Skip to content
This repository has been archived by the owner on May 23, 2019. It is now read-only.

PlatformUbuntu14

Wes edited this page Nov 1, 2016 · 13 revisions

Overview

This installation generally takes 15-30min on hardware with more than 4 cores. This is due to the CPAN dependencies that are being compiled and tested. Someday maybe someone will contrib a PPA... 👍

Setting up the Environment

Because @giovino is so awesome, the helper script will configure apache2, bind and install CIF to /opt/cif for you, as well as install any required CPAN dependencies too!

If you find @giovino in the wild, buy him a beer.

$ sudo apt-get install -y htop build-essential automake autoconf git
$ git clone -b master https://github.com/csirtgadgets/massive-octo-spice
$ cd massive-octo-spice
$ bash autogen.sh
$ sudo bash ./hacking/platforms/easybutton.sh

Notes

  • When it asks you what type of mail server you want setup, you can choose 'Internet', just make sure it's fire-walled appropriately and you re-configure it post install to match your local host policy.

Testing

Router

  1. start cif-router
$ sudo service cif-router start
  1. test connectivity to the router
$ curl -k -w "\n" -X GET 'https://localhost:443/api/_ping?token=1234'
{"timestamp":[1400585768,265584]}

Smrt

  1. perform an initial cif-smrt test run
$ sudo /opt/cif/bin/cif-smrt --testmode -d -M
[2014-04-19T16:00:51,868Z][INFO]: cleaning up tmp...
[2014-04-19T16:00:52,012Z][INFO]: generating ping request...
[2014-04-19T16:00:52,077Z][INFO]: sending ping...
[2014-04-19T16:00:52,089Z][INFO]: ping returned
[2014-04-19T16:00:52,106Z][INFO]: processing: bin/cif-smrt -d -r /opt/cif/etc/rules/default/bruteforceblocker.cfg -f ssh
[2014-04-19T16:00:52,427Z][INFO]: starting at: 2014-04-19T00:00:00Z
[2014-04-19T16:00:52,431Z][INFO]: processing...
[2014-04-19T16:00:54,532Z][INFO]: building events: 1273
[2014-04-19T16:00:55,335Z][INFO]: sending: 78
[2014-04-19T16:00:55,955Z][INFO]: took: ~0.921849
[2014-04-19T16:00:55,956Z][INFO]: rate: ~84.6125558524227 o/s
[2014-04-19T16:00:55,956Z][INFO]: processing: bin/cif-smrt -d -r /opt/cif/etc/rules/default/drg.cfg -f ssh
...
  1. start cif-smrt

    $ sudo service cif-smrt start
Clone this wiki locally