Installation Guide

The goal of this document is to explain and guide you through the initial installation of Taranis.

Table of Contents Use of Taranis Solving issues during installation fixing the scripts installation problems with Perl modules. Configuration the main configuration file ChartDirector web-based configuration software/hardware definitions (CPE)

Use of Taranis

NCSC-NL feels that Taranis can be a useful tool for other CERT organizations that more or less follow the same process. NCSC-NL first started sharing Taranis in 2009. Over the years, we have increasingly sought community involvement in discussing issues and bugs. More importantly, we have increasingly reached out to the growing Taranis community to determine which functionality would enrich the tool, while staying close to its goal of helping CERT-teams.

That’s why NCSC-NL decided to make Taranis available to the community free of charge under the European Union Public License (EUPL). You can find more information on this license on the European Commission website .

1. Prepare a System
2. Bootstrapping an Installation

Solving issues during installation

fixing the scripts

During installation bootstrap or upgrade, you will see the scripts which are executed. Each installation script can be run as often as you want: they will attempt to make minimal changes into the desired situation. Any failure will cause installation to stop.

The lines before the error message show which script fails. You can ask our help to fix the script or attempt it yourself (please report the issue to info@ncsc.nl!) Then simply rerun the bootstrap or install from the start. The modified install scripts will not get overwritten once unpacked.

installation problems with Perl modules.

Taranis uses dozens of Perl packages, which are downloaded from Perl’s distribution archive 'CPAN'. That does not always work flawless: sometimes packages do not install smoothly. When you encounter installation problems, please inform us.

There are two ways around it:

1. Most Perl modules we install from CPAN are also available as package from your Linux distribution. When you install it that way, the Taranis installation will not attempt to install the module anymore.
2. Become user 'taranis' and install the module by hand, before attempting the bootstrap/install again:

root#   su – taranis
tara$   cpan -i $module

If that results in a regression test failure then attempt it again adding the -f (force) option. Simply rerun the installation again.

Configuration

Taranis can be configured on many different aspects. This chapter will guide you through the configuration options you should take a look at after installing Taranis.

the main configuration file

Most of the settings of Taranis can be changed in the file ~taranis/etc/taranis.conf.xml. You can keep much of the default settings in this file, but not all of them. Please see the Administration Guide for a list of the settings that you should review at this time.

ChartDirector

Taranis optionally offers extensive statistics on all the information stored and produced. These statistics can be shown through different types of charts like pie charts and bar charts. Taranis makes use of ChartDirector to produce these graphs.

If you want to make use of these statistics, you are required to a ChartDirector license] through the website of Advanced Software Engineering (ASE).

After you purchased a license, you must create the license file chartdir.lic with the license key you received and place it here: ~taranis/etc/chartdir.lic

If you don’t purchase a license, you will see a message on the bottom of every statistic you generate.

web-based configuration

After you’ve performed all the basic configuration steps as outlined in this chapter it is time to login to the Taranis web interface and start adding sources, parsers, users, etc. Please refer to the Administration Guide for more information or the configuration options Taranis offers. We advise you to at least configure the following items in Taranis before actual use.

See the administration for details on these items:

Start adding sources to your installation.

• Compile a list of possible damage descriptions if you plan to use the advisory-functionality of Taranis.
• Create at least one constituent type, followed by at least one constituent group, one constituent role and one constituent individual.
• Create another Taranis-user. You’ll need at least two users to be able to approve any product (advisory, End-of-Week)

software/hardware definitions (CPE)

Published advisories contain information about the inflicted software and/or hardware. The international CPE (Common Platform Enumeration) registration contains over 120k unique identifiers. When you want to use them all, run:

tara$ taranis cpe dictionary --versions

This action can take up to five minutes or longer depending on your environment.

One complication with using CPEs, is that products have many versions, which are each represented as separate record. For example, when you want to link “any linux kernel version” to an advisory, you have to link over 2100 CPEs.

For the purpose of Taranis, it is sufficient to work without all the detailed version numbers. The number of products decreases to 18k. To use the simplified CPEs, run:

# --no-versions is default
tara$ taranis cpe dictionary

In either case, put your dictionary import in cron for your taranis user. Run this at least once a month.

Alternatively you may choose to add your own definitions via the web-interface. Via Taranis configuration -> publication configuration -> Software/Hardware, the product specification can be added manually. You may delete (hide) items you do not want to use anymore, even when they were imported as dictionary.

Please refer to the Administration Guide for more information.