum_repos/salt-2019-2.repo /etc/yum.repos.d/salt-2019-2.repo cp "$./yum_repos/salt-2019-2.repo" /etc/yum.repos.d/salt-2019-2.repo
else else
yum -y install https://repo.saltstack.com/py3/redhat/salt-py3-repo-latest-2.el7.noarch.rpm yum -y install https://repo.saltstack.com/py3/redhat/salt-py3-repo-latest-2.el7.noarch.rpm
cp /etc/yum.repos.d/salt-py3-latest.repo /etc/yum.repos.d/salt-2019-2.repo cp /etc/yum.repos.d/salt-py3-latest.repo /etc/yum.repos.d/salt-2019-2.repo
@@ -1056,7 +1009,7 @@ saltify() {
fi fi
;; ;;
esac esac
cp "$SCRIPTDIR/yum_repos/wazuh.repo" /etc/yum.repos.d/wazuh.repo cp "$./yum_repos/wazuh.repo" /etc/yum.repos.d/wazuh.repo
yum clean expire-cache yum clean expire-cache
yum -y install epel-release\ yum -y install epel-release\
salt-minion-2019.2.3\ salt-minion-2019.2.3\
@@ -1086,15 +1039,15 @@ saltify() {
software-properties-common\ software-properties-common\
apt-transport-https\ apt-transport-https\
openssl\ openssl\
jq >> "$SETUPLOG" 2>&1 jq >> "$setup_log" 2>&1
# Grab the version from the os-release file # Grab the version from the os-release file
local ubuntu_version local ubuntu_version
ubuntu_version=$(grep VERSION_ID /etc/os-release | awk -F '[ "]' '{print $2}') ubuntu_version=$(grep VERSION_ID /etc/os-release | awk -F '[ "]' '{print $2}')
case "$INSTALLTYPE" in case "$install_type" in
'FLEET') 'FLEET')
if [ "$OSVER" != 'xenial' ]; then apt-get -y install python3-mysqldb >> "$SETUPLOG" 2>&1; else apt-get -y install python-mysqldb >> "$SETUPLOG" 2>&1; fi if [ "$OSVER" != 'xenial' ]; then apt-get -y install python3-mysqldb >> "$setup_log" 2>&1; else apt-get -y install python-mysqldb >> "$setup_log" 2>&1; fi
;; ;;
'MASTER' | 'EVAL' | 'MASTERSEARCH') # TODO: should this also be HELIXSENSOR? 'MASTER' | 'EVAL' | 'MASTERSEARCH') # TODO: should this also be HELIXSENSOR?
if [ "$OSVER" != "xenial" ]; then local py_ver_url_path="/py3"; else local py_ver_url_path="/apt"; fi if [ "$OSVER" != "xenial" ]; then local py_ver_url_path="/py3"; else local py_ver_url_path="/apt"; fi
@@ -1120,35 +1073,35 @@ saltify() {
# Add repo # Add repo
echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list
# Initialize the new repos # Initialize the new repos
apt-get update >> "$SETUPLOG" 2>&1 apt-get update >> "$setup_log" 2>&1
# FIXME: Install salt-master on Ubuntu? # FIXME: Install salt-master on Ubuntu?
apt-get -y install sqlite3 argon2 openssl >> "$SETUPLOG" 2>&1 apt-get -y install sqlite3 argon2 openssl >> "$setup_log" 2>&1
if [ "$OSVER" != 'xenial' ]; then apt-get -y install python3-mysqldb >> "$SETUPLOG" 2>&1; else apt-get -y install python-mysqldb >> "$SETUPLOG" 2>&1; fi if [ "$OSVER" != 'xenial' ]; then apt-get -y install python3-mysqldb >> "$setup_log" 2>&1; else apt-get -y install python-mysqldb >> "$setup_log" 2>&1; fi
;; ;;
*) *)
# Copy down the gpg keys and install them from the master # Copy down the gpg keys and install them from the master
mkdir "$TMP"/gpg mkdir "$temp_install_dir"/gpg
echo "scp the gpg keys and install them from the master" echo "scp the gpg keys and install them from the master"
scp -v -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/gpg/* "$TMP"/gpg scp -v -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/gpg/* "$temp_install_dir"/gpg
echo "Using apt-key add to add SALTSTACK-GPG-KEY.pub and GPG-KEY-WAZUH" echo "Using apt-key add to add SALTSTACK-GPG-KEY.pub and GPG-KEY-WAZUH"
apt-key add "$TMP"/gpg/SALTSTACK-GPG-KEY.pub apt-key add "$temp_install_dir"/gpg/SALTSTACK-GPG-KEY.pub
apt-key add "$TMP"/gpg/GPG-KEY-WAZUH apt-key add "$temp_install_dir"/gpg/GPG-KEY-WAZUH
echo "deb http://repo.saltstack.com/apt/ubuntu/$ubuntu_version/amd64/2019.2 $OSVER main" > /etc/apt/sources.list.d/saltstack.list echo "deb http://repo.saltstack.com/apt/ubuntu/$ubuntu_version/amd64/2019.2 $OSVER main" > /etc/apt/sources.list.d/saltstack.list
echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list
;; ;;
esac esac
apt-get update >> "$SETUPLOG" 2>&1 apt-get update >> "$setup_log" 2>&1
apt-get -y install salt-minion=2019.2.3+ds-1\ apt-get -y install salt-minion=2019.2.3+ds-1\
salt-common=2019.2.3+ds-1 >> "$SETUPLOG" 2>&1 salt-common=2019.2.3+ds-1 >> "$setup_log" 2>&1
apt-mark hold salt-minion salt-common apt-mark hold salt-minion salt-common
if [ "$OSVER" != 'xenial' ]; then apt-get -y install python3-dateutil python3-m2crypto >> "$SETUPLOG" 2>&1; else apt-get -y install python-dateutil python-m2crypto >> "$SETUPLOG" 2>&1; fi if [ "$OSVER" != 'xenial' ]; then apt-get -y install python3-dateutil python3-m2crypto >> "$setup_log" 2>&1; else apt-get -y install python-dateutil python-m2crypto >> "$setup_log" 2>&1; fi
fi fi
} }
salt_checkin() { salt_checkin() {
case "$INSTALLTYPE" in case "$install_type" in
'MASTER' | 'EVAL' | 'HELIXSENSOR' | 'MASTERSEARCH') # Fix Mine usage 'MASTER' | 'EVAL' | 'HELIXSENSOR' | 'MASTERSEARCH') # Fix Mine usage
{ {
echo "Building Certificate Authority"; echo "Building Certificate Authority";
@@ -1162,11 +1115,11 @@ salt_checkin() {
salt '*' mine.send x509.get_pem_entries glob_path=/etc/pki/ca.crt; salt '*' mine.send x509.get_pem_entries glob_path=/etc/pki/ca.crt;
echo " Applying SSL state"; echo " Applying SSL state";
salt-call state.apply ssl; salt-call state.apply ssl;
} >> "$SETUPLOG" 2>&1 } >> "$setup_log" 2>&1
;; ;;
*) *)
salt-call state.apply ca >> "$SETUPLOG" 2>&1 salt-call state.apply ca >> "$setup_log" 2>&1
salt-call state.apply ssl >> "$SETUPLOG" 2>&1 salt-call state.apply ssl >> "$setup_log" 2>&1
;; ;;
esac esac
} }
@@ -1174,11 +1127,11 @@ salt_checkin() {
# FIXME: should this be a function? # FIXME: should this be a function?
salt_firstcheckin() { salt_firstcheckin() {
#First Checkin #First Checkin
salt-call state.highstate >> "$SETUPLOG" 2>&1 salt-call state.highstate >> "$setup_log" 2>&1
} }
salt_master_directories() { setup_salt_master_dirs() {
# Create salt paster directories # Create salt paster directories
mkdir -p /opt/so/saltstack/salt mkdir -p /opt/so/saltstack/salt
mkdir -p /opt/so/saltstack/pillar mkdir -p /opt/so/saltstack/pillar
@@ -1188,19 +1141,17 @@ salt_master_directories() {
rsync -avh --exclude 'TRANS.TBL' /home/onion/SecurityOnion/pillar/* /opt/so/saltstack/pillar/ rsync -avh --exclude 'TRANS.TBL' /home/onion/SecurityOnion/pillar/* /opt/so/saltstack/pillar/
rsync -avh --exclude 'TRANS.TBL' /home/onion/SecurityOnion/salt/* /opt/so/saltstack/salt/ rsync -avh --exclude 'TRANS.TBL' /home/onion/SecurityOnion/salt/* /opt/so/saltstack/salt/
else else
cp -R "$SCRIPTDIR"/../pillar/* /opt/so/saltstack/pillar/ cp -R ../pillar/* /opt/so/saltstack/pillar/
cp -R "$SCRIPTDIR"/../salt/* /opt/so/saltstack/salt/ cp -R ../salt/* /opt/so/saltstack/salt/
fi fi
# FIXME: why is this being done? echo "Chown the salt dirs on the master for socore" >> "$setup_log" 2>&1
chmod +x /opt/so/saltstack/pillar/firewall/addfirewall.sh chown -R socore:socore /opt/so
chmod +x /opt/so/saltstack/pillar/data/addtotab.sh
} }
sensor_pillar() { sensor_pillar() {
local pillar_file=$TMP/pillar/minions/$MINION_ID.sls local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls
# Create the sensor pillar # Create the sensor pillar
printf '%s\n'\ printf '%s\n'\
@@ -1220,9 +1171,9 @@ sensor_pillar() {
SPIN=$(echo "$SPIN" | cut -d\" -f2) SPIN=$(echo "$SPIN" | cut -d\" -f2)
echo " - $SPIN" >> "$pillar_file" echo " - $SPIN" >> "$pillar_file"
done done
elif [ "$INSTALLTYPE" = 'HELIXSENSOR' ]; then elif [ "$install_type" = 'HELIXSENSOR' ]; then
echo " bro_lbprocs: $LBPROCS" >> "$pillar_file" echo " bro_lbprocs: $lb_procs" >> "$pillar_file"
echo " suriprocs: $LBPROCS" >> "$pillar_file" echo " suriprocs: $lb_procs" >> "$pillar_file"
else else
echo " bro_lbprocs: $BASICBRO" >> "$pillar_file" echo " bro_lbprocs: $BASICBRO" >> "$pillar_file"
echo " suriprocs: $BASICSURI" >> "$pillar_file" echo " suriprocs: $BASICSURI" >> "$pillar_file"
@@ -1234,8 +1185,8 @@ sensor_pillar() {
" master: $MSRV"\ " master: $MSRV"\
" mtu: $MTU"\ " mtu: $MTU"\
" uniqueid: $(date '+%s')" >> "$pillar_file" " uniqueid: $(date '+%s')" >> "$pillar_file"
if [ "$HNSENSOR" != 'inherit' ]; then if [ "$home_network_sensor" != 'inherit' ]; then
echo " hnsensor: $HNSENSOR" >> "$pillar_file" echo " home_network_sensor: $home_network_sensor" >> "$pillar_file"
fi fi
printf '%s\n'\ printf '%s\n'\
" access_key: $ACCESS_KEY"\ " access_key: $ACCESS_KEY"\
@@ -1248,7 +1199,7 @@ set_hostname() {
set_hostname_iso set_hostname_iso
HOSTNAME=$(cat /etc/hostname) HOSTNAME=$(cat /etc/hostname)
if [[ ! $INSTALLTYPE =~ ^(MASTER|EVAL|HELIXSENSOR|MASTERSEARCH)$ ]]; then if [[ ! $install_type =~ ^(MASTER|EVAL|HELIXSENSOR|MASTERSEARCH)$ ]]; then
if [[ $TESTHOST = *"not found"* ]] || [ -z "$TESTHOST" ] || [[ $TESTHOST = *"connection timed out"* ]]; then if [[ $TESTHOST = *"not found"* ]] || [ -z "$TESTHOST" ] || [[ $TESTHOST = *"connection timed out"* ]]; then
if ! grep -q "$MSRVIP" /etc/hosts; then if ! grep -q "$MSRVIP" /etc/hosts; then
echo "$MSRVIP $MSRV" >> /etc/hosts echo "$MSRVIP $MSRV" >> /etc/hosts
@@ -1271,22 +1222,22 @@ set_initial_firewall_policy() {
get_main_ip get_main_ip
case "$INSTALLTYPE" in case "$install_type" in
'MASTER') 'MASTER')
printf " - %s\n" "$MAINIP" | tee /opt/so/saltstack/pillar/firewall/minions.sls /opt/so/saltstack/pillar/firewall/masterfw.sls printf " - %s\n" "$MAINIP" | tee /opt/so/saltstack/pillar/firewall/minions.sls /opt/so/saltstack/pillar/firewall/masterfw.sls
/opt/so/saltstack/pillar/data/addtotab.sh mastertab "$MINION_ID" "$MAINIP" "$CPUCORES" "$RANDOMUID" "$MAININT" "$FSROOT" "$FSNSM" /opt/so/saltstack/pillar/data/addtotab.sh mastertab "$MINION_ID" "$MAINIP" "$CPUCORES" "$random_uid" "$MAININT" "$FSROOT" "$FSNSM"
;; ;;
'EVAL' | 'MASTERSEARCH') 'EVAL' | 'MASTERSEARCH')
printf " - %s\n" "$MAINIP" | tee /opt/so/saltstack/pillar/firewall/minions.sls\ printf " - %s\n" "$MAINIP" | tee /opt/so/saltstack/pillar/firewall/minions.sls\
/opt/so/saltstack/pillar/firewall/masterfw.sls\ /opt/so/saltstack/pillar/firewall/masterfw.sls\
/opt/so/saltstack/pillar/firewall/forward_nodes.sls\ /opt/so/saltstack/pillar/firewall/forward_nodes.sls\
/opt/so/saltstack/pillar/firewall/search_nodes.sls /opt/so/saltstack/pillar/firewall/search_nodes.sls
case "$INSTALLTYPE" in case "$install_type" in
'EVAL') 'EVAL')
/opt/so/saltstack/pillar/data/addtotab.sh evaltab "$MINION_ID" "$MAINIP" "$CPUCORES" "$RANDOMUID" "$MAININT" "$FSROOT" "$FSNSM" bond0 /opt/so/saltstack/pillar/data/addtotab.sh evaltab "$MINION_ID" "$MAINIP" "$CPUCORES" "$random_uid" "$MAININT" "$FSROOT" "$FSNSM" bond0
;; ;;
'MASTERSEARCH') 'MASTERSEARCH')
/opt/so/saltstack/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$CPUCORES" "$RANDOMUID" "$MAININT" "$FSROOT" "$FSNSM" /opt/so/saltstack/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$CPUCORES" "$random_uid" "$MAININT" "$FSROOT" "$FSNSM"
;; ;;
esac esac
;; ;;
@@ -1300,17 +1251,17 @@ set_initial_firewall_policy() {
case "$INSTALLERTYPE" in case "$INSTALLERTYPE" in
'SENSOR') 'SENSOR')
ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh forward_nodes "$MAINIP" ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh forward_nodes "$MAINIP"
ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$CPUCORES" "$RANDOMUID" "$MAININT" "$FSROOT" "$FSNSM" bond0 ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$CPUCORES" "$random_uid" "$MAININT" "$FSROOT" "$FSNSM" bond0
;; ;;
'SEARCHNODE') 'SEARCHNODE')
ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh search_nodes "$MAINIP" ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh search_nodes "$MAINIP"
ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$CPUCORES" "$RANDOMUID" "$MAININT" "$FSROOT" "$FSNSM" ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$CPUCORES" "$random_uid" "$MAININT" "$FSROOT" "$FSNSM"
;; ;;
'HEAVYNODE') 'HEAVYNODE')
ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh forward_nodes "$MAINIP" ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh forward_nodes "$MAINIP"
ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh search_nodes "$MAINIP" ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh search_nodes "$MAINIP"
ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$CPUCORES" "$RANDOMUID" "$MAININT" "$FSROOT" "$FSNSM" bond0 ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$CPUCORES" "$random_uid" "$MAININT" "$FSROOT" "$FSNSM" bond0
ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$CPUCORES" "$RANDOMUID" "$MAININT" "$FSROOT" "$FSNSM" ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo /opt/so/saltstack/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$CPUCORES" "$random_uid" "$MAININT" "$FSROOT" "$FSNSM"
;; ;;
esac esac
;; ;;
@@ -1346,7 +1297,7 @@ set_management_interface() {
set_node_type() { set_node_type() {
case "$INSTALLTYPE" in case "$install_type" in
'SEARCHNODE' | 'EVAL' | 'MASTERSEARCH' | 'HEAVYNODE') 'SEARCHNODE' | 'EVAL' | 'MASTERSEARCH' | 'HEAVYNODE')
NODETYPE='search' NODETYPE='search'
;; ;;
@@ -1380,7 +1331,7 @@ set_updates() {
# FIXME: should this be a function? # FIXME: should this be a function?
set_version() { set_version() {
# Drop a file with the current version # Drop a file with the current version
echo "$SOVERSION" > /etc/soversion echo "$so_version" > /etc/soversion
} }
update_sudoers() { update_sudoers() {

1761
setup/so-setup
View File

File diff suppressed because it is too large Load Diff

61
setup/so-whiptail
View File

@@ -15,17 +15,17 @@
# You should have received a copy of the GNU General Public License # You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
source "./so-variables"
whiptail_basic_bro() { whiptail_basic_bro() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
BASICBRO=$(whiptail --title "Security Onion Setup" --inputbox \ BASICBRO=$(whiptail --title "Security Onion Setup" --inputbox \
"Enter the number of bro processes:" 10 75 $LBPROCS 3>&1 1>&2 2>&3) "Enter the number of bro processes:" 10 75 "$lb_procs" 3>&1 1>&2 2>&3)
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
} }
whiptail_basic_suri() { whiptail_basic_suri() {
@@ -33,7 +33,7 @@ whiptail_basic_suri() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
BASICSURI=$(whiptail --title "Security Onion Setup" --inputbox \ BASICSURI=$(whiptail --title "Security Onion Setup" --inputbox \
"Enter the number of Suricata Processes:" 10 75 $LBPROCS 3>&1 1>&2 2>&3) "Enter the number of Suricata Processes:" 10 75 "$lb_procs" 3>&1 1>&2 2>&3)
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
@@ -44,7 +44,7 @@ whiptail_bro_pins() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
BROPINS=$(whiptail --noitem --title "Pin Bro CPUS" --checklist "Please Select $LBPROCS cores to pin Bro to:" 20 75 12 "${LISTCORES[@]}" 3>&1 1>&2 2>&3 ) BROPINS=$(whiptail --noitem --title "Pin Bro CPUS" --checklist "Please Select $lb_procs cores to pin Bro to:" 20 75 12 "${cpu_core_list[@]}" 3>&1 1>&2 2>&3 )
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
@@ -68,8 +68,8 @@ whiptail_bond_nics() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
local nic_list=() local nic_list=()
for FNIC in "${FNICS[@]}"; do for filtered_nic in "${filtered_nics[@]}"; do
nic_list+=("$FNIC" "Interface" "OFF") nic_list+=("$filtered_nic" "Interface" "OFF")
done done
BNICS=$(whiptail --title "NIC Setup" --checklist "Please add NICs to the Monitor Interface" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 ) BNICS=$(whiptail --title "NIC Setup" --checklist "Please add NICs to the Monitor Interface" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 )
@@ -102,9 +102,9 @@ whiptail_cancel() {
whiptail --title "Security Onion Setup" --msgbox "Cancelling Setup. No changes have been made." 8 75 whiptail --title "Security Onion Setup" --msgbox "Cancelling Setup. No changes have been made." 8 75
if [ -d "/root/installtmp" ]; then if [ -d "/root/installtmp" ]; then
echo "/root/installtmp exists" >> $SETUPLOG 2>&1 echo "/root/installtmp exists" >> $setup_log 2>&1
install_cleanup >> $SETUPLOG 2>&1 install_cleanup >> $setup_log 2>&1
echo "/root/installtmp removed" >> $SETUPLOG 2>&1 echo "/root/installtmp removed" >> $setup_log 2>&1
fi fi
exit exit
@@ -325,7 +325,8 @@ whiptail_homenet_master() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
# Ask for the HOME_NET on the master # Ask for the HOME_NET on the master
HNMASTER=$(whiptail --title "Security Onion Setup" --inputbox \ export home_network_master
home_network_master=$(whiptail --title "Security Onion Setup" --inputbox \
"Enter your HOME_NET separated by ," 10 75 10.0.0.0/8,192.168.0.0/16,172.16.0.0/12 3>&1 1>&2 2>&3) "Enter your HOME_NET separated by ," 10 75 10.0.0.0/8,192.168.0.0/16,172.16.0.0/12 3>&1 1>&2 2>&3)
local exitstatus=$? local exitstatus=$?
@@ -342,9 +343,10 @@ whiptail_homenet_sensor() {
local exitstatus=$? local exitstatus=$?
if [ $exitstatus == 0 ]; then if [ $exitstatus == 0 ]; then
HNSENSOR=inherit export home_network_sensor=inherit
else else
HNSENSOR=$(whiptail --title "Security Onion Setup" --inputbox \ export home_network_sensor
home_network_sensor=$(whiptail --title "Security Onion Setup" --inputbox \
"Enter your HOME_NET separated by ," 10 75 10.0.0.0/8,192.168.0.0/16,172.16.0.0/12 3>&1 1>&2 2>&3) "Enter your HOME_NET separated by ," 10 75 10.0.0.0/8,192.168.0.0/16,172.16.0.0/12 3>&1 1>&2 2>&3)
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
@@ -357,7 +359,8 @@ whiptail_install_type() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
# What kind of install are we doing? # What kind of install are we doing?
INSTALLTYPE=$(whiptail --title "Security Onion Setup" --radiolist \ export install_type
install_type=$(whiptail --title "Security Onion Setup" --radiolist \
"Choose Install Type:" 20 75 13 \ "Choose Install Type:" 20 75 13 \
"SENSOR" "Create a forward only sensor" ON \ "SENSOR" "Create a forward only sensor" ON \
"SEARCHNODE" "Add a Search Node with parsing" OFF \ "SEARCHNODE" "Add a Search Node with parsing" OFF \
@@ -382,9 +385,9 @@ whiptail_log_size_limit() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
LOG_SIZE_LIMIT=$(whiptail --title "Security Onion Setup" --inputbox \ log_size_limit=$(whiptail --title "Security Onion Setup" --inputbox \
"Please specify the amount of disk space (in GB) you would like to allocate for Elasticsearch data storage. \ "Please specify the amount of disk space (in GB) you would like to allocate for Elasticsearch data storage. \
By default, this is set to 85% of the disk space allotted for /nsm." 10 75 $LOG_SIZE_LIMIT 3>&1 1>&2 2>&3) By default, this is set to 85% of the disk space allotted for /nsm." 10 75 "$log_size_limit" 3>&1 1>&2 2>&3)
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
@@ -440,13 +443,13 @@ whiptail_management_nic() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
MNIC=$(whiptail --title "NIC Setup" --radiolist "Please select your management NIC" 20 75 12 "${NICS[@]}" 3>&1 1>&2 2>&3 ) MNIC=$(whiptail --title "NIC Setup" --radiolist "Please select your management NIC" 20 75 12 "${all_nics[@]}" 3>&1 1>&2 2>&3 )
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
while [ -z "$MNIC" ] while [ -z "$MNIC" ]
do do
MNIC=$(whiptail --title "NIC Setup" --radiolist "Please select your management NIC" 20 75 12 "${NICS[@]}" 3>&1 1>&2 2>&3 ) MNIC=$(whiptail --title "NIC Setup" --radiolist "Please select your management NIC" 20 75 12 "${all_nics[@]}" 3>&1 1>&2 2>&3 )
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
done done
@@ -483,7 +486,7 @@ whiptail_make_changes() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
whiptail --title "Security Onion Setup" --yesno "We are going to set this machine up as a $INSTALLTYPE. Please hit YES to make changes or NO to cancel." 8 75 whiptail --title "Security Onion Setup" --yesno "We are going to set this machine up as a $install_type. Please hit YES to make changes or NO to cancel." 8 75
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
@@ -495,7 +498,7 @@ whiptail_management_server() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
MSRV=$(whiptail --title "Security Onion Setup" --inputbox \ MSRV=$(whiptail --title "Security Onion Setup" --inputbox \
"Enter your Master Server HOSTNAME. It is CASE SENSITIVE!" 10 75 XXXX 3>&1 1>&2 2>&3) "Enter your Master Server hostname. It is CASE SENSITIVE!" 10 75 XXXX 3>&1 1>&2 2>&3)
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
@@ -630,7 +633,7 @@ whiptail_node_ls_pipeline_worker() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
LSPIPELINEWORKERS=$(whiptail --title "Security Onion Setup" --inputbox \ LSPIPELINEWORKERS=$(whiptail --title "Security Onion Setup" --inputbox \
"\nEnter LogStash Pipeline Workers: \n \n(Recommended value is pre-populated)" 10 75 $CPUCORES 3>&1 1>&2 2>&3) "\nEnter LogStash Pipeline Workers: \n \n(Recommended value is pre-populated)" 10 75 "$cpu_cores" 3>&1 1>&2 2>&3)
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
@@ -895,8 +898,8 @@ whiptail_setup_complete() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
whiptail --title "Security Onion Setup" --msgbox "Finished installing this as an $INSTALLTYPE. Press Enter to reboot." 8 75 whiptail --title "Security Onion Setup" --msgbox "Finished installing this as an $install_type. Press Enter to reboot." 8 75
install_cleanup >> $SETUPLOG 2>&1 install_cleanup >> $setup_log 2>&1
} }
@@ -904,8 +907,8 @@ whiptail_setup_failed() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
whiptail --title "Security Onion Setup" --msgbox "Install had a problem. Please see $SETUPLOG for details. Press Enter to reboot." 8 75 whiptail --title "Security Onion Setup" --msgbox "Install had a problem. Please see $setup_log for details. Press Enter to reboot." 8 75
install_cleanup >> $SETUPLOG 2>&1 install_cleanup >> $setup_log 2>&1
} }
@@ -925,8 +928,9 @@ whiptail_suricata_pins() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
FILTEREDCORES=$(echo "${LISTCORES[@]}" "${BROPINS[@]}" | tr -d '"' | tr ' ' '\n' | sort | uniq -u | awk '{print $1 " \"" "core" "\""}') local filtered_cores
SURIPINS=$(whiptail --noitem --title "Pin Suricata CPUS" --checklist "Please Select $LBPROCS cores to pin Suricata to:" 20 75 12 ${FILTEREDCORES[@]} 3>&1 1>&2 2>&3 ) filtered_cores=$(echo "${cpu_core_list[@]}" "${BROPINS[@]}" | tr -d '"' | tr ' ' '\n' | sort | uniq -u | awk '{print $1 " \"" "core" "\""}')
SURIPINS=$(whiptail --noitem --title "Pin Suricata CPUS" --checklist "Please Select $lb_procs cores to pin Suricata to:" 20 75 12 "${filtered_cores[@]}" 3>&1 1>&2 2>&3 )
local exitstatus=$? local exitstatus=$?
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
@@ -971,13 +975,10 @@ whiptail_you_sure() {
[ -z "$QUIET" ] && return [ -z "$QUIET" ] && return
echo "whiptail_you_sure called" >> $setup_log 2>&1
echo "whiptail_you_sure called" >> $SETUPLOG 2>&1
whiptail --title "Security Onion Setup" --yesno "Are you sure you want to install Security Onion over the internet?" 8 75 whiptail --title "Security Onion Setup" --yesno "Are you sure you want to install Security Onion over the internet?" 8 75
local exitstatus=$? local exitstatus=$?
echo "whiptail_you_sure returning $exitstatus" >> $SETUPLOG 2>&1
return $exitstatus return $exitstatus
} }