-
Notifications
You must be signed in to change notification settings - Fork 17
Installation Guide
The goal of this document is to explain and guide you through the initial installation of Taranis.
NCSC-NL feels that Taranis can be a useful tool for other CERT organizations that more or less follow the same process. NCSC-NL first started sharing Taranis in 2009. Over the years, we have increasingly sought community involvement in discussing issues and bugs. More importantly, we have increasingly reached out to the growing Taranis community to determine which functionality would enrich the tool, while staying close to its goal of helping CERT-teams.
That’s why NCSC-NL decided to make Taranis available to the community free of charge under the European Union Public License (EUPL). You can find more information on this license on the European Commission website .
Since release 3.4.0, Taranis will install under a username, by default taranis. You may already have an older version of Taranis
On a freshly installed host, you need to start with a Taranis distribution package. A Taranis distribution package is named as taranis-$version.tar.gz.
If you have not received the bootstrap script separately, you can collect extract it from the package:
root# tar xzf taranis-$version.tar.gz taranis-$version/taranis-bootstrap
root# mv taranis-$version/taranis-bootstraptara$ taranis install --version 3.4 # Newest version in 3.4With a recent bootstrap script, you run:
root# ./taranis-bootstrap taranis-$version.tar.gzThe bootstrap script will start with creating the user ‘taranis’ (if the name doesn’t already exist). It will unpack the sources (if not unpacked already) into ~taranis/sources/taranis-$version. Then it starts the install scripts which are contained in the package.
The more popular options of the taranis-bootstrap commands are:
-u --user USERNAME (default 'taranis') -g --group GROUPNAME (default 'taranis') -m --migrate DIR (default '/opt/taranis')
Install the software under this username. You can safely run very distinct releases of Taranis under different usernames on the same server.
During installation, you will get some questions. These values will get stored in ~taranis/etc/setup-generic or ~taranis/etc/setup-$version may change them later, by hand in that file, but need to rerun taranis install to effectuate them.
Also, you may get some questions from the Perl modules during the installation. You can simply accept the defaults.
Please, read the release notes.
When you wish to upgrade to a newer release, you have the following options:
- Bootstrap with a new username: read the taranis bootstrap procedure.
- Share an installation under an existing username: become that user and run
taranis install taranis-$new_version.tar.gz - Install from GIT under the existing username
When you create a new username to install a parallel instance (or same username on a different server), you need the content of ~/var, ~/local*, and the database from your older installation.
Example: upgrading a minor release
tara$ taranis install --version 3.4.1-rc2 # Explicit version
tara$ taranis install --version 3.4 # Newest version in 3.4If you have GIT configured:
tara$ cd ~/sources/taranis-3.4.1
tara$ taranis install –--git # Reinstall from GITtara$ taranis install --no-internet # Skip external checksDuring installation bootstrap or upgrade, you will see the scripts which are executed. Each installation script can be run as often as you want: they will attempt to make minimal changes into the desired situation. Any failure will cause installation to stop.
The lines before the error message show which script fails. You can ask our help to fix the script or attempt it yourself (please report the issue to info@ncsc.nl!) Then simply rerun the bootstrap or install from the start. The modified install scripts will not get overwritten once unpacked.
Taranis uses dozens of Perl packages, which are downloaded from Perl’s distribution archive 'CPAN'. That does not always work flawless: sometimes packages do not install smoothly. When you encounter installation problems, please inform us.
There are two ways around it:
- Most Perl modules we install from CPAN are also available as package from your Linux distribution. When you install it that way, the Taranis installation will not attempt to install the module anymore.
- Become user 'taranis' and install the module by hand, before attempting the bootstrap/install again:
root# su – taranis
tara$ cpan -i $module-f (force) option. Simply rerun the installation again.
Taranis can be configured on many different aspects. This chapter will guide you through the configuration options you should take a look at after installing Taranis.
Most of the settings of Taranis can be changed in the file ~taranis/etc/taranis.conf.xml. You can keep much of the default settings in this file, but not all of them. Please see the Administration Guide for a list of the settings that you should review at this time.
Taranis optionally offers extensive statistics on all the information stored and produced. These statistics can be shown through different types of charts like pie charts and bar charts. Taranis makes use of ChartDirector to produce these graphs.
If you want to make use of these statistics, you are required to a ChartDirector license] through the website of Advanced Software Engineering (ASE).
After you purchased a license, you must create the license file chartdir.lic with the license key you received and place it here: ~taranis/etc/chartdir.lic
If you don’t purchase a license, you will see a message on the bottom of every statistic you generate.
After you’ve performed all the basic configuration steps as outlined in this chapter it is time to login to the Taranis web interface and start adding sources, parsers, users, etc. Please refer to the Administration Guide for more information or the configuration options Taranis offers. We advise you to at least configure the following items in Taranis before actual use.
See the administration for details on these items:
Start adding sources to your installation.
- Compile a list of possible damage descriptions if you plan to use the advisory-functionality of Taranis.
- Create at least one constituent type, followed by at least one constituent group, one constituent role and one constituent individual.
- Create another Taranis-user. You’ll need at least two users to be able to approve any product (advisory, End-of-Week)
Published advisories contain information about the inflicted software and/or hardware. The international CPE (Common Platform Enumeration) registration contains over 120k unique identifiers. When you want to use them all, run:
tara$ taranis cpe dictionary --versionsOne complication with using CPEs, is that products have many versions, which are each represented as separate record. For example, when you want to link “any linux kernel version” to an advisory, you have to link over 2100 CPEs.
For the purpose of Taranis, it is sufficient to work without all the detailed version numbers. The number of products decreases to 18k. To use the simplified CPEs, run:
# --no-versions is default
tara$ taranis cpe dictionaryAlternatively you may choose to add your own definitions via the web-interface. Via Taranis configuration -> publication configuration -> Software/Hardware, the product specification can be added manually. You may delete (hide) items you do not want to use anymore, even when they were imported as dictionary.
Please refer to the Administration Guide for more information.
images/taranis-logo-medium.png ©NCSC-NL, License: EUPL-1.2
