Cyber Security: SELKS Pertama Kali Login

From OnnoWiki
Revision as of 10:37, 17 July 2023 by Onnowpurbo (talk | contribs)
Jump to navigation Jump to search

It is always recommended to follow the latest docs:

https://github.com/StamusNetworks/SELKS/wiki

Please go to the end of the brief below for production setup considerations.

First time setup:

Non interactive, airgapped mode. The below command will setup the selks installation:

  • in non-interactive mode
  • install all containers (elasticsearch/suricata/ngingx/logstash/kibana/scirius/evebox/portainer) without pulling anything from the internet
  • use the interface tppdummy0 as sniffing interface
  • use 8GB of RAM for Elasticsearch
  • start up the installation (docker compose)

Examples:

cd /opt/selksd/SELKS/docker/ && ./easy-setup.sh --non-interactive --no-pull-containers -i tppdummy0 --iA --restart-mode always --es-memory 8G && docker-compose up -d 

atau kalau mau pakai interface operasional enp0s3

cd /opt/selksd/SELKS/docker/ && ./easy-setup.sh --non-interactive --no-pull-containers -i enp0s3 --iA --restart-mode always --es-memory 8G && docker-compose up -d


Interactive with latest updated containers and software:

  • update/pull and install all containers (elasticsearch/suricata/ngingx/logstash/kibana/scirius/evebox/portainer)
  • use the interface tppdummy0 as sniffing interface
  • use 8GB of RAM for Elasticsearch, 1GB
  • start up the installation (docker compose)

Example:

cd /opt/selksd/SELKS/docker/
docker-compose down
git pull
./easy-setup.sh --iA --es-memory 8G 
docker-compose pull
docker-compose up -d --force-recreate


Setting up dummy interface If you would not want to sniff on specific system interface and want to set up a dummy interface for sniffing to replay for example specific

pcap cases:

Example:

ip link add tppdummy0 type dummy && ip link set tppdummy0 up && ifconfig tppdummy0 mtu 1572