CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #415 from Security-Onion-Solutions/issue/136

Browse Source 
Issue/136
This commit is contained in:
Josh Patterson
2020-03-12 17:46:38 -04:00
committed by GitHub
parent efda3b9295 804a87eb21
commit 8b0509aa4a
6 changed files with 63 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pillar/top.sls
View File

@@ -3,19 +3,19 @@ base:
- patch.needs_restarting - patch.needs_restarting
- docker.config - docker.config
'G@role:so-mastersearch or G@role:so-heavynode': '*_mastersearch or *_heavynode':
- match: compound - match: compound
- logstash - logstash
- logstash.master - logstash.master
- logstash.search - logstash.search
'G@role:so-sensor': '*_sensor':
- static - static
- firewall.* - firewall.*
- brologs - brologs
- minions.{{ grains.id }} - minions.{{ grains.id }}
'G@role:so-master or G@role:so-mastersearch': '*_master or *_mastersearch':
- match: compound - match: compound
- static - static
- firewall.* - firewall.*
@@ -23,11 +23,11 @@ base:
- auth - auth
- minions.{{ grains.id }} - minions.{{ grains.id }}
'G@role:so-master': '*_master':
- logstash - logstash
- logstash.master - logstash.master
'G@role:so-eval': '*_eval':
- static - static
- firewall.* - firewall.*
- data.* - data.*
@@ -37,18 +37,18 @@ base:
- logstash.eval - logstash.eval
- minions.{{ grains.id }} - minions.{{ grains.id }}
'G@role:so-node': '*_node':
- static - static
- firewall.* - firewall.*
- minions.{{ grains.id }} - minions.{{ grains.id }}
'G@role:so-heavynode': '*_heavynode':
- static - static
- firewall.* - firewall.*
- brologs - brologs
- minions.{{ grains.id }} - minions.{{ grains.id }}
'G@role:so-helix': '*_helix':
- static - static
- firewall.* - firewall.*
- fireeye - fireeye

19
salt/ssl/init.sls
View File

@@ -1,17 +1,24 @@
{% set master = salt['grains.get']('master') %} {% set master = salt['grains.get']('master') %}
{% set master_minion_id = master.split(".")[0] %} {% set masterip = salt['pillar.get']('static:masterip', '') %}
{%- set masterip = salt['pillar.get']('static:masterip', '') -%} {% set global_ca_text = [] %}
{% set global_ca_server = [] %}
{% if grains['role'] == 'so-master' or grains['role'] == 'so-eval' %} {% if 'master' in grains.id.split('_')|last or 'eval' in grains.id.split('_')|last %}
{% set trusttheca_text = salt['mine.get'](grains.id, 'x509.get_pem_entries')[grains.id]['/etc/pki/ca.crt']|replace('\n', '') %} {% set trusttheca_text = salt['mine.get'](grains.id, 'x509.get_pem_entries')[grains.id]['/etc/pki/ca.crt']|replace('\n', '') %}
{% set ca_server = grains.id %} {% set ca_server = grains.id %}
{% else %} {% else %}
{% set trusttheca_text = salt['mine.get'](master_minion_id, 'x509.get_pem_entries')[master_minion_id]['/etc/pki/ca.crt']|replace('\n', '') %} {% set x509dict = salt['mine.get']('*', 'x509.get_pem_entries') %}
{% set ca_server = master_minion_id %} {% for host in x509dict %}
{% if 'master' in host.split('_')|last %}
{% do global_ca_text.append(x509dict[host].get('/etc/pki/ca.crt')|replace('\n', '')) %}
{% do global_ca_server.append(host) %}
{% endif %}
{% endfor %}
{% set trusttheca_text = global_ca_text[0] %}
{% set ca_server = global_ca_server[0] %}
{% endif %} {% endif %}
# Trust the CA # Trust the CA
trusttheca: trusttheca:
x509.pem_managed: x509.pem_managed:
- name: /etc/ssl/certs/intca.crt - name: /etc/ssl/certs/intca.crt

28
salt/top.sls
View File

@@ -11,7 +11,7 @@ base:
- patch.os.schedule - patch.os.schedule
- motd - motd
'G@role:so-helix': '*_helix':
- ca - ca
- ssl - ssl
- registry - registry
@@ -26,7 +26,7 @@ base:
- filebeat - filebeat
- schedule - schedule
'G@role:so-sensor': '*_sensor':
- ca - ca
- ssl - ssl
- common - common
@@ -43,7 +43,7 @@ base:
{%- endif %} {%- endif %}
- schedule - schedule
'G@role:so-eval': '*_eval':
- ca - ca
- ssl - ssl
- registry - registry
@@ -89,7 +89,7 @@ base:
{%- endif %} {%- endif %}
'G@role:so-master': '*_master':
- ca - ca
- ssl - ssl
- registry - registry
@@ -133,8 +133,8 @@ base:
# Search node logic # Search node logic
'G@role:so-node and I@node:node_type:parser': '*_node and I@node:node_type:parser':
- match: pillar - match: compound
- common - common
- firewall - firewall
- logstash - logstash
@@ -143,8 +143,8 @@ base:
{%- endif %} {%- endif %}
- schedule - schedule
'G@role:so-node and I@node:node_type:hot': '*_node and I@node:node_type:hot':
- match: pillar - match: compound
- common - common
- firewall - firewall
- logstash - logstash
@@ -155,8 +155,8 @@ base:
{%- endif %} {%- endif %}
- schedule - schedule
'G@role:so-node and I@node:node_type:warm': '*_node and I@node:node_type:warm':
- match: pillar - match: compound
- common - common
- firewall - firewall
- elasticsearch - elasticsearch
@@ -165,7 +165,7 @@ base:
{%- endif %} {%- endif %}
- schedule - schedule
'G@role:so-node and I@node:node_type:search': '*_node and I@node:node_type:search':
- match: compound - match: compound
- ca - ca
- ssl - ssl
@@ -183,7 +183,7 @@ base:
{%- endif %} {%- endif %}
- schedule - schedule
'G@role:mastersensor': '*_mastersensor':
- common - common
- firewall - firewall
- sensor - sensor
@@ -194,7 +194,7 @@ base:
{%- endif %} {%- endif %}
- schedule - schedule
'G@role:so-mastersearch': '*_mastersearch':
- ca - ca
- ssl - ssl
- registry - registry
@@ -238,7 +238,7 @@ base:
- domainstats - domainstats
{%- endif %} {%- endif %}
'G@role:so-heavynode': '*_heavynode':
- ca - ca
- ssl - ssl
- common - common

33
setup/so-functions
View File

@@ -268,7 +268,7 @@ copy_master_config() {
copy_minion_tmp_files() { copy_minion_tmp_files() {
if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then if [ $INSTALLTYPE == 'MASTER' ] || [ $INSTALLTYPE == 'EVAL' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
echo "Copying pillar and salt files in $TMP to /opt/so/saltstack" echo "Copying pillar and salt files in $TMP to /opt/so/saltstack"
cp -Rv $TMP/pillar/ /opt/so/saltstack/ >> $SETUPLOG 2>&1 cp -Rv $TMP/pillar/ /opt/so/saltstack/ >> $SETUPLOG 2>&1
if [ -d $TMP/salt ] ; then if [ -d $TMP/salt ] ; then
@@ -407,7 +407,7 @@ docker_install() {
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
yum -y update yum -y update
yum -y install docker-ce python36-docker yum -y install docker-ce python36-docker
if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ]; then if [ $INSTALLTYPE == 'MASTER' ] || [ $INSTALLTYPE == 'EVAL' ]; then
docker_registry docker_registry
echo "Restarting Docker" >> $SETUPLOG 2>&1 echo "Restarting Docker" >> $SETUPLOG 2>&1
systemctl restart docker systemctl restart docker
@@ -421,7 +421,7 @@ docker_install() {
else else
if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ]; then if [ $INSTALLTYPE == 'MASTER' ] || [ $INSTALLTYPE == 'EVAL' ]; then
apt-get update >> $SETUPLOG 2>&1 apt-get update >> $SETUPLOG 2>&1
if [ $OSVER != "xenial" ]; then if [ $OSVER != "xenial" ]; then
apt-get -y install docker-ce python3-docker >> $SETUPLOG 2>&1 apt-get -y install docker-ce python3-docker >> $SETUPLOG 2>&1
@@ -684,7 +684,7 @@ ls_heapsize() {
# Determine LS Heap Size # Determine LS Heap Size
if [ $TOTAL_MEM -ge 32000 ] || [ $INSTALLTYPE == 'MASTERSEARCH' ] || [ $INSTALLTYPE == 'HEAVYNODE' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ]; then if [ $TOTAL_MEM -ge 32000 ] || [ $INSTALLTYPE == 'MASTERSEARCH' ] || [ $INSTALLTYPE == 'HEAVYNODE' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ]; then
LS_HEAP_SIZE="1000m" LS_HEAP_SIZE="1000m"
elif [ $INSTALLTYPE == 'EVALMODE' ]; then elif [ $INSTALLTYPE == 'EVAL' ]; then
LS_HEAP_SIZE="700m" LS_HEAP_SIZE="700m"
else else
# If minimal RAM, then set minimal heap # If minimal RAM, then set minimal heap
@@ -703,7 +703,7 @@ master_pillar() {
echo " mainint: $MAININT" >> $PILLARFILE echo " mainint: $MAININT" >> $PILLARFILE
echo " esheap: $ES_HEAP_SIZE" >> $PILLARFILE echo " esheap: $ES_HEAP_SIZE" >> $PILLARFILE
echo " esclustername: {{ grains.host }}" >> $PILLARFILE echo " esclustername: {{ grains.host }}" >> $PILLARFILE
if [ $INSTALLTYPE == 'EVALMODE' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then if [ $INSTALLTYPE == 'EVAL' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
echo " freq: 0" >> $PILLARFILE echo " freq: 0" >> $PILLARFILE
echo " domainstats: 0" >> $PILLARFILE echo " domainstats: 0" >> $PILLARFILE
echo " ls_pipeline_batch_size: 125" >> $PILLARFILE echo " ls_pipeline_batch_size: 125" >> $PILLARFILE
@@ -895,7 +895,7 @@ saltify() {
if [ $OS == 'centos' ]; then if [ $OS == 'centos' ]; then
ADDUSER=adduser ADDUSER=adduser
if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then if [ $INSTALLTYPE == 'MASTER' ] || [ $INSTALLTYPE == 'EVAL' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
reserve_group_ids reserve_group_ids
yum -y install wget https://repo.saltstack.com/py3/redhat/salt-py3-repo-latest-2.el7.noarch.rpm yum -y install wget https://repo.saltstack.com/py3/redhat/salt-py3-repo-latest-2.el7.noarch.rpm
cp /etc/yum.repos.d/salt-py3-latest.repo /etc/yum.repos.d/salt-py3-2019-2.repo cp /etc/yum.repos.d/salt-py3-latest.repo /etc/yum.repos.d/salt-py3-2019-2.repo
@@ -1056,7 +1056,7 @@ EOF
yum -y update exclude=salt* yum -y update exclude=salt*
systemctl enable salt-minion systemctl enable salt-minion
if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then if [ $INSTALLTYPE == 'MASTER' ] || [ $INSTALLTYPE == 'EVAL' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
yum -y install salt-master-2019.2.3 python3 python36-m2crypto salt-minion-2019.2.3 python36-dateutil python36-mysql python36-docker yum -y install salt-master-2019.2.3 python3 python36-m2crypto salt-minion-2019.2.3 python36-dateutil python36-mysql python36-docker
systemctl enable salt-master systemctl enable salt-master
else else
@@ -1082,7 +1082,7 @@ EOF
UVER=$(grep VERSION_ID /etc/os-release | awk -F '[ "]' '{print $2}') UVER=$(grep VERSION_ID /etc/os-release | awk -F '[ "]' '{print $2}')
# Nasty hack but required for now # Nasty hack but required for now
if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then if [ $INSTALLTYPE == 'MASTER' ] || [ $INSTALLTYPE == 'EVAL' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
if [ $OSVER != "xenial" ]; then if [ $OSVER != "xenial" ]; then
# Install the repo for salt py3 edition # Install the repo for salt py3 edition
@@ -1151,7 +1151,7 @@ EOF
salt_checkin() { salt_checkin() {
# Master State to Fix Mine Usage # Master State to Fix Mine Usage
if [ $INSTALLTYPE == 'MASTERONLY' ] || [ $INSTALLTYPE == 'EVALMODE' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then if [ $INSTALLTYPE == 'MASTER' ] || [ $INSTALLTYPE == 'EVAL' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
echo "Building Certificate Authority" echo "Building Certificate Authority"
salt-call state.apply ca >> $SETUPLOG 2>&1 salt-call state.apply ca >> $SETUPLOG 2>&1
echo " *** Restarting Salt to fix any SSL errors. ***" echo " *** Restarting Salt to fix any SSL errors. ***"
@@ -1280,8 +1280,7 @@ set_hostname() {
echo "::1 localhost localhost.localdomain localhost6 localhost6.localdomain6" >> /etc/hosts echo "::1 localhost localhost.localdomain localhost6 localhost6.localdomain6" >> /etc/hosts
echo $HOSTNAME > /etc/hostname echo $HOSTNAME > /etc/hostname
HOSTNAME=$(cat /etc/hostname) HOSTNAME=$(cat /etc/hostname)
MINION_ID=$(echo $HOSTNAME | awk -F. {'print $1'}) if [ $INSTALLTYPE != 'MASTER' ] || [ $INSTALLTYPE != 'EVAL' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
if [ $INSTALLTYPE != 'MASTERONLY' ] || [ $INSTALLTYPE != 'EVALMODE' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
if [[ $TESTHOST = *"not found"* ]] || [[ $TESTHOST = *"connection timed out"* ]]; then if [[ $TESTHOST = *"not found"* ]] || [[ $TESTHOST = *"connection timed out"* ]]; then
if ! grep -q $MSRVIP /etc/hosts; then if ! grep -q $MSRVIP /etc/hosts; then
echo "$MSRVIP $MSRV" >> /etc/hosts echo "$MSRVIP $MSRV" >> /etc/hosts
@@ -1303,21 +1302,21 @@ set_hostname_iso() {
set_initial_firewall_policy() { set_initial_firewall_policy() {
get_main_ip get_main_ip
if [ $INSTALLTYPE == 'MASTERONLY' ]; then if [ $INSTALLTYPE == 'MASTER' ]; then
printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/minions.sls printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/minions.sls
printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/masterfw.sls printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/masterfw.sls
/opt/so/saltstack/pillar/data/addtotab.sh mastertab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM /opt/so/saltstack/pillar/data/addtotab.sh mastertab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM
fi fi
if [ $INSTALLTYPE == 'EVALMODE' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then if [ $INSTALLTYPE == 'EVAL' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/minions.sls printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/minions.sls
printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/masterfw.sls printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/masterfw.sls
printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/forward_nodes.sls printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/forward_nodes.sls
printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/search_nodes.sls printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/search_nodes.sls
if [ $INSTALLTYPE == 'EVALMODE' ]; then if [ $INSTALLTYPE == 'EVAL' ]; then
/opt/so/saltstack/pillar/data/addtotab.sh evaltab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM bond0 /opt/so/saltstack/pillar/data/addtotab.sh evaltab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM bond0
elif [ $INSTALLTYPE == 'MASTERSEARCH' ]; then elif [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
/opt/so/saltstack/pillar/data/addtotab.sh mastersearchtab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM /opt/so/saltstack/pillar/data/addtotab.sh nodestab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM
fi fi
fi fi
@@ -1327,7 +1326,7 @@ set_initial_firewall_policy() {
printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/forward_nodes.sls printf " - $MAINIP\n" >> /opt/so/saltstack/pillar/firewall/forward_nodes.sls
fi fi
if [ $INSTALLTYPE == 'SENSORONLY' ]; then if [ $INSTALLTYPE == 'SENSOR' ]; then
ssh -i /root/.ssh/so.key socore@$MSRV sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh minions $MAINIP ssh -i /root/.ssh/so.key socore@$MSRV sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh minions $MAINIP
ssh -i /root/.ssh/so.key socore@$MSRV sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh forward_nodes $MAINIP ssh -i /root/.ssh/so.key socore@$MSRV sudo /opt/so/saltstack/pillar/firewall/addfirewall.sh forward_nodes $MAINIP
ssh -i /root/.ssh/so.key socore@$MSRV sudo /opt/so/saltstack/pillar/data/addtotab.sh sensorstab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM bond0 ssh -i /root/.ssh/so.key socore@$MSRV sudo /opt/so/saltstack/pillar/data/addtotab.sh sensorstab $MINION_ID $MAINIP $CPUCORES $RANDOMUID $MAININT $FSROOT $FSNSM bond0
@@ -1380,7 +1379,7 @@ set_management_interface() {
set_node_type() { set_node_type() {
# Determine the node type based on whiplash choice # Determine the node type based on whiplash choice
if [ $INSTALLTYPE == 'SEARCHNODE' ] || [ $INSTALLTYPE == 'EVALMODE' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ] || [ $INSTALLTYPE == 'HEAVYNODE' ] ; then if [ $INSTALLTYPE == 'SEARCHNODE' ] || [ $INSTALLTYPE == 'EVAL' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ] || [ $INSTALLTYPE == 'HEAVYNODE' ] ; then
NODETYPE='search' NODETYPE='search'
fi fi
if [ $INSTALLTYPE == 'PARSINGNODE' ]; then if [ $INSTALLTYPE == 'PARSINGNODE' ]; then

16
setup/so-setup
View File

@@ -31,7 +31,6 @@ fi
# Global Variables # Global Variables
HOSTNAME=$(cat /etc/hostname) HOSTNAME=$(cat /etc/hostname)
MINION_ID=$(echo $HOSTNAME | awk -F. {'print $1'})
TOTAL_MEM=`grep MemTotal /proc/meminfo | awk '{print $2}' | sed -r 's/.{3}$//'` TOTAL_MEM=`grep MemTotal /proc/meminfo | awk '{print $2}' | sed -r 's/.{3}$//'`
NICS=$(ip link | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2 " \"" "Interface" "\"" " OFF"}') NICS=$(ip link | awk -F: '$0 !~ "lo|vir|veth|br|docker|wl|^[^0-9]"{print $2 " \"" "Interface" "\"" " OFF"}')
CPUCORES=$(cat /proc/cpuinfo | grep processor | wc -l) CPUCORES=$(cat /proc/cpuinfo | grep processor | wc -l)
@@ -120,6 +119,9 @@ if (whiptail_you_sure) ; then
# What kind of install are we doing? # What kind of install are we doing?
whiptail_install_type whiptail_install_type
SHORTNAME=$(echo $HOSTNAME | awk -F. {'print $1'})
MINION_ID=$(echo $SHORTNAME'_'$INSTALLTYPE | tr '[:upper:]' '[:lower:]')
echo "MINION_ID = $MINION_ID" >> $SETUPLOG 2>&1
# How do we want to handle OS patching? manual, auto or scheduled days and hours # How do we want to handle OS patching? manual, auto or scheduled days and hours
whiptail_patch_schedule whiptail_patch_schedule
@@ -252,7 +254,7 @@ if (whiptail_you_sure) ; then
#################### ####################
## Master ## ## Master ##
#################### ####################
if [ $INSTALLTYPE == 'MASTERONLY' ]; then if [ $INSTALLTYPE == 'MASTER' ]; then
# Would you like to do an advanced install? # Would you like to do an advanced install?
whiptail_master_adv whiptail_master_adv
@@ -437,7 +439,7 @@ if (whiptail_you_sure) ; then
## Sensor ## ## Sensor ##
#################### ####################
if [ $INSTALLTYPE == 'SENSORONLY' ]; then if [ $INSTALLTYPE == 'SENSOR' ]; then
filter_unused_nics filter_unused_nics
whiptail_bond_nics whiptail_bond_nics
whiptail_management_server whiptail_management_server
@@ -520,12 +522,12 @@ if (whiptail_you_sure) ; then
## Eval Mode or Master Search ## ## Eval Mode or Master Search ##
####################################### #######################################
if [ $INSTALLTYPE == 'EVALMODE' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then if [ $INSTALLTYPE == 'EVAL' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then
# Filter out the management NIC # Filter out the management NIC
filter_unused_nics filter_unused_nics
if [ $INSTALLTYPE == 'EVALMODE' ]; then if [ $INSTALLTYPE == 'EVAL' ]; then
TYPE='eval' TYPE='eval'
# Select which NICs are in the bond # Select which NICs are in the bond
whiptail_bond_nics whiptail_bond_nics
@@ -585,7 +587,7 @@ if (whiptail_you_sure) ; then
add_socore_user_master add_socore_user_master
{ {
sleep 0.5 sleep 0.5
if [ $INSTALLTYPE == 'EVALMODE' ]; then if [ $INSTALLTYPE == 'EVAL' ]; then
echo -e "XXX\n0\nCreating Bond Interface... \nXXX" echo -e "XXX\n0\nCreating Bond Interface... \nXXX"
create_sensor_bond >> $SETUPLOG 2>&1 create_sensor_bond >> $SETUPLOG 2>&1
fi fi
@@ -660,7 +662,7 @@ if (whiptail_you_sure) ; then
echo -e "XXX\n45\nInstalling Kibana... \nXXX" echo -e "XXX\n45\nInstalling Kibana... \nXXX"
salt-call state.apply kibana >> $SETUPLOG 2>&1 salt-call state.apply kibana >> $SETUPLOG 2>&1
if [ $INSTALLTYPE == 'EVALMODE' ]; then if [ $INSTALLTYPE == 'EVAL' ]; then
echo -e "XXX\n50\nInstalling pcap... \nXXX" echo -e "XXX\n50\nInstalling pcap... \nXXX"
salt-call state.apply pcap >> $SETUPLOG 2>&1 salt-call state.apply pcap >> $SETUPLOG 2>&1
echo -e "XXX\n52\nInstalling Suricata... \nXXX" echo -e "XXX\n52\nInstalling Suricata... \nXXX"

6
setup/so-whiptail
View File

@@ -249,10 +249,10 @@ whiptail_install_type() {
# What kind of install are we doing? # What kind of install are we doing?
INSTALLTYPE=$(whiptail --title "Security Onion Setup" --radiolist \ INSTALLTYPE=$(whiptail --title "Security Onion Setup" --radiolist \
"Choose Install Type:" 20 75 13 \ "Choose Install Type:" 20 75 13 \
"SENSORONLY" "Create a forward only sensor" ON \ "SENSOR" "Create a forward only sensor" ON \
"SEARCHNODE" "Add a Search Node with parsing" OFF \ "SEARCHNODE" "Add a Search Node with parsing" OFF \
"MASTERONLY" "Start a new grid" OFF \ "MASTER" "Start a new grid" OFF \
"EVALMODE" "Evaluate all the things" OFF \ "EVAL" "Evaluate all the things" OFF \
"MASTERSEARCH" "Master + Search Node" OFF \ "MASTERSEARCH" "Master + Search Node" OFF \
"HEAVYNODE" "Sensor + Search Node" OFF \ "HEAVYNODE" "Sensor + Search Node" OFF \
"HELIXSENSOR" "Connect this sensor to FireEye Helix" OFF \ "HELIXSENSOR" "Connect this sensor to FireEye Helix" OFF \