mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
Merge pull request #9939 from Security-Onion-Solutions/kilo
automated testing support; removal of nonexistent ScanRuby strelka scanner
This commit is contained in:
Jason Ertel
GitHub
@@ -23,6 +23,7 @@ if [[ $# -lt 1 ]]; then
|
||||
echo " accept: Accepts a new key and adds the minion files"
|
||||
echo " delete: Removes the key and deletes the minion files"
|
||||
echo " reject: Rejects a key"
|
||||
echo " test: Ingest test data"
|
||||
echo ""
|
||||
exit 1
|
||||
fi
|
||||
@@ -75,6 +76,22 @@ function getinstallinfo() {
|
||||
source <(echo $INSTALLVARS)
|
||||
}
|
||||
|
||||
function testminion() {
|
||||
# Always run on the host, since this is going to be the manager of a distributed grid, or an eval/standalone.
|
||||
# Distributed managers must run this in order for the sensor nodes to have access to the so-tcpreplay image.
|
||||
so-test
|
||||
result=$?
|
||||
|
||||
# If this so-minion script is not running on the given minion ID, run so-test remotely on the sensor as well
|
||||
local_id=$(lookup_grain id)
|
||||
if [[ ! "$local_id" =~ "${MINION_ID}_" ]]; then
|
||||
salt "$MINION_ID" cmd.run 'so-test'
|
||||
result=$?
|
||||
fi
|
||||
|
||||
exit $result
|
||||
}
|
||||
|
||||
function listminions() {
|
||||
salt-key list -F --out=json
|
||||
exit $?
|
||||
@@ -277,3 +294,7 @@ if [[ "$OPERATION" = 'add' || "$OPERATION" = 'setup' ]]; then
|
||||
create$NODETYPE
|
||||
echo "Minion file created for $MINION_ID"
|
||||
fi
|
||||
|
||||
if [[ "$OPERATION" = 'test' ]]; then
|
||||
testminion
|
||||
fi
|
||||
@@ -17,6 +17,6 @@ salt-call state.apply playbook,playbook.automation_user_create
|
||||
|
||||
/usr/sbin/so-soctopus-restart
|
||||
|
||||
echo "Importing Plays - this will take some time...."
|
||||
echo "Importing Plays - NOTE: this will continue after installation finishes and could take an hour or more. Rebooting while the import is in progress will delay playbook imports."
|
||||
sleep 5
|
||||
so-playbook-ruleupdate >> /root/setup_playbook_rule_update.log 2>&1 &
|
||||
|
||||
@@ -24,12 +24,14 @@ def showUsage(options, args):
|
||||
print(' -h - Prints this usage information')
|
||||
print(' -q - Suppress output; useful for automation of exit code value')
|
||||
print(' -j - Output in JSON format')
|
||||
print(' -i - Consider the installation outcome regardless of whether the system appears healthy')
|
||||
print('')
|
||||
print(' Exit codes:')
|
||||
print(' 0 - Success, system appears to be running correctly')
|
||||
print(' 1 - Error, one or more subsystems are not running')
|
||||
print(' 2 - System is starting')
|
||||
print(' 99 - Installation in progress')
|
||||
print(' 100 - System installation encountered errors')
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
@@ -38,6 +40,16 @@ def fail(msg):
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
def check_installation_status(options, console):
|
||||
if "-i" in options:
|
||||
if os.path.isfile('/root/failure'):
|
||||
return 100
|
||||
if os.path.isfile('/root/success'):
|
||||
return 0
|
||||
return 99
|
||||
return 0
|
||||
|
||||
|
||||
def check_system_status(options, console):
|
||||
code = 0
|
||||
highstate_end_time = 0
|
||||
@@ -66,6 +78,8 @@ def output(options, console, code, data):
|
||||
console.print(" [bold yellow]:hourglass: [bold white]System appears to be starting. No highstate has completed since the system was restarted.")
|
||||
elif code == 99:
|
||||
console.print(" [bold red]:exclamation: [bold white]Installation does not appear to be complete. A highstate has not fully completed.")
|
||||
elif code == 100:
|
||||
console.print(" [bold red]:exclamation: [bold white]Installation encountered errors.")
|
||||
else:
|
||||
table = Table(title = "Security Onion Status", show_edge = False, safe_box = True, box = box.MINIMAL)
|
||||
table.add_column("Container", justify="right", style="white", no_wrap=True)
|
||||
@@ -137,7 +151,9 @@ def check_container_status(options, console):
|
||||
|
||||
def check_status(options, console):
|
||||
container_list = []
|
||||
code = check_system_status(options, console)
|
||||
code = check_installation_status(options, console)
|
||||
if code == 0:
|
||||
code = check_system_status(options, console)
|
||||
if code == 0:
|
||||
code, container_list = check_container_status(options, console)
|
||||
output(options, console, code, container_list)
|
||||
@@ -150,9 +166,8 @@ def main():
|
||||
for option in args:
|
||||
if option.startswith("-"):
|
||||
options.append(option)
|
||||
args.remove(option)
|
||||
|
||||
if len(args) != 0 or "-h" in options:
|
||||
if "-h" in options or "--help" in options or "-?" in options:
|
||||
showUsage(options, None)
|
||||
|
||||
if os.environ["USER"] != "root":
|
||||
|
||||
@@ -496,19 +496,6 @@ EOF
|
||||
fi
|
||||
}
|
||||
|
||||
function migrateLockedUsers() {
|
||||
# This is a migration function to convert locked users from prior to 2.3.90
|
||||
# to inactive users using the newer Kratos functionality. This should only
|
||||
# find locked users once.
|
||||
lockedEmails=$(curl -s ${kratosUrl}/identities | jq -r '.[] | select(.traits.status == "locked") | .traits.email')
|
||||
if [[ -n "$lockedEmails" ]]; then
|
||||
echo "Disabling locked users..."
|
||||
for email in $lockedEmails; do
|
||||
updateStatus "$email" locked
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
function updateStatus() {
|
||||
email=$1
|
||||
status=$2
|
||||
@@ -703,11 +690,6 @@ case "${operation}" in
|
||||
echo "Password is acceptable"
|
||||
;;
|
||||
|
||||
"migrate")
|
||||
migrateLockedUsers
|
||||
echo "User migration complete"
|
||||
;;
|
||||
|
||||
*)
|
||||
fail "Unsupported operation: $operation"
|
||||
usage
|
||||
|
||||
@@ -308,11 +308,6 @@ strelka:
|
||||
priority: 5
|
||||
options:
|
||||
limit: 1000
|
||||
'ScanRuby':
|
||||
- positive:
|
||||
flavors:
|
||||
- 'text/x-ruby'
|
||||
priority: 5
|
||||
'ScanSwf':
|
||||
- positive:
|
||||
flavors:
|
||||
|
||||
@@ -1,67 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
#BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=Distributed-manager
|
||||
install_type=MANAGER
|
||||
INTERWEBS=AIRGAP
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,68 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
# ALLOW_CIDR=0.0.0.0/0
|
||||
# ALLOW_ROLE=a
|
||||
# BASICZEEK=7
|
||||
# BASICSURI=7
|
||||
# BLOGS=
|
||||
# BNICS=eth1
|
||||
# ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=distributed-search
|
||||
install_type=SEARCHNODE
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
# MANAGERADV=BASIC
|
||||
MANAGERUPDATES=1
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
MSRV=distributed-manager
|
||||
MSRVIP=10.66.166.52
|
||||
# MTU=
|
||||
# NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
# OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
# PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
# REDIRECTINFO=IP
|
||||
# RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
# STRELKA=1
|
||||
# THEHIVE=0
|
||||
# WAZUH=1
|
||||
# WEBUSER=onionuser@somewhere.invalid
|
||||
# WEBPASSWD1=0n10nus3r
|
||||
# WEBPASSWD2=0n10nus3r
|
||||
@@ -1,68 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
# ALLOW_CIDR=0.0.0.0/0
|
||||
# ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=Distributed-sensor
|
||||
install_type=SENSOR
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
# MANAGERADV=BASIC
|
||||
MANAGERUPDATES=1
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
MSRV=distributed-manager
|
||||
MSRVIP=10.66.166.52
|
||||
# MTU=
|
||||
# NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
# NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
# OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
# PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
# REDIRECTINFO=IP
|
||||
# RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
# STRELKA=1
|
||||
# THEHIVE=0
|
||||
# WAZUH=1
|
||||
# WEBUSER=onionuser@somewhere.invalid
|
||||
# WEBPASSWD1=0n10nus3r
|
||||
# WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
#BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=distributed-manager
|
||||
install_type=MANAGER
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
REDIRECTHOST=$(cat /root/public_ip)
|
||||
REDIRECTINFO=OTHER
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=0
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,68 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
#ALLOW_CIDR=0.0.0.0/0
|
||||
#ALLOW_ROLE=a
|
||||
#BASICZEEK=7
|
||||
#BASICSURI=7
|
||||
# BLOGS=
|
||||
#BNICS=ens6
|
||||
#ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=distributed-search
|
||||
install_type=SEARCHNODE
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
#MANAGERADV=BASIC
|
||||
MANAGERUPDATES=1
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
MSRV=distributed-manager
|
||||
MSRVIP=10.99.1.20
|
||||
# MTU=
|
||||
#NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
#OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
#PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
#REDIRECTINFO=HOSTNAME
|
||||
#RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=0
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
#STRELKA=1
|
||||
#THEHIVE=0
|
||||
#WAZUH=1
|
||||
# WEBUSER=onionuser@somewhere.invalid
|
||||
# WEBPASSWD1=0n10nus3r
|
||||
# WEBPASSWD2=0n10nus3r
|
||||
@@ -1,68 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
#ALLOW_CIDR=0.0.0.0/0
|
||||
#ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=distributed-sensor
|
||||
install_type=SENSOR
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
#MANAGERADV=BASIC
|
||||
MANAGERUPDATES=1
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
MSRV=distributed-manager
|
||||
MSRVIP=10.99.1.20
|
||||
# MTU=
|
||||
#NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
#NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
#OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
#PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
#REDIRECTINFO=HOSTNAME
|
||||
#RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=0
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
#STRELKA=1
|
||||
#THEHIVE=0
|
||||
#WAZUH=1
|
||||
# WEBUSER=onionuser@somewhere.invalid
|
||||
# WEBPASSWD1=0n10nus3r
|
||||
# WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=7
|
||||
BASICSURI=7
|
||||
# BLOGS=
|
||||
#BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=distributed-manager
|
||||
install_type=MANAGER
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,68 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
# ALLOW_CIDR=0.0.0.0/0
|
||||
# ALLOW_ROLE=a
|
||||
# BASICZEEK=7
|
||||
# BASICSURI=7
|
||||
# BLOGS=
|
||||
# BNICS=eth1
|
||||
# ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=distributed-search
|
||||
install_type=SEARCHNODE
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
# MANAGERADV=BASIC
|
||||
MANAGERUPDATES=1
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
MSRV=distributed-manager
|
||||
MSRVIP=10.66.166.42
|
||||
# MTU=
|
||||
# NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=ADVANCED
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
# OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
# PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
# REDIRECTINFO=IP
|
||||
# RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
# STRELKA=1
|
||||
# THEHIVE=0
|
||||
# WAZUH=1
|
||||
# WEBUSER=onionuser@somewhere.invalid
|
||||
# WEBPASSWD1=0n10nus3r
|
||||
# WEBPASSWD2=0n10nus3r
|
||||
@@ -1,70 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
# ALLOW_CIDR=0.0.0.0/0
|
||||
# ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=Distributed-Sensor
|
||||
install_type=SENSOR
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
# MANAGERADV=BASIC
|
||||
MANAGERUPDATES=1
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
MSRV=distributed-manager
|
||||
MSRVIP=10.66.166.42
|
||||
MTU=1500
|
||||
# NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
# NODESETUP=NODEBASIC
|
||||
NSMSETUP=ADVANCED
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
# OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
# PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
# REDIRECTINFO=IP
|
||||
# RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
# STRELKA=1
|
||||
SURIPINS=(2 3)
|
||||
# THEHIVE=0
|
||||
# WAZUH=1
|
||||
# WEBUSER=onionuser@somewhere.invalid
|
||||
# WEBPASSWD1=0n10nus3r
|
||||
# WEBPASSWD2=0n10nus3r
|
||||
ZEEKPINS=(0 1)
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=7
|
||||
BASICSURI=7
|
||||
# BLOGS=
|
||||
#BNICS=eth1
|
||||
ZEEKVERSION=SURICATA
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=distributed-manager
|
||||
install_type=MANAGER
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,68 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
# ALLOW_CIDR=0.0.0.0/0
|
||||
# ALLOW_ROLE=a
|
||||
# BASICZEEK=7
|
||||
# BASICSURI=7
|
||||
# BLOGS=
|
||||
# BNICS=eth1
|
||||
# ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=distributed-search
|
||||
install_type=SEARCHNODE
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
# MANAGERADV=BASIC
|
||||
MANAGERUPDATES=1
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
MSRV=distributed-manager
|
||||
MSRVIP=10.66.166.72
|
||||
# MTU=
|
||||
# NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
# OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
# PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
# REDIRECTINFO=IP
|
||||
# RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
# STRELKA=1
|
||||
# THEHIVE=0
|
||||
# WAZUH=1
|
||||
# WEBUSER=onionuser@somewhere.invalid
|
||||
# WEBPASSWD1=0n10nus3r
|
||||
# WEBPASSWD2=0n10nus3r
|
||||
@@ -1,68 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
# ALLOW_CIDR=0.0.0.0/0
|
||||
# ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=SURICATA
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=distributed-sensor
|
||||
install_type=SENSOR
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
# MANAGERADV=BASIC
|
||||
MANAGERUPDATES=1
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
MSRV=distributed-manager
|
||||
MSRVIP=10.66.166.72
|
||||
# MTU=
|
||||
# NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
# NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
# OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
# PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
# REDIRECTINFO=IP
|
||||
# RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
# STRELKA=1
|
||||
# THEHIVE=0
|
||||
# WAZUH=1
|
||||
# WEBUSER=onionuser@somewhere.invalid
|
||||
# WEBPASSWD1=0n10nus3r
|
||||
# WEBPASSWD2=0n10nus3r
|
||||
@@ -1,67 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=eval
|
||||
install_type=EVAL
|
||||
INTERWEBS=AIRGAP
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=eval
|
||||
install_type=EVAL
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
REDIRECTHOST=$(cat /root/public_ip)
|
||||
REDIRECTINFO=OTHER
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=eval
|
||||
install_type=EVAL
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
# address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=eval
|
||||
install_type=EVAL
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,67 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
#BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=import
|
||||
install_type=IMPORT
|
||||
INTERWEBS=AIRGAP
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
# OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
# PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
# SOREMOTEPASS1=onionuser
|
||||
# SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
# THEHIVE=0
|
||||
# WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
#BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=import
|
||||
install_type=IMPORT
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
# OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
# PLAYBOOK=1
|
||||
REDIRECTHOST=$(cat /root/public_ip)
|
||||
REDIRECTINFO=OTHER
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
# SOREMOTEPASS1=onionuser
|
||||
# SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
# THEHIVE=0
|
||||
# WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
#BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=import
|
||||
install_type=IMPORT
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
# OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
# PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
# SOREMOTEPASS1=onionuser
|
||||
# SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
# THEHIVE=0
|
||||
# WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
# address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
#BNICS=eth1
|
||||
ZEEKVERSION=SURICATA
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=import
|
||||
install_type=IMPORT
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
# OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
# PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
# SOREMOTEPASS1=onionuser
|
||||
# SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
# THEHIVE=0
|
||||
# WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,67 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=standalone
|
||||
install_type=STANDALONE
|
||||
INTERWEBS=AIRGAP
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=standalone
|
||||
install_type=STANDALONE
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
REDIRECTHOST=$(cat /root/public_ip)
|
||||
REDIRECTINFO=OTHER
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=ZEEK
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=standalone
|
||||
install_type=STANDALONE
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -1,66 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
||||
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
||||
# https://securityonion.net/license; you may not use this file except in compliance with the
|
||||
# Elastic License 2.0.
|
||||
|
||||
|
||||
TESTING=true
|
||||
|
||||
# address_type=DHCP
|
||||
ADMINUSER=onionuser
|
||||
ADMINPASS1=onionuser
|
||||
ADMINPASS2=onionuser
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
ALLOW_ROLE=a
|
||||
BASICZEEK=2
|
||||
BASICSURI=2
|
||||
# BLOGS=
|
||||
BNICS=eth1
|
||||
ZEEKVERSION=SURICATA
|
||||
# CURCLOSEDAYS=
|
||||
# EVALADVANCED=BASIC
|
||||
# HELIXAPIKEY=
|
||||
HNMANAGER=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12
|
||||
HNSENSOR=inherit
|
||||
HOSTNAME=standalone
|
||||
install_type=STANDALONE
|
||||
# LSINPUTBATCHCOUNT=
|
||||
# LSINPUTTHREADS=
|
||||
# LSPIPELINEBATCH=
|
||||
# LSPIPELINEWORKERS=
|
||||
MANAGERADV=BASIC
|
||||
# MDNS=
|
||||
# MGATEWAY=
|
||||
# MIP=
|
||||
# MMASK=
|
||||
MNIC=eth0
|
||||
# MSEARCH=
|
||||
# MSRV=
|
||||
# MTU=
|
||||
NIDS=Suricata
|
||||
# NODE_ES_HEAP_SIZE=
|
||||
# NODE_LS_HEAP_SIZE=
|
||||
NODESETUP=NODEBASIC
|
||||
NSMSETUP=BASIC
|
||||
NODEUPDATES=MANAGER
|
||||
# OINKCODE=
|
||||
OSQUERY=1
|
||||
# PATCHSCHEDULEDAYS=
|
||||
# PATCHSCHEDULEHOURS=
|
||||
PATCHSCHEDULENAME=auto
|
||||
PLAYBOOK=1
|
||||
# REDIRECTHOST=
|
||||
REDIRECTINFO=IP
|
||||
RULESETUP=ETOPEN
|
||||
# SHARDCOUNT=
|
||||
# SKIP_REBOOT=
|
||||
SOREMOTEPASS1=onionuser
|
||||
SOREMOTEPASS2=onionuser
|
||||
STRELKA=1
|
||||
THEHIVE=0
|
||||
WAZUH=1
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
@@ -17,11 +17,11 @@ log() {
|
||||
}
|
||||
|
||||
error() {
|
||||
log "$1" "E"
|
||||
log "$1" "ERROR"
|
||||
}
|
||||
|
||||
info() {
|
||||
log "$1" "I"
|
||||
log "$1" "INFO"
|
||||
}
|
||||
|
||||
title() {
|
||||
@@ -68,9 +68,7 @@ add_web_user() {
|
||||
wait_for_file /nsm/kratos/db/db.sqlite 30 5
|
||||
{
|
||||
info "Attempting to add administrator user for web interface...";
|
||||
export SKIP_STATE_APPLY=true
|
||||
echo "$WEBPASSWD1" | /usr/sbin/so-user add --email "$WEBUSER" --role "superuser";
|
||||
unset SKIP_STATE_APPLY
|
||||
info "Add user result: $?";
|
||||
} >> "/root/so-user-add.log" 2>&1
|
||||
}
|
||||
@@ -322,7 +320,7 @@ collect_hostname() {
|
||||
}
|
||||
|
||||
collect_hostname_validate() {
|
||||
if [[ $automated == no ]] && [[ "$HOSTNAME" == *'localhost'* ]]; then HOSTNAME=securityonion; fi
|
||||
if [[ -z "$TESTING" ]] && [[ "$HOSTNAME" == *'localhost'* ]]; then HOSTNAME=securityonion; fi
|
||||
|
||||
whiptail_set_hostname "$HOSTNAME"
|
||||
|
||||
@@ -1600,6 +1598,15 @@ networking_needful() {
|
||||
fi
|
||||
set_main_ip
|
||||
compare_main_nic_ip
|
||||
|
||||
# Attempt to autodetect the manager IP, if an offset value exists
|
||||
if [[ -n "$MSRVIP_OFFSET" && -z "$MSRVIP" ]]; then
|
||||
mips1=$(echo "$MNIC_IP" | awk -F. '{print $1}')
|
||||
mips2=$(echo "$MNIC_IP" | awk -F. '{print $2}')
|
||||
mips3=$(echo "$MNIC_IP" | awk -F. '{print $3}')
|
||||
mips4=$(echo "$MNIC_IP" | awk -F. '{print $4}')
|
||||
MSRVIP="$mips1.$mips2.$mips3.$((mips4+$MSRVIP_OFFSET))"
|
||||
fi
|
||||
}
|
||||
|
||||
network_setup() {
|
||||
@@ -1766,6 +1773,10 @@ reinstall_init() {
|
||||
|
||||
local service_retry_count=20
|
||||
|
||||
# Disregard previous install outcomes
|
||||
rm -f /root/failure
|
||||
rm -f /root/success
|
||||
|
||||
{
|
||||
# remove all of root's cronjobs
|
||||
logCmd "crontab -r -u root"
|
||||
@@ -2269,20 +2280,20 @@ set_initial_firewall_policy() {
|
||||
title "Setting Initial Firewall Policy"
|
||||
if [ -f $default_salt_dir/salt/common/tools/sbin/so-firewall ]; then chmod +x $default_salt_dir/salt/common/tools/sbin/so-firewall; fi
|
||||
|
||||
case "$install_type" in
|
||||
'MANAGER')
|
||||
$default_salt_dir/salt/common/tools/sbin/so-firewall --role=manager --ip=$MAINIP --apply=true
|
||||
;;
|
||||
'EVAL' | 'MANAGERSEARCH' | 'STANDALONE' | 'IMPORT')
|
||||
$default_salt_dir/salt/common/tools/sbin/so-firewall --role=$install_type --ip=$MAINIP --apply=true
|
||||
;;
|
||||
esac
|
||||
case "$install_type" in
|
||||
'EVAL' | 'MANAGER' | 'MANAGERSEARCH' | 'STANDALONE' | 'IMPORT')
|
||||
$default_salt_dir/salt/common/tools/sbin/so-firewall --role=$install_type --ip=$MAINIP --apply=true
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
set_initial_firewall_access() {
|
||||
if [[ ! -z "$ALLOW_CIDR" ]]; then
|
||||
$default_salt_dir/salt/common/tools/sbin/so-firewall --role=analyst --ip=$ALLOW_CIDR --apply=true
|
||||
fi
|
||||
if [[ ! -z "$MINION_CIDR" ]]; then
|
||||
$default_salt_dir/salt/common/tools/sbin/so-firewall --role=sensors --ip=$MINION_CIDR --apply=true
|
||||
fi
|
||||
}
|
||||
|
||||
# Set up the management interface on the ISO
|
||||
|
||||
@@ -37,10 +37,10 @@ source ./so-variables
|
||||
|
||||
# Parse command line arguments
|
||||
setup_type=$1
|
||||
automation=$2
|
||||
test_profile=$2
|
||||
|
||||
WHATWOULDYOUSAYYAHDOHERE=setup
|
||||
|
||||
# This is for automation
|
||||
while [[ $# -gt 0 ]]; do
|
||||
arg="$1"
|
||||
shift
|
||||
@@ -49,12 +49,8 @@ while [[ $# -gt 0 ]]; do
|
||||
export TURBO="http://${arg#*=}";;
|
||||
"--proxy="* )
|
||||
export {http,https,ftp,rsync,all}_proxy="${arg#*=}";;
|
||||
"--allow-role="* )
|
||||
export ALLOW_ROLE="${arg#*=}";;
|
||||
"--allow-cidr="* )
|
||||
export ALLOW_CIDR="${arg#*=}";;
|
||||
"--skip-reboot" )
|
||||
export SKIP_REBOOT=1;;
|
||||
* )
|
||||
if [[ "$arg" == "--"* ]]; then
|
||||
echo "Invalid option"
|
||||
@@ -166,41 +162,65 @@ catch() {
|
||||
exit 1
|
||||
}
|
||||
|
||||
automated=no
|
||||
|
||||
# Add the progress function for manager node type installs
|
||||
progress() {
|
||||
local msg=${1:-'Please wait while installing...'}
|
||||
|
||||
if [ $automated == no ]; then
|
||||
if [ -z "$TESTING" ]; then
|
||||
whiptail --title "$whiptail_title" --gauge "$msg" 6 70 0 # append to text
|
||||
else
|
||||
cat >> $setup_log 2>&1
|
||||
fi
|
||||
}
|
||||
|
||||
# If using automation let's do automation things.
|
||||
if [[ -f automation/$automation && $(basename $automation) == $automation ]]; then
|
||||
info "Preselecting variable values based on automated setup: $automation"
|
||||
source automation/$automation
|
||||
automated=yes
|
||||
if [ -n "$test_profile" ]; then
|
||||
install_type="$(echo $test_profile |awk -F- '{print $1}')"
|
||||
if [[ "$install_type" == "distributed" ]]; then
|
||||
install_type=MANAGER
|
||||
else
|
||||
install_type=${install_type^^}
|
||||
fi
|
||||
|
||||
attempt=1
|
||||
attempts=60
|
||||
ip a | grep "$MNIC:" | grep "state UP" >> $setup_log 2>&1
|
||||
while [ $? -ne 0 ]; do
|
||||
logCmd "ip a"
|
||||
if [ $attempt -gt $attempts ]; then
|
||||
error "Network unavailable - setup cannot continue"
|
||||
exit 1
|
||||
fi
|
||||
info "Waiting for network to come up (attempt $attempt of $attempts)"
|
||||
attempt=$((attempt + 1))
|
||||
info "Sleeping 10s to try again"
|
||||
sleep 10;
|
||||
logCmd "ip a | grep '$MNIC:' | grep 'state UP'"
|
||||
done
|
||||
info "Network is up on $MNIC"
|
||||
# The below settings are hardcoded purely for automated testing purposes.
|
||||
TESTING=true
|
||||
|
||||
if [[ "$test_profile" =~ "-sensor" ]]; then
|
||||
install_type=SENSOR
|
||||
HOSTNAME=sensor
|
||||
MSRVIP_OFFSET=-2
|
||||
elif [[ "$test_profile" =~ "-search" ]]; then
|
||||
install_type=SEARCHNODE
|
||||
HOSTNAME=search
|
||||
MSRVIP_OFFSET=-1
|
||||
else
|
||||
HOSTNAME=manager
|
||||
fi
|
||||
|
||||
info "Activating test profile; profile=$test_profile; install_type=$install_type"
|
||||
|
||||
MINION_CIDR=10.0.0.0/8
|
||||
MSRV=manager
|
||||
if [[ "$test_profile" =~ "-net" ]]; then
|
||||
address_type=DHCP
|
||||
elif [[ "$test_profile" =~ "-cloud" ]]; then
|
||||
MSRVIP=10.99.1.20
|
||||
elif [[ "$test_profile" =~ "-airgap" ]]; then
|
||||
is_airgap=true
|
||||
fi
|
||||
|
||||
if [ -f "/root/public_ip" ]; then
|
||||
REDIRECTHOST=$(cat /root/public_ip)
|
||||
REDIRECTINFO=OTHER
|
||||
else
|
||||
REDIRECTINFO=IP
|
||||
fi
|
||||
|
||||
ALLOW_CIDR=0.0.0.0/0
|
||||
MNIC=$(ls -1 /sys/class/net | head -1)
|
||||
BNICS=$(ls -1 /sys/class/net | head -2 | tail -1)
|
||||
WEBUSER=onionuser@somewhere.invalid
|
||||
WEBPASSWD1=0n10nus3r
|
||||
WEBPASSWD2=0n10nus3r
|
||||
fi
|
||||
|
||||
# Make sure the setup type is suppoted.
|
||||
@@ -227,7 +247,7 @@ dmesg -D
|
||||
|
||||
# Kernel consoleblank is causing whiptail progress screen to appear to hang #1084
|
||||
# https://github.com/Security-Onion-Solutions/securityonion/issues/1084
|
||||
if [ "$automated" == no ]; then
|
||||
if [ -z "$TESTING" ]; then
|
||||
TTY=$(tty)
|
||||
info "Setup is running on TTY $TTY"
|
||||
if echo $TTY | grep -q "/dev/tty"; then
|
||||
@@ -283,7 +303,7 @@ if ! [[ -f $install_opt_file ]]; then
|
||||
compare_main_nic_ip
|
||||
|
||||
fi
|
||||
if [[ $setup_type == 'iso' ]] && [ "$automated" == no ]; then
|
||||
if [[ $setup_type == 'iso' ]] && [ -z "$TESTING" ]; then
|
||||
whiptail_first_menu_iso
|
||||
if [[ $option == "CONFIGURENETWORK" ]]; then
|
||||
collect_hostname
|
||||
@@ -454,7 +474,7 @@ if ! [[ -f $install_opt_file ]]; then
|
||||
add_mngr_ip_to_hosts
|
||||
check_manager_connection
|
||||
collect_idh_services
|
||||
collect_idh_preferences
|
||||
collect_idh_preferences
|
||||
set_minion_info
|
||||
whiptail_end_settings
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ log_has_errors() {
|
||||
# Ignore Failed: 0 since that is the salt state output, and we detect state failures
|
||||
# via Result: False already.
|
||||
|
||||
grep -E "FAILED|Failed|failed|ERROR|Error|Result: False" "$setup_log" | \
|
||||
grep -E "FAILED|Failed|failed|ERROR|Result: False" "$setup_log" | \
|
||||
grep -vE "The Salt Master has cached the public key for this node" | \
|
||||
grep -vE "Minion failed to authenticate with the master" | \
|
||||
grep -vE "Failed to connect to ::1" | \
|
||||
@@ -79,21 +79,52 @@ status_failed() {
|
||||
return 1
|
||||
}
|
||||
|
||||
# Creates scripts that are going to be invoked by the automated test system. These scripts will
|
||||
# overwritten by Salt, once the minion is accepted into the grid and the salt states run.
|
||||
create_temp_scripts_if_missing() {
|
||||
if [ ! -f /usr/sbin/so-status ]; then
|
||||
if [ -f /root/success ]; then
|
||||
echo "echo 'so-status not yet available'" > /usr/sbin/so-status
|
||||
echo "exit 0" >> /usr/sbin/so-status
|
||||
|
||||
# Pretend so-test succeeded in the interim period while waiting for this minion to be accepted. This avoids tests getting hung up.
|
||||
echo "echo 'so-test not yet available'" > /usr/sbin/so-test
|
||||
echo "exit 0" >> /usr/sbin/so-test
|
||||
chmod a+x /usr/sbin/so-test
|
||||
else
|
||||
echo "echo 'Installation failed - so-status not available'" > /usr/sbin/so-status
|
||||
echo "exit 100" >> /usr/sbin/so-status
|
||||
fi
|
||||
chmod a+x /usr/sbin/so-status
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
exit_code=0
|
||||
if log_has_errors; then
|
||||
echo "WARNING: Errors detected during setup"
|
||||
if [ -f /root/success ]; then
|
||||
echo "Successfully completed setup a while ago"
|
||||
elif [ -f /root/failure ]; then
|
||||
echo "WARNING: Failed setup a while ago"
|
||||
exit_code=1
|
||||
elif log_has_errors; then
|
||||
echo "WARNING: Errors detected during setup"
|
||||
exit_code=1
|
||||
touch /root/failure
|
||||
elif using_iso && cron_error_in_mail_spool; then
|
||||
echo "WARNING: Unexpected cron job output in mail spool"
|
||||
echo "WARNING: Unexpected cron job output in mail spool"
|
||||
exit_code=1
|
||||
touch /root/failure
|
||||
elif is_manager_node && status_failed; then
|
||||
echo "WARNING: Containers are not in a healthy state"
|
||||
exit_code=1
|
||||
touch /root/failure
|
||||
else
|
||||
echo "Successfully completed setup!"
|
||||
fi
|
||||
echo "Successfully completed setup!"
|
||||
touch /root/success
|
||||
fi
|
||||
|
||||
create_temp_scripts_if_missing
|
||||
|
||||
exit $exit_code
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user