IDS: YaF SiLK catatan dari CERT NetSA - Revision history

Onnowpurbo: /* Start YAF */

2022-04-21T00:23:49Z

Start YAF

2022-04-21T00:21:56Z

Start YAF

2022-04-21T00:18:18Z

Configure rwflowpack

2022-04-21T00:12:50Z

Configure rwflowpack

2022-04-21T00:09:39Z

Update Dynamic Linker

2022-04-21T00:06:26Z

Update Dynamic Linker

2022-04-20T23:57:00Z

Configure rwflowpack

2022-04-20T23:50:19Z

2022-04-20T23:44:43Z

2022-04-20T23:33:50Z

Created page with " ==Referensi== * https://tools.netsa.cert.org/silk/silk-on-box-deb.html"

New page

==Referensi==

* https://tools.netsa.cert.org/silk/silk-on-box-deb.html

← Older revision		Revision as of 00:23, 21 April 2022
Line 176:		Line 176:
	Look at the yaf log file, /var/log/yaf.log to ensure that it is running.		Look at the yaf log file, /var/log/yaf.log to ensure that it is running.

		+
		+	cat /var/log/yaf.log

	Check the rwflowpack log file again to ensure that it received a connection from yaf. There should be a message similar to the following (the port number will likely differ):		Check the rwflowpack log file again to ensure that it received a connection from yaf. There should be a message similar to the following (the port number will likely differ):

@@ Line 165: / Line 165: @@
-Restart
+Restart (contains no runlevels, aborting tidak apa2)
   systemctl enable yaf
@@ Line 182: / Line 182: @@
 If nothing is happening, it could be that yaf is waiting for network traffic. Follow the steps in the next section to generate some.
 ==Generate traffic==

@@ Line 108: / Line 108: @@
   group my-network
-   ipblocks 192.168.1.0/24  # address of ethernet interface. CHANGE THIS.
+   ipblocks 192.168.0.0/24  # address of ethernet interface. CHANGE THIS.
    ipblocks 10.0.0.0/8      # other blocks considered internal. OPTIONAL.
   end group
@@ Line 140: / Line 140: @@
   PID_DIR=/var/run
-Start rwflowpack
+Start rwflowpack (a message about "contains no runlevels, aborting" is non-fatal):
   systemctl enable rwflowpack
@@ Line 150: / Line 150: @@
 Look at the rwflowpack log file, /var/log/rwflowpack-YYYYYMMDD.log to ensure that it is running.
 ==Start YAF==

@@ Line 96: / Line 96: @@
 Next create the sensors.conf file that is used by rwflowpack for collecting data from yaf.
   probe S0 ipfix
@@ Line 146: / Line 150: @@
 Look at the rwflowpack log file, /var/log/rwflowpack-YYYYYMMDD.log to ensure that it is running.
 ==Start YAF==

@@ Line 69: / Line 69: @@
   (debian)
   /etc/ld.so.conf.d/libc.conf:/usr/local/lib
   (ubuntu)
   /etc/ld.so.conf.d/x86_64-linux-gnu.conf:/usr/local/lib/x86_64-linux-gnu
   (debian)

@@ Line 67: / Line 67: @@
   $ grep local /etc/ld.so.conf.d/*
   /etc/ld.so.conf.d/libc.conf:/usr/local/lib
   mv silk.conf /etc/ld.so.conf.d/.
   ldconfig
 =Configuring the tools=

@@ Line 107: / Line 107: @@
   mv sensors.conf /var/silk/sensors.conf
 ==Referensi==
 * https://tools.netsa.cert.org/silk/silk-on-box-deb.html

← Older revision	Revision as of 23:50, 20 April 2022
Line 45:	Line 45:


	+	==Install YAF==

	+	cd /tmp
	+	tar -zxf /tmp/yaf-2.12.2.tar.gz
	+	cd yaf-2.12.2
	+	./configure \
	+	--prefix=/usr/local \
	+	--enable-silent-rules \
	+	--enable-applabel \
	+	--enable-metadata \
	+	--enable-plugins
	+	make
	+	make install

	+	cp /tmp/yaf-2.12.2/etc/init.d/yaf /etc/init.d/yaf
	+	chmod a+x /etc/init.d/yaf


	+	==Update Dynamic Linker==

	+	$ grep local /etc/ld.so.conf.d/*

	+	/etc/ld.so.conf.d/libc.conf:/usr/local/lib
	+
	+	mv silk.conf /etc/ld.so.conf.d/.
	+	ldconfig
	+
	+
	+	=Configuring the tools=
	+
	+	==Configure SiLK==
	+
	+	mkdir -p /var/silk/data
	+	chmod go+rx /var/silk /var/silk/data
	+	cp /usr/local/share/silk/twoway-silk.conf /var/silk/data/silk.conf
	+
	+
	+	==Configure rwflowpack==
	+
	+	Next create the sensors.conf file that is used by rwflowpack for collecting data from yaf.
	+
	+	probe S0 ipfix
	+	listen-on-port 18001
	+	protocol tcp
	+	listen-as-host 127.0.0.1
	+	end probe
	+
	+	group my-network
	+	ipblocks 192.168.1.0/24 # address of ethernet interface. CHANGE THIS.
	+	ipblocks 10.0.0.0/8 # other blocks considered internal. OPTIONAL.
	+	end group
	+
	+	sensor S0
	+	ipfix-probes S0
	+	internal-ipblocks @my-network
	+	external-ipblocks remainder
	+	end sensor
	+
	+	(Once the entire system is running, if you discover that all your records show up as type ext2ext, it means you did not configure your internal netblocks correctly.)
	+
	+	mv sensors.conf /var/silk/sensors.conf

← Older revision	Revision as of 23:44, 20 April 2022
Line 1:	Line 1:
	+	=Building the tools=
	+
	+	==Install Prerequisites==
	+
	+	apt -y install build-essential
	+	apt -y install libglib2.0-dev liblzo2-dev zlib1g-dev libgnutls28-dev libpcap-dev python3.8-dev
	+	apt -y install libmaxminddb-dev
	+
	+	==Download Software==
	+
	+	cd /tmp
	+	wget https://tools.netsa.cert.org/releases/silk-3.19.1.tar.gz
	+	wget https://tools.netsa.cert.org/releases/libfixbuf-2.4.1.tar.gz
	+	wget https://tools.netsa.cert.org/releases/yaf-2.12.2.tar.gz
	+
	+
	+	==Install libfixbuf==
	+
	+	cd /tmp
	+	tar -zxf /tmp/libfixbuf-2.4.1.tar.gz
	+	cd libfixbuf-2.4.1
	+	./configure \
	+	--prefix=/usr/local \
	+	--enable-silent-rules
	+	make
	+	make install
	+
	+
	+	==Install SiLK==
	+
	+	cd /tmp
	+	tar -zxf /tmp/silk-3.19.1.tar.gz
	+	cd silk-3.19.1
	+	./configure \
	+	--prefix=/usr/local \
	+	--enable-silent-rules \
	+	--enable-data-rootdir=/var/silk/data \
	+	--enable-ipv6 \
	+	--enable-ipset-compatibility=3.14.0 \
	+	--enable-output-compression \
	+	--with-python \
	+	--with-python-prefix
	+	make
	+	make install
	+
	+
	+
	+
	+
	+
	+
	+
	+
	+
	+