How To: MaxMind via GeoIP with pfELK
Andrew edited this page Mar 12, 2022
·
18 revisions
sudo add-apt-repository ppa:maxmind/ppa
sudo apt install geoipupdate
Alternate versions available here: https://github.com/maxmind/geoipupdate/releases
wget https://github.com/maxmind/geoipupdate/releases/download/v4.9.0/geoipupdate_4.9.0_linux_amd64.deb
apt install ./geoipupdate_4.9.0_linux_amd64.deb
- Create a MaxMind Account @ https://www.maxmind.com/en/geolite2/signup
- Login to your MaxMind Account; navigate to "My License Key" under "Services" and Generate new license key
sudo nano /etc/GeoIP.conf
- Modify lines 7 & 8 as follows (without < >):
AccountID <Input Your Account ID>
LicenseKey <Input Your LicenseKey>
- Modify line 13 as follows:
EditionIDs GeoLite2-City GeoLite2-Country GeoLite2-ASN
sudo geoipupdate
sudo nano /etc/cron.weekly/geoipupdate
- Add the following and save/exit
00 17 * * 0 geoipupdate
/etc/pfelk/conf.d/30-geoip.conf
- Remove all instances of
#MMR#-
sed -i 's/#MMR#//' /etc/pfelk/conf.d/30-geoip.confor edit manually
-
systemctl restart logstash.service