-
Notifications
You must be signed in to change notification settings - Fork 17
Installation Guide
The goal of this document is to explain and guide you through the initial installation of Taranis.
NCSC-NL feels that Taranis can be a useful tool for other CERT organizations that more or less follow the same process. NCSC-NL first started sharing Taranis in 2009. Over the years, we have increasingly sought community involvement in discussing issues and bugs. More importantly, we have increasingly reached out to the growing Taranis community to determine which functionality would enrich the tool, while staying close to its goal of helping CERT-teams.
That’s why NCSC-NL decided to make Taranis available to the community free of charge under the European Union Public License (EUPL). You can find more information on this license on the European Commission website .
Taranis requires several components to be installed on the operating system. This chapter provides step-by-step descriptions on how to install the application.
It is difficult to provide hard requirements regarding CPU, internal memory and disk space needed to run Taranis. We recommend a minimal configuration with around 10 GB of disk space, 1 processor with 4 cores, and 4 GB of internal RAM.
A typical minimal configuration is identified by the parameters:
- Sources: Around 250 to 500 sources
- Items: Around 1.000 items collected daily from the 250 – 500 sources
- Users: 1 to 3 concurrent users
- Threads: The collector runs with a maximum of 2 threads
- Clustering: Clustering is enabled for around a maximum of 50% of all your sources (125-250 sources)
- Screenshots: Incidentally used
To ensure you have a robust setup, we recommend that your system/configuration is scalable. Make sure you can add more disk space or internal memory to your system if needed. Also make sure that it is possible to change your configuration so that e.g. the collector no longer runs on the same server as the other Taranis components. This way you make sure that both your current Taranis configuration as well as future Taranis configurations can be handled by your infrastructure.
Taranis installation is only supported for the latest versions of CentOS (currently version 7 with or without SELinux), Ubuntu (currently 16.04LTS), and RedHat (7EL). We also run Taranis on RedHat 6EL and OpenSUSE 42.3/Tumbleweed, but those are not supported. It may work for you.
NCSC will try to help you with Taranis on request, but without guarantee on success or response time (Best effort).
Install a server or VM with one of the supported operating systems. Configure a hostname.
NOTE: It is not easy to install Taranis in Docker, because we run multiple daemons. Although there are some tricks to get it work, of course.
For CentOS, run “yum install perl”. On Ubuntu, run “apt-get install perl-modules”
Upgrade Perl’s CPAN.pm to at least 1.94_63 (released in 2011) with
perl -MCPAN -e 'install CPAN'The best results are with local delivery of email. Probably you want to configure postfix. Look careful at the headers of sent messages, to see that it does not expose too much details about your infrastructure.
You will need a name for the web-interface of Taranis. Please configure this before starting the installation.
Since release 3.4.0, Taranis will install under a username, by default taranis. You may already have an older version of Taranis
On a freshly installed host, you need to start with a Taranis distribution package. A Taranis distribution package is named as taranis-$version.tar.gz.
If you have not received the bootstrap script separately, you can collect extract it from the package:
root# tar xzf taranis-$version.tar.gz taranis-$version/taranis-bootstrap
root# mv taranis-$version/taranis-bootstraptara$ taranis install --version 3.4 # Newest version in 3.4With a recent bootstrap script, you run:
root# ./taranis-bootstrap taranis-$version.tar.gzThe bootstrap script will start with creating the user ‘taranis’ (if the name doesn’t already exist). It will unpack the sources (if not unpacked already) into ~taranis/sources/taranis-$version. Then it starts the install scripts which are contained in the package.
The more popular options of the taranis-bootstrap commands are:
-u --user USERNAME (default 'taranis') -g --group GROUPNAME (default 'taranis') -m --migrate DIR (default '/opt/taranis')
Install the software under this username. You can safely run very distinct releases of Taranis under different usernames on the same server.
During installation, you will get some questions. These values will get stored in ~taranis/etc/setup-generic or ~taranis/etc/setup-$version may change them later, by hand in that file, but need to rerun taranis install to effectuate them.
Also, you may get some questions from the Perl modules during the installation. You can simply accept the defaults.
Please, read the release notes.
When you wish to upgrade to a newer release, you have the following options:
- Bootstrap with a new username: read the taranis bootstrap procedure.
- Share an installation under an existing username: become that user and run
taranis install taranis-$new_version.tar.gz - Install from GIT under the existing username
When you create a new username to install a parallel instance (or same username on a different server), you need the content of ~/var, ~/local*, and the database from your older installation.
Example: upgrading a minor release
tara$ taranis install --version 3.4.1-rc2 # Explicit version
tara$ taranis install --version 3.4 # Newest version in 3.4If you have GIT configured:
tara$ cd ~/sources/taranis-3.4.1
tara$ taranis install –--git # Reinstall from GITtara$ taranis install --no-internet # Skip external checksDuring installation bootstrap or upgrade, you will see the scripts which are executed. Each installation script can be run as often as you want: they will attempt to make minimal changes into the desired situation. Any failure will cause installation to stop.
The lines before the error message show which script fails. You can ask our help to fix the script or attempt it yourself (please report the issue to info@ncsc.nl!) Then simply rerun the bootstrap or install from the start. The modified install scripts will not get overwritten once unpacked.
Taranis uses dozens of Perl packages, which are downloaded from Perl’s distribution archive 'CPAN'. That does not always work flawless: sometimes packages do not install smoothly. When you encounter installation problems, please inform us.
There are two ways around it:
- Most Perl modules we install from CPAN are also available as package from your Linux distribution. When you install it that way, the Taranis installation will not attempt to install the module anymore.
- Become user 'taranis' and install the module by hand, before attempting the bootstrap/install again:
root# su – taranis
tara$ cpan -i $module-f (force) option. Simply rerun the installation again.
Taranis can be configured on many different aspects. This chapter will guide you through the configuration options you should take a look at after installing Taranis.
Most of the settings of Taranis can be changed in the file ~taranis/etc/taranis.conf.xml. You can keep much of the default settings in this file, but not all of them. Please see the Administration Guide for a list of the settings that you should review at this time.
Taranis optionally offers extensive statistics on all the information stored and produced. These statistics can be shown through different types of charts like pie charts and bar charts. Taranis makes use of ChartDirector to produce these graphs.
If you want to make use of these statistics, you are required to a ChartDirector license] through the website of Advanced Software Engineering (ASE).
After you purchased a license, you must create the license file chartdir.lic with the license key you received and place it here: ~taranis/etc/chartdir.lic
If you don’t purchase a license, you will see a message on the bottom of every statistic you generate.
After you’ve performed all the basic configuration steps as outlined in this chapter it is time to login to the Taranis web interface and start adding sources, parsers, users, etc. Please refer to the Administration Guide for more information or the configuration options Taranis offers. We advise you to at least configure the following items in Taranis before actual use.
See the administration for details on these items:
Start adding sources to your installation.
- Compile a list of possible damage descriptions if you plan to use the advisory-functionality of Taranis.
- Create at least one constituent type, followed by at least one constituent group, one constituent role and one constituent individual.
- Create another Taranis-user. You’ll need at least two users to be able to approve any product (advisory, End-of-Week)
Published advisories contain information about the inflicted software and/or hardware. The international CPE (Common Platform Enumeration) registration contains over 120k unique identifiers. When you want to use them all, run:
tara$ taranis cpe dictionary --versionsOne complication with using CPEs, is that products have many versions, which are each represented as separate record. For example, when you want to link “any linux kernel version” to an advisory, you have to link over 2100 CPEs.
For the purpose of Taranis, it is sufficient to work without all the detailed version numbers. The number of products decreases to 18k. To use the simplified CPEs, run:
# --no-versions is default
tara$ taranis cpe dictionaryAlternatively you may choose to add your own definitions via the web-interface. Via Taranis configuration -> publication configuration -> Software/Hardware, the product specification can be added manually. You may delete (hide) items you do not want to use anymore, even when they were imported as dictionary.
Please refer to the Administration Guide for more information.
images/taranis-logo-medium.png ©NCSC-NL, License: EUPL-1.2
