From 76e3118bd3af981fd1867bb62cfee42831c41961 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Sun, 21 Jun 2020 08:33:09 -0400 Subject: [PATCH 1/4] Split Sensoroni and Stenographer executables into separate images --- salt/pcap/files/sensoroni.json | 1 + salt/pcap/init.sls | 59 +++++++++++++++++++++++++--------- 2 files changed, 45 insertions(+), 15 deletions(-) diff --git a/salt/pcap/files/sensoroni.json b/salt/pcap/files/sensoroni.json index 81776b021..ed673d969 100644 --- a/salt/pcap/files/sensoroni.json +++ b/salt/pcap/files/sensoroni.json @@ -12,6 +12,7 @@ "apiKey": "{{ SENSORONIKEY }}" }, "stenoquery": { + "executablePath": "/opt/sensoroni/scripts/stenoquery.sh", "pcapInputPath": "/nsm/pcap", "pcapOutputPath": "/nsm/pcapout" } diff --git a/salt/pcap/init.sls b/salt/pcap/init.sls index 93203ca5b..9910507b7 100644 --- a/salt/pcap/init.sls +++ b/salt/pcap/init.sls @@ -20,19 +20,28 @@ # PCAP Section -# Create the logstash group stenographergroup: group.present: - name: stenographer - gid: 941 -# Add the logstash user for the jog4j settings stenographer: user.present: - uid: 941 - gid: 941 - home: /opt/so/conf/steno +sensoronigroup: + group.present: + - name: sensoroni + - gid: 948 + +sensoroni: + user.present: + - uid: 948 + - gid: 948 + - home: /opt/so/conf/steno + stenoconfdir: file.directory: - name: /opt/so/conf/steno @@ -58,8 +67,8 @@ stenoconf: file.managed: - name: /opt/so/conf/steno/config - source: salt://pcap/files/config - - user: root - - group: root + - user: stenographer + - group: stenographer - mode: 644 - template: jinja - defaults: @@ -67,10 +76,10 @@ stenoconf: sensoroniagentconf: file.managed: - - name: /opt/so/conf/steno/sensoroni.json + - name: /opt/so/conf/sensoroni/sensoroni.json - source: salt://pcap/files/sensoroni.json - - user: stenographer - - group: stenographer + - user: sensoroni + - group: sensoroni - mode: 600 - template: jinja @@ -97,8 +106,8 @@ pcaptmpdir: pcapoutdir: file.directory: - name: /nsm/pcapout - - user: 941 - - group: 941 + - user: sensoroni + - group: sensoroni - makedirs: True pcapindexdir: @@ -115,23 +124,43 @@ stenolog: - group: 941 - makedirs: True +pcap_network: + docker_network.present + so-steno: docker_container.running: - image: {{ MASTER }}:5000/soshybridhunter/so-steno:{{ VERSION }} - network_mode: host - privileged: True - - port_bindings: - - 127.0.0.1:1234:1234 + - networks: + - pcap_network: + - aliases: + - steno + - require: + - docker_network: pcap_network - binds: - /opt/so/conf/steno/certs:/etc/stenographer/certs:rw - /opt/so/conf/steno/config:/etc/stenographer/config:rw - /nsm/pcap:/nsm/pcap:rw - /nsm/pcapindex:/nsm/pcapindex:rw - /nsm/pcaptmp:/tmp:rw - - /nsm/pcapout:/nsm/pcapout:rw - /opt/so/log/stenographer:/var/log/stenographer:rw - - /opt/so/conf/steno/sensoroni.json:/opt/sensoroni/sensoroni.json:ro - - /opt/so/log/stenographer:/opt/sensoroni/logs:rw - watch: - file: /opt/so/conf/steno/config - - file: /opt/so/conf/steno/sensoroni.json + +so-sensoroni: + docker_container.running: + - image: {{ MASTER }}:5000/soshybridhunter/so-soc:{{ VERSION }} + - networks: + - pcap_network: + - aliases: + - sensoroni + - require: + - docker_network: pcap_network + - binds: + - /opt/so/conf/steno/certs:/etc/stenographer/certs:rw + - /nsm/pcapout:/nsm/pcapout:rw + - /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro + - /opt/so/log/sensoroni:/opt/sensoroni/logs:rw + - watch: + - file: /opt/so/conf/sensoroni/sensoroni.json From 81ed656ba041aff5df362aaea6bd0466410621de Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Sun, 21 Jun 2020 10:50:10 -0400 Subject: [PATCH 2/4] Bind both steno and sensoroni processes to host network --- salt/pcap/init.sls | 49 +++++++++++++++++++--------------------------- 1 file changed, 20 insertions(+), 29 deletions(-) diff --git a/salt/pcap/init.sls b/salt/pcap/init.sls index 9910507b7..310b7e153 100644 --- a/salt/pcap/init.sls +++ b/salt/pcap/init.sls @@ -31,17 +31,6 @@ stenographer: - gid: 941 - home: /opt/so/conf/steno -sensoronigroup: - group.present: - - name: sensoroni - - gid: 948 - -sensoroni: - user.present: - - uid: 948 - - gid: 948 - - home: /opt/so/conf/steno - stenoconfdir: file.directory: - name: /opt/so/conf/steno @@ -49,6 +38,13 @@ stenoconfdir: - group: 939 - makedirs: True +sensoroniconfdir: + file.directory: + - name: /opt/so/conf/sensoroni + - user: 939 + - group: 939 + - makedirs: True + {% if BPF_STENO %} {% set BPF_CALC = salt['cmd.script']('/usr/sbin/so-bpf-compile', INTERFACE + ' ' + BPF_STENO|join(" "),cwd='/root') %} {% if BPF_CALC['stderr'] == "" %} @@ -78,8 +74,8 @@ sensoroniagentconf: file.managed: - name: /opt/so/conf/sensoroni/sensoroni.json - source: salt://pcap/files/sensoroni.json - - user: sensoroni - - group: sensoroni + - user: 939 + - group: 939 - mode: 600 - template: jinja @@ -106,8 +102,8 @@ pcaptmpdir: pcapoutdir: file.directory: - name: /nsm/pcapout - - user: sensoroni - - group: sensoroni + - user: 939 + - group: 939 - makedirs: True pcapindexdir: @@ -124,20 +120,20 @@ stenolog: - group: 941 - makedirs: True -pcap_network: - docker_network.present +sensoronilog: + file.directory: + - name: /opt/so/log/sensoroni + - user: 939 + - group: 939 + - makedirs: True so-steno: docker_container.running: - image: {{ MASTER }}:5000/soshybridhunter/so-steno:{{ VERSION }} - network_mode: host - privileged: True - - networks: - - pcap_network: - - aliases: - - steno - - require: - - docker_network: pcap_network + - port_bindings: + - 127.0.0.1:1234:1234 - binds: - /opt/so/conf/steno/certs:/etc/stenographer/certs:rw - /opt/so/conf/steno/config:/etc/stenographer/config:rw @@ -151,12 +147,7 @@ so-steno: so-sensoroni: docker_container.running: - image: {{ MASTER }}:5000/soshybridhunter/so-soc:{{ VERSION }} - - networks: - - pcap_network: - - aliases: - - sensoroni - - require: - - docker_network: pcap_network + - network_mode: host - binds: - /opt/so/conf/steno/certs:/etc/stenographer/certs:rw - /nsm/pcapout:/nsm/pcapout:rw From 1ee3625f6104695e005ab554bf24b39b5847c113 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Sun, 21 Jun 2020 15:46:36 -0400 Subject: [PATCH 3/4] Ensure certs dir is group readable by socore since Sensoroni process will need to read the client key --- salt/pcap/init.sls | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/pcap/init.sls b/salt/pcap/init.sls index 310b7e153..02a2e23d8 100644 --- a/salt/pcap/init.sls +++ b/salt/pcap/init.sls @@ -83,7 +83,7 @@ stenoca: file.directory: - name: /opt/so/conf/steno/certs - user: 941 - - group: 941 + - group: 939 pcapdir: file.directory: From d7693f9b555704b030d2da6cfa71128c81dff04f Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Mon, 22 Jun 2020 08:27:43 -0400 Subject: [PATCH 4/4] Expose pcap dir to sensoroni for epoch discovery --- salt/pcap/init.sls | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/pcap/init.sls b/salt/pcap/init.sls index 02a2e23d8..bcf09b765 100644 --- a/salt/pcap/init.sls +++ b/salt/pcap/init.sls @@ -150,6 +150,7 @@ so-sensoroni: - network_mode: host - binds: - /opt/so/conf/steno/certs:/etc/stenographer/certs:rw + - /nsm/pcap:/nsm/pcap:rw - /nsm/pcapout:/nsm/pcapout:rw - /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro - /opt/so/log/sensoroni:/opt/sensoroni/logs:rw