crappyrules/mistborn
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

initial plugins

Browse Source
This commit is contained in:
Steven Foerster
2021-12-02 12:13:26 -05:00
parent d4c43c527d
commit 78b9bf997a
71 changed files with 114 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/services/Mistborn-bitwarden.service
-25
View File
@@ -1,25 +0,0 @@
[Unit]
Description=Mistborn Bitwarden Service
Requires=Mistborn-base.service
After=Mistborn-base.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml down
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-compose -f /opt/mistborn/extra/bitwarden.yml down
# Post stop
ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-elasticsearch.service
-22
View File
@@ -1,22 +0,0 @@
[Unit]
Description=Mistborn Elasticsearch Service
Requires=Mistborn-base.service
After=Mistborn-base.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/usr/sbin/sysctl -w vm.max_map_count=262144
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-guacamole.service
-23
View File
@@ -1,23 +0,0 @@
[Unit]
Description=Mistborn Guacamole
Requires=Mistborn-base.service
After=Mistborn-base.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml down
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-compose -f /opt/mistborn/extra/guacamole.yml down
# Post stop
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-homeassistant.service
-23
View File
@@ -1,23 +0,0 @@
[Unit]
Description=Mistborn Home Assistant
Requires=Mistborn-base.service
After=Mistborn-base.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml down
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-compose -f /opt/mistborn/extra/homeassistant.yml down
# Post stop
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-jellyfin.service
-23
View File
@@ -1,23 +0,0 @@
[Unit]
Description=Mistborn Jellyfin Service
Requires=Mistborn-nextcloud.service
After=Mistborn-nextcloud.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml down
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compose -f /opt/mistborn/extra/jellyfin.yml down
# Post stop
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-jitsi.service
-27
View File
@@ -1,27 +0,0 @@
[Unit]
Description=Mistborn Jitsi Service
Requires=Mistborn-base.service
After=Mistborn-base.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi /opt/mistborn/scripts/services/jitsi/iptables_up.sh
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down
# Post stop
ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi /opt/mistborn/scripts/services/jitsi/iptables_down.sh
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-nextcloud.service
-23
View File
@@ -1,23 +0,0 @@
[Unit]
Description=Mistborn Nextcloud Service
Requires=Mistborn-base.service
After=Mistborn-base.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml down
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-compose -f /opt/mistborn/extra/nextcloud.yml down
# Post stop
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-onlyoffice.service
-23
View File
@@ -1,23 +0,0 @@
[Unit]
Description=Mistborn OnlyOffice Service
Requires=Mistborn-base.service
After=Mistborn-base.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-compose -f /opt/mistborn/extra/onlyoffice.yml down
# Post stop
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-raspap.service
-25
View File
@@ -1,25 +0,0 @@
[Unit]
Description=Mistborn RaspAP Service
Requires=Mistborn-base.service
After=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 8095 -j MISTBORN_LOG_DROP
#ExecStartPre=/bin/bash /opt/mistborn_volumes/extra/raspap/etc-raspap/hostapd/servicestart.sh --interface uap0 --seconds 3
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml down
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml down
ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 8095 -j MISTBORN_LOG_DROP
# Post stop
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-rocketchat.service
-25
View File
@@ -1,25 +0,0 @@
[Unit]
Description=Mistborn Rocket Chat Service
Requires=Mistborn-base.service
After=Mistborn-base.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml down
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-compose -f /opt/mistborn/extra/rocketchat.yml down
# Post stop
ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-syncthing.service
-27
View File
@@ -1,27 +0,0 @@
[Unit]
Description=Mistborn Syncthing Service
Requires=Mistborn-base.service
After=Mistborn-base.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml down
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p udp --dport 21027 -j MISTBORN_LOG_DROP
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh syncthing docker-compose -f /opt/mistborn/extra/syncthing.yml down
# Post stop
ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p udp --dport 21027 -j MISTBORN_LOG_DROP
ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-tor.service
-25
View File
@@ -1,25 +0,0 @@
[Unit]
Description=Mistborn Tor Service
Requires=Mistborn-base.service
After=Mistborn-base.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml down
ExecStartPre=/sbin/iptables -w -I DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml up --build
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f /opt/mistborn/extra/tor.yml down
# Post stop
ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP
[Install]
WantedBy=Mistborn-base.service
scripts/services/Mistborn-wazuh.service
-30
View File
@@ -1,30 +0,0 @@
[Unit]
Description=Mistborn Wazuh Service
Requires=Mistborn-elasticsearch.service
After=Mistborn-elasticsearch.service
PartOf=Mistborn-base.service
[Service]
Restart=always
RestartSec=15
TimeoutStartSec=600
User=root
Group=docker
PermissionsStartOnly=true
# Shutdown container (if running) when unit is stopped
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
# Start container when unit is started
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml up --build
# Agent install
ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent.sh
ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_start.sh
# Suricata
ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_init.sh
ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_start.sh
# Stop container when unit is stopped
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_stop.sh
ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_stop.sh
[Install]
WantedBy=Mistborn-base.service
scripts/services/elasticsearch/files/internal_users.yml
-17
View File
@@ -1,17 +0,0 @@
---
# This is the internal user database
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
_meta:
type: "internalusers"
config_version: 2
# Define your internal users here
mistborn:
hash: "__MISTBORN_HASH__"
reserved: true
backend_roles:
- "admin"
description: "Mistborn user"
scripts/services/elasticsearch/init.sh
-21
View File
@@ -1,21 +0,0 @@
#!/bin/bash
set -e
if [[ -f "/opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml" ]]; then
echo "internal_users.yml exists. Proceeding."
exit 0
fi
mkdir -p /opt/mistborn_volumes/extra/elasticsearch/init/ >/dev/null 2>&1
chmod -R +x /opt/mistborn_volumes/extra/elasticsearch/init/
cp /opt/mistborn/scripts/services/elasticsearch/files/internal_users.yml /opt/mistborn_volumes/extra/elasticsearch/init/
ELASTICSEARCH_MISTBORN_HASHED="$(docker run --rm amazon/opendistro-for-elasticsearch:1.12.0 bash /usr/share/elasticsearch/plugins/opendistro_security/tools/hash.sh -p ${MISTBORN_DEFAULT_PASSWORD} | tr -d '\n')"
if [[ -z "${ELASTICSEARCH_MISTBORN_HASHED}" ]]; then
echo "Elasticsearch password hash not generated properly"
exit 1;
fi
sed -i "s|__MISTBORN_HASH__|${ELASTICSEARCH_MISTBORN_HASHED}|" /opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml
scripts/services/guacamole/init.sh
-21
View File
@@ -1,21 +0,0 @@
#!/bin/bash
if [[ -f "/opt/mistborn_volumes/extra/guacamole/init/initdb.sql" ]]; then
echo "initdb.sql exists. Proceeding."
exit 0
fi
mkdir -p /opt/mistborn_volumes/extra/guacamole/init/ >/dev/null 2>&1
chmod -R +x /opt/mistborn_volumes/extra/guacamole/init/
docker run --rm guacamole/guacamole /opt/guacamole/bin/initdb.sh --postgres > /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
# grab values in initdb.sql to replace
HEXSTRINGS=($(egrep -o [0-9a-fA-F]{64} /opt/mistborn_volumes/extra/guacamole/init/initdb.sql))
# reset default password in init.db
SALT=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice('0123456789ABCDEF') for x in range(64)]))")
GUAC_PASSWORD_HASHED=$(echo -n "${MISTBORN_DEFAULT_PASSWORD}${SALT}" | sha256sum | awk '{print $1}' | tr a-z A-Z)
sed -i "s/${HEXSTRINGS[1]}/$SALT/" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
sed -i "s/${HEXSTRINGS[0]}/$GUAC_PASSWORD_HASHED/" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
sed -i "s/guacadmin/mistborn/g" /opt/mistborn_volumes/extra/guacamole/init/initdb.sql
scripts/services/homeassistant/init.sh
-54
View File
@@ -1,54 +0,0 @@
#!/bin/bash
HASS_CONFIG="/opt/mistborn_volumes/extra/homeassistant/config/configuration.yaml"
if [[ -f "$HASS_CONFIG" ]]; then
# configuration.yaml exists
if [[ ! -z $(grep "use_x_forwarded_for: true" "$HASS_CONFIG") ]]; then
# FOUND
exit 0;
fi
# add the proxy config
# write the trusted proxies config
cat >> ${HASS_CONFIG}<< EOF
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.16.0.0/12
EOF
exit 0;
fi
# create parent directory if needed
PARENTDIR="$(dirname $HASS_CONFIG)"
if [[ ! -d "$PARENTDIR" ]]; then
mkdir -p $PARENTDIR
fi
# write the trusted proxies config
cat >> ${HASS_CONFIG}<< EOF
# Configure a default setup of Home Assistant (frontend, api, etc)
default_config:
# Text to speech
#tts:
# - platform: google_translate
#group: !include groups.yaml
#automation: !include automations.yaml
#script: !include scripts.yaml
#scene: !include scenes.yaml
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.16.0.0/12
EOF
scripts/services/jitsi/iptables_down.sh
-4
View File
@@ -1,4 +0,0 @@
#!/bin/bash
iptables -w -D DOCKER-USER -i $DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
iptables -w -D DOCKER-USER -i $DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
scripts/services/jitsi/iptables_up.sh
-4
View File
@@ -1,4 +0,0 @@
#!/bin/bash
iptables -w -I DOCKER-USER -i $DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP
iptables -w -I DOCKER-USER -i $DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP
scripts/services/wazuh/agent.sh
-30
View File
@@ -1,30 +0,0 @@
#!/bin/bash
# detect if already installed
if dpkg -s wazuh-agent &> /dev/null; then
echo "Wazuh agent already installed"
exit 0
fi
# install curl
echo "install curl"
sudo -E apt-get install -y curl
# prepare repo
echo "Adding Wazuh Repository"
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo -E apt-key add -
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo -E tee /etc/apt/sources.list.d/wazuh.list
apt-get update
# wait for service to be listening
while ! nc -z 10.2.3.1 55000; do
WAIT_TIME=10
echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
sleep ${WAIT_TIME}
done
# install
echo "Installing Wazuh agent"
WAZUH_MANAGER="10.2.3.1" apt-get install wazuh-agent
scripts/services/wazuh/agent_start.sh
-4
View File
@@ -1,4 +0,0 @@
#!/bin/bash
systemctl start wazuh-agent
systemctl enable wazuh-agent
scripts/services/wazuh/agent_stop.sh
-4
View File
@@ -1,4 +0,0 @@
#!/bin/bash
systemctl stop wazuh-agent
systemctl disable wazuh-agent
scripts/services/wazuh/suricata/suricata_init.sh
-129
View File
@@ -1,129 +0,0 @@
#!/bin/bash
set -e
# detect if suricata is installed
if [[ $(dpkg-query -W -f='${Status}' suricata 2>/dev/null | grep -c "ok installed") -eq 1 ]]; then
echo "Suricata Installed"
exit 0
fi
source /opt/mistborn/scripts/subinstallers/platform.sh
# minimal dependencies
sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev \
libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
make libmagic-dev libjansson-dev jq wget
## recommended dependencies
#sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev \
# libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
# libcap-ng-dev libcap-ng0 make libmagic-dev \
# libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \
# python-yaml rustc cargo
# iptables/nftables integration
sudo -E apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 \
libnetfilter-log-dev libnetfilter-log1 \
libnfnetlink-dev libnfnetlink0
if [ "$DISTRO" == "ubuntu" ]; then
echo "Installing Suricata Ubuntu PPA"
sudo -E add-apt-repository -y ppa:oisf/suricata-stable
sudo -E apt-get update
sudo -E apt-get install -y suricata
elif [ "$DISTRO" == "debian" ]; then
# retrieve version codename
source /etc/os-release
echo "deb http://http.debian.net/debian $VERSION_CODENAME-backports main" | \
sudo -E tee /etc/apt/sources.list.d/backports.list
sudo -E apt-get update
sudo -E apt-get install -y suricata -t ${VERSION_CODENAME}-backports
else
echo "Basic Suricata installation"
sudo -E apt-get install -y suricata
fi
# # iptables
# sudo iptables -A INPUT -j NFQUEUE
# sudo iptables -I FORWARD -j NFQUEUE
# sudo iptables -I OUTPUT -j NFQUEUE
# # rsyslog to create /var/log/suricata.log
# sudo cp ./scripts/conf/20-suricata.conf /etc/rsyslog.d/
# sudo chown root:root /etc/rsyslog.d/20-suricata.conf
# sudo systemctl restart rsyslog
# rules
pushd .
cd /tmp
wget https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz
tar zxvf emerging.rules.tar.gz
sudo -E rm /etc/suricata/rules/* -f
sudo -E mv rules/*.rules /etc/suricata/rules/
popd
# suricata yaml
sudo -E rm -f /etc/suricata/suricata.yaml
sudo -E wget -O /etc/suricata/suricata.yaml http://www.branchnetconsulting.com/wazuh/suricata.yaml
IFACE=$(ip -o -4 route show to default | awk 'NR==1{print $5}')
sudo sed -i "s/eth0/${IFACE}/g" /etc/suricata/suricata.yaml
sudo sed -i "s/eth0/${IFACE}/g" /etc/default/suricata
#systemctl restart suricata
# wait for service to be listening
while ! nc -z 10.2.3.1 55000; do
WAIT_TIME=10
echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
sleep ${WAIT_TIME}
done
# set working directory to mistborn for docker-compose
pushd .
cd /opt/mistborn
# ensure group exists
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -g suricata -q 2>/dev/null
# add this host to group
WAZUH_ID=$(sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/manage_agents -l | egrep ^\ *ID | grep $(hostname) | awk '{print $2}' | tr -d ',')
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -i ${WAZUH_ID} -g suricata -q
# write agent.conf
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh bash -c "cat > /var/ossec/etc/shared/suricata/agent.conf << EOF
<agent_config>
<localfile>
<log_format>json</log_format>
<location>/var/log/suricata/eve.json</location>
</localfile>
</agent_config>
EOF
"
# restart manager
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml restart wazuh
popd
# suricata-update
sudo -E apt install python3-pip
sudo -E pip3 install pyyaml
sudo -E pip3 install https://github.com/OISF/suricata-update/archive/master.zip
sudo -E pip3 install --pre --upgrade suricata-update
# sudo -E suricata-update enable-source oisf/trafficid
# sudo -E suricata-update enable-source etnetera/aggressive
# sudo -E suricata-update enable-source sslbl/ssl-fp-blacklist
# sudo -E suricata-update enable-source et/open
# sudo -E suricata-update enable-source tgreen/hunting
# sudo -E suricata-update enable-source sslbl/ja3-fingerprints
# sudo -E suricata-update enable-source ptresearch/attackdetection
sudo -E suricata-update
sudo systemctl daemon-reload
sudo systemctl restart suricata
scripts/services/wazuh/suricata/suricata_start.sh
-7
View File
@@ -1,7 +0,0 @@
#!/bin/bash
systemctl start suricata
systemctl enable suricata
#apt-get install -y python-pyinotify
#python /opt/mistborn/scripts/services/scirius/suri_reloader -p /etc/suricata/rules &
scripts/services/wazuh/suricata/suricata_stop.sh
-6
View File
@@ -1,6 +0,0 @@
#!/bin/bash
systemctl stop suricata
systemctl disable suricata
#kill $(pgrep -f suri_reloader) 2>/dev/null