ansible role to setup MISP, Malware Information Sharing Platform & Threat Sharing
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
defaults cybox 2.1.0.18.dev0 not available in pip -> 2.1.0.17 Jun 30, 2018
files missing file Jan 24, 2017
handlers ensure HRNGDEVICE is configured for rng-tools Apr 29, 2018
meta meta: add Ubuntu 18.04 May 12, 2018
packer add packer config for Azure template Aug 12, 2018
tasks centos7: add PYTHONPATH and serverspec path Aug 12, 2018
templates config.php template: fix some naming Jun 30, 2018
test centos7: add PYTHONPATH and serverspec path Aug 12, 2018
vars add python3_bin distribution var Aug 12, 2018
.gitignore adding local repository gitignore Jan 13, 2018
.kitchen.docker.yml vagrant/kitchen ansible: add profile_tasks and timer May 25, 2018
.kitchen.vagrant.yml vagrant/kitchen ansible: add profile_tasks and timer May 25, 2018
.kitchen.yml kitchen testing: forcing 2.5.5 - file module issue on 2.6 ansible#42150 Jun 30, 2018
.travis.yml travis review May 26, 2018
.travis.yml.docker switch travis test from docker to lxd Apr 28, 2018
.travis.yml.lxd travis/lxd: disable manual serverspec run - not working anyway Apr 29, 2018
.travis.yml.lxd-kitchen travis kitchen/lxd: cleaning Jun 17, 2018
.travis.yml.simple minor changes - get-dependencies call, packer droplet name Jan 7, 2017
Jenkinsfile README update, add base support for git signed commit retrieve Jan 30, 2017
LICENSE Initial commit on github Apr 25, 2016
README.md add packer config for Azure template Aug 12, 2018
get-dependencies.sh fix test configurations with galaxy naming, kitchen copy role Jan 4, 2017

README.md

Build Status - Master Build Status - Devel

MISP ansible role

Ansible role to setup MISP, Malware Information Sharing Platform & Threat Sharing

Alternatives

Requirements & Dependencies

Ansible

It was tested on the following versions:

  • 2.0
  • 2.2
  • 2.3
  • 2.4
  • 2.5

Operating systems

Tested with vagrant on Ubuntu 14.04, Kitchen test with xenial, trusty and centos7

Example Playbook

Just include this role in your list. For example

- host: all
  roles:
    - juju4.MISP

default admin credentials (admin@admin.test / admin)

Variables

Nothing specific for now.

Continuous integration

This role has a travis basic test (for github), more advanced with kitchen and also a Vagrantfile (test/vagrant). Default kitchen config (.kitchen.yml) is lxd-based, while (.kitchen.vagrant.yml) is vagrant/virtualbox based.

Once you ensured all necessary roles are present, You can test with:

$ gem install kitchen-ansible kitchen-lxd_cli kitchen-sync kitchen-vagrant
$ cd /path/to/roles/juju4.MISP
$ kitchen verify
$ kitchen login
$ KITCHEN_YAML=".kitchen.vagrant.yml" kitchen verify

or

$ cd /path/to/roles/juju4.MISP/test/vagrant
$ vagrant up
$ vagrant ssh

Role has also a packer config which allows to create image for virtualbox, vmware, eventually digitalocean, lxc and others. When building it, it's advise to do it outside of roles directory as all the directory is upload to the box during building and it's currently not possible to exclude packer directory from it (https://github.com/mitchellh/packer/issues/1811)

$ cd /path/to/packer-build
$ cp -Rd /path/to/juju4.MISP/packer .
## update packer-*.json with your current absolute ansible role path for the main role
## you can add additional role dependencies inside setup-roles.sh
$ cd packer
$ packer build packer-*.json
$ packer build -only=virtualbox-iso packer-*.json
## if you want to enable extra log
$ PACKER_LOG_PATH="packerlog.txt" PACKER_LOG=1 packer build packer-*.json
## for digitalocean build, you need to export TOKEN in environment.
##  update json config on your setup and region.
$ export DO_TOKEN=xxx
$ packer build -only=digitalocean packer-*.json
## for Azure
$ . ~/.azure/credentials
$ packer build azure-packer-centos7.json
$ packer build -var-file=variables.json azure-packer-centos7.json

Troubleshooting & Known issues

Troubleshooting

$ tail /var/log/apache2/misp.*
$ tail /var/www/MISP/app/tmp/logs/*.log
$ cd /var/www/MISP/app/Console && ./cake CakeResque.CakeResque tail

Known bugs

  • in /var/www/MISP/app/tmp/logs/error.log Error: [MissingTableException] Table logs for model Log was not found in datasource default. check misp database exists in mysql and is filled
  • PHP Fatal error: Can't use method return value in write context Only on centos71 with php54. Ok with ubuntu trusty and php55. = switch to php56 from remi repository
  • MISP curl_tests.sh is made to run once unlike kitchen verify. If repeated, this test will fail.
  • nosetests .coverage owned by root make the test failing on ubuntu trusty:
$ cd /var/www/MISP/PyMISP && nosetests --with-coverage --cover-package=pymisp tests/test_offline.py
[...]
ImportError: No module named packages.urllib3.response

Name                 Stmts   Miss  Cover
----------------------------------------
pymisp/__init__.py       2      2     0%
pymisp/api.py          782    782     0%
----------------------------------------
TOTAL                  784    784     0%
----------------------------------------------------------------------
Ran 1 test in 0.002s

FAILED (errors=1)
$ dpkg -l |grep urllib3
ii  python-urllib3                   1.7.1-1ubuntu4                   all          HTTP library with thread-safe connection pooling for Python
ii  python-urllib3-whl               1.7.1-1ubuntu4                   all          HTTP library with thread-safe connection pooling
ii  python3-urllib3                  1.7.1-1ubuntu4                   all          HTTP library with thread-safe connection pooling for Python3
  • if using privileged docker and a host with mysql, you might have the following issue
mysqld[29176]: /usr/sbin/mysqld: error while loading shared libraries: libaio.so.1: cannot stat shared object: Permission denied

https://github.com/docker/docker/issues/7512

  • docker and redis can have issue too and it might be necessary to edit systemd config on xenial see task 'docker redis workaround ???'

  • travis tasks seems to stall in some case like for ubuntu trusty. Not identified why...

FAQ

  • usage of roles dependencies like geerlinguy.{mysql,nginx,apache} are not required but allow more fine-tuning.

  • To debug gpg issues (as per Server Settings: Diagnostics), refer to https://github.com/MISP/MISP/issues/413 Target file has changed and is now MISP/app/Model/Server.php

  • role is serving MISP as http. They are other roles to handle certificates like letsencrypt (ex: thefinn93.letsencrypt) New ansible v2.2 letsencrypt module allow certificate creation but no renewal of task without rerunning role.

  • LIEF build can take a while (30-60min) on Centos7. Disable if not needed

TODO

License

BSD 2-clause