Skip to content

Update of list-vagrant #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cejkato2 wants to merge 29 commits into
base: master
Choose a base branch
from
Open

Update of list-vagrant #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
88f7c1e
munin: copy host-specific config files
cejkato2 Nov 15, 2018
aa143d6
Merge branch 'master' of github.com:cesnet/list
cejkato2 Feb 12, 2019
c919261
ipfixcol: add example (commented out) of multiple odids
cejkato2 Feb 19, 2019
5c14bdf
apache: disable privatetmp in systemd - scgui needs to find its temp …
cejkato2 Feb 19, 2019
eca125b
roles: add fail2ban with enabled ssh
cejkato2 Feb 19, 2019
74ba028
roles: add easyrsa to build CA and client&server certificates
cejkato2 Feb 19, 2019
e0183d4
roles: add socat as a TLS endpoint
cejkato2 Feb 19, 2019
fbaa382
nemea: add missing UniRec templates into ipfixcol config
cejkato2 Feb 24, 2019
a3e8509
Blacklistfilter WIP
sustefil Mar 3, 2019
73d784c
revert change that commented list's roles out
cejkato2 Aug 8, 2019
40b747f
Merge remote-tracking branch 'origin/master' into blacklistfilter
cejkato2 Aug 8, 2019
7bd7cf0
moved data.ipfix.bz2 to github (from dior, which returned 404)
cejkato2 Aug 8, 2019
318108a
nemea: blacklistfilter - fixed missing directory
cejkato2 Aug 8, 2019
bd710d4
vagrantfile: partial reverted example of ansible.raw_arguments
cejkato2 Aug 8, 2019
438f621
migrate to python3
cejkato2 Aug 9, 2019
2b6ad7d
update configuration of NEMEA
cejkato2 Aug 9, 2019
6ce7472
install nemead uid and gid
cejkato2 Aug 9, 2019
b65af31
update warden_server
cejkato2 Aug 9, 2019
b8fa41a
Merge remote-tracking branch 'origin/master' into blacklistfilter
cejkato2 Aug 9, 2019
10bd04b
Merge remote-tracking branch 'origin/installfest2019' into blacklistf…
cejkato2 Aug 9, 2019
1f97828
nemea reporters: explicitly enforce python3 using sup config
cejkato2 Aug 12, 2019
042dea7
install php7 as a dependency of main-page na scgui
cejkato2 Aug 12, 2019
a99bd70
warden-server: register local warden-client for demo
cejkato2 Aug 12, 2019
72bbc0f
setup nemea-dashboard backend using HTTP proxy
cejkato2 Aug 12, 2019
43c15e9
add unused role ipfixcol2
cejkato2 Aug 12, 2019
1d69bd2
fail2ban: export events to warden (/data/warden/*)
cejkato2 Aug 12, 2019
bd99241
cleanup
cejkato2 Aug 13, 2019
3756c73
mongodb: automatically clean content older than 3 months
cejkato2 Aug 13, 2019
8c6f070
Merge branch 'master' into blacklistfilter
cejkato2 Apr 17, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions ansible/inventory/host_files/list-vagrant/fail2ban/jail.local
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
[DEFAULT]
bantime = 3600

[sshd]
enabled = true
action = iptables[name=SSH, port=ssh, protocol=tcp]
f2b-warden[name=SSH, port=ssh, protocol=tcp, wardenpath=/data/warden/]

191 changes: 124 additions & 67 deletions ansible/inventory/host_files/list-vagrant/ipfixcol/profiles.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,75 +1,132 @@
<?xml version="1.0"?>
<!-- Live profile (default - always must exists) -->
<profile name="live">
<!--## Type of a profile -->
<type>normal</type>
<!--## Directory for data store of valuable data and statistics -->
<directory>/data/flow/live/</directory>
<!--## Type of a profile -->
<type>normal</type>
<!--## Directory for data store of valuable data and statistics -->
<directory>/data/flow/live/</directory>
<!-- List of channels that belong to the profile -->
<channelList>
<channel name="ipv4">
<!--## List of sources from which channel will receive data -->
<sourceList>
<!--## Live profile always use "*" -->
<source>*</source>
</sourceList>
<!--## Filter applied on records, specifying whether it belongs to the profile -->
<filter>ipVersion = 4</filter>
</channel>
<channel name="ipv6">
<sourceList>
<source>*</source>
</sourceList>
<filter>ipv6</filter>
</channel>

<!-- List of channels that belong to the profile -->
<channelList>
<channel name="ipv4">
<!--## List of sources from which channel will receive data -->
<sourceList>
<!--## Live profile always use "*" -->
<source>*</source>
</sourceList>
<!--## Filter applied on records, specifying whether it belongs to the profile -->
<filter>ipVersion = 4</filter>
</channel>
<channel name="ipv6">
<sourceList>
<source>*</source>
</sourceList>
<filter>ipv6</filter>
</channel>
</channelList>
<!-- Channels by Observation Domain ID -->
<!--
<channel name="mynet1">
<sourceList>
<source>*</source>
</sourceList>
<filter>odid = 1</filter>
</channel>
<channel name="mynet2">
<sourceList>
<source>*</source>
</sourceList>
<filter>odid = 2</filter>
</channel>
-->

<!--## List of subprofiles that belong to the live profile -->
<subprofileList>
<!--## Example subprofile for -->
<profile name="emails">
<type>normal</type>
<directory>/data/flow/live/emails/</directory>
</channelList>
<!--## List of subprofiles that belong to the live profile -->
<subprofileList>
<!--## Example subprofile for -->
<profile name="emails">
<type>normal</type>
<directory>/data/flow/live/emails/</directory>
<channelList>
<!-- POP3 flows -->
<channel name="pop3">
<sourceList>
<!--## Sources are channels only from the parent profile -->
<source>ipv4</source>
<source>ipv6</source>
</sourceList>
<filter>port in [110 995]</filter>
</channel>
<!-- IMAP flows -->
<channel name="imap">
<sourceList>
<source>ipv4</source>
<source>ipv6</source>
</sourceList>
<filter>port in [143 993]</filter>
</channel>
<!-- SMTP flows -->
<channel name="smtp">
<sourceList>
<source>ipv4</source>
<source>ipv6</source>
</sourceList>
<filter>port in [25 465]</filter>
</channel>
</channelList>
</profile>

<channelList>
<!-- POP3 flows -->
<channel name="pop3">
<sourceList>
<!--## Sources are channels only from the parent profile -->
<source>ipv4</source>
<source>ipv6</source>
</sourceList>
<filter>
port in [110 995 ]
</filter>
</channel>
<!-- Subprofiles by Interface per each Observation Domain ID -->
<!--
<profile name="mynet1">
<type>normal</type>
<directory>/data/flow/live/mynet1/</directory>
<channelList>
<channel name="wan">
<sourceList>
<source>mynet1</source>
</sourceList>
<filter>ingressInterface = 0</filter>
</channel>
<channel name="lan">
<sourceList>
<source>mynet1</source>
</sourceList>
<filter>ingressInterface = 1</filter>
</channel>
<channel name="guest">
<sourceList>
<source>mynet1</source>
</sourceList>
<filter>ingressInterface = 2</filter>
</channel>
</channelList>
</profile>
<profile name="mynet2">
<type>normal</type>
<directory>/data/flow/live/mynet2/</directory>
<channelList>
<channel name="wan">
<sourceList>
<source>mynet2</source>
</sourceList>
<filter>ingressInterface = 0</filter>
</channel>
<channel name="lan">
<sourceList>
<source>mynet2</source>
</sourceList>
<filter>ingressInterface = 1</filter>
</channel>
<channel name="guest">
<sourceList>
<source>mynet2</source>
</sourceList>
<filter>ingressInterface = 2</filter>
</channel>
</channelList>
</profile>
-->

<!-- IMAP flows -->
<channel name="imap">
<sourceList>
<source>ipv4</source>
<source>ipv6</source>
</sourceList>
<filter>
port in [143 993]
</filter>
</channel>

<!-- SMTP flows -->
<channel name="smtp">
<sourceList>
<source>ipv4</source>
<source>ipv6</source>
</sourceList>
<filter>
sourceTransportPort == 25 or
destinationTransportPort == 25 or
sourceTransportPort == 465 or
destinationTransportPort == 465
</filter>
</channel>
</channelList>
</profile>
</subprofileList>
</subprofileList>
</profile>

2 changes: 1 addition & 1 deletion ansible/inventory/host_files/list-vagrant/nemea/detectors/blacklistfilter.sup
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
<name>ipblacklistfilter</name>
<enabled>true</enabled>
<path>/usr/bin/nemea/ipblacklistfilter</path>
<params> </params>
<params/>
<trapinterfaces>
<interface>
<type>UNIXSOCKET</type>
Expand Down
158 changes: 158 additions & 0 deletions ...ble/inventory/host_files/list-vagrant/nemea/detectors/blacklistfilter_with_af.sup.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,158 @@
<module>
<name>blacklist_downloader</name>
<enabled>true</enabled>
<path>/usr/bin/nemea/bl_downloader.py</path>
<params>--repo-path /data/blacklistfilter/blacklist_repo</params>
<trapinterfaces/>
</module>

<module>
<name>ipblacklistfilter</name>
<enabled>true</enabled>
<path>/usr/bin/nemea/ipblacklistfilter</path>
<params/>
<trapinterfaces>
<interface>
<type>UNIXSOCKET</type>
<direction>IN</direction>
<params>flow_data_source</params>
</interface>
<interface>
<type>UNIXSOCKET</type>
<direction>OUT</direction>
<params>ipblacklist_aggregator_ur_sock</params>
</interface>
</trapinterfaces>
</module>

<module>
<name>ipblacklist_aggregator_ur</name>
<enabled>true</enabled>
<path>/usr/bin/nemea/agg</path>
<params>-k SRC_IP -k DST_IP -k PROTOCOL -k DST_PORT -s BYTES -s PACKETS -o SRC_BLACKLIST -o DST_BLACKLIST -t g:60</params>
<trapinterfaces>
<interface>
<type>UNIXSOCKET</type>
<direction>IN</direction>
<params>ipblacklist_aggregator_ur_sock</params>
</interface>
<interface>
<type>UNIXSOCKET</type>
<direction>OUT</direction>
<params>blacklist_aggregator_ip:timeout=1000</params>
</interface>
</trapinterfaces>
</module>

<module>
<name>blacklist_aggregator_json</name>
<enabled>true</enabled>
<path>/usr/bin/nemea/blacklist_aggregator.py</path>
<params>-t 5</params>
<trapinterfaces>
<interface>
<type>UNIXSOCKET</type>
<direction>IN</direction>
<params>blacklist_aggregator_ip</params>
</interface>
<interface>
<type>UNIXSOCKET</type>
<direction>IN</direction>
<params>blacklist_aggregator_url</params>
</interface>
<interface>
<type>UNIXSOCKET</type>
<direction>OUT</direction>
<params>adaptive_ip_url2:timeout=NO_WAIT</params>
</interface>
</trapinterfaces>
</module>

<module>
<name>urlblacklistfilter</name>
<enabled>true</enabled>
<path>/usr/bin/nemea/urlblacklistfilter</path>
<params/>
<trapinterfaces>
<interface>
<type>UNIXSOCKET</type>
<direction>IN</direction>
<params>http_data_source</params>
</interface>
<interface>
<type>UNIXSOCKET</type>
<direction>OUT</direction>
<params>blacklist_aggregator_url</params>
</interface>
</trapinterfaces>
</module>

<module>
<name>dnsblacklistfilter</name>
<enabled>true</enabled>
<path>/usr/bin/nemea/dnsblacklistfilter</path>
<params/>
<trapinterfaces>
<interface>
<type>UNIXSOCKET</type>
<direction>IN</direction>
<params>dns_data_source</params>
</interface>
<interface>
<type>UNIXSOCKET</type>
<direction>OUT</direction>
<params>adaptive_dns</params>
</interface>
</trapinterfaces>
</module>

<module>
<name>adaptive_ipblacklistfilter</name>
<enabled>true</enabled>
<path>/usr/bin/nemea/ipblacklistfilter</path>
<params>-4 /tmp/blacklistfilter/adaptive.blist</params>
<trapinterfaces>
<interface>
<type>UNIXSOCKET</type>
<direction>IN</direction>
<params>flow_data_source</params>
</interface>
<interface>
<type>FILE</type>
<direction>OUT</direction>
<params>/data/blacklistfilter/evidence_adaptive</params>
</interface>
</trapinterfaces>
</module>

<module>
<name>adaptive_filter</name>
<enabled>true</enabled>
<path>/usr/bin/nemea/adaptive_filter</path>
<params>-p 30 -l 20 -e 300</params>
<trapinterfaces>
<interface>
<type>UNIXSOCKET</type>
<direction>IN</direction>
<params>adaptive_ip_url2</params>
</interface>

<interface>
<type>UNIXSOCKET</type>
<direction>IN</direction>
<params>adaptive_dns</params>
</interface>

<interface>
<type>UNIXSOCKET</type>
<direction>OUT</direction>
<params>blacklist2idea_sock:timeout=NO_WAIT</params>
</interface>

<interface>
<type>FILE</type>
<direction>OUT</direction>
<params>/data/blacklistfilter/evidence_detection</params>
</interface>
</trapinterfaces>
</module>
2 changes: 1 addition & 1 deletion ansible/inventory/host_files/list-vagrant/nemea/detectors/dnstunnel_detection.sup
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<interface>
<type>UNIXSOCKET</type>
<direction>IN</direction>
<params>flow_data_source</params>
<params>dns_data_source</params>
</interface>
<interface>
<type>TCP</type>
Expand Down
Loading