337 lines
9.7 KiB
Plaintext
337 lines
9.7 KiB
Plaintext
################################
|
|
# sosetup.conf
|
|
################################
|
|
# This file can be used to automate sosetup.
|
|
#
|
|
# Copy this example file to your home directory:
|
|
# cp /usr/share/securityonion/sosetup.conf ~
|
|
#
|
|
# Edit your new sosetup.conf:
|
|
# nano ~/sosetup.conf
|
|
#
|
|
# Run Setup with the -f switch and the path to this file:
|
|
# sudo sosetup -f ~/sosetup.conf
|
|
|
|
################################
|
|
# Management Interface
|
|
################################
|
|
# MGMT_INTERFACE
|
|
# Which network interface should be the management interface?
|
|
# The management interface has an IP address and is NOT used for sniffing.
|
|
# We recommend that you always make this eth0 if possible for consistency.
|
|
MGMT_INTERFACE='eth2'
|
|
|
|
# MGMT_CONFIG_TYPE
|
|
# Should the management interface be configured using DHCP or static IP?
|
|
# We recommend using static IP whenever possible.
|
|
MGMT_CONFIG_TYPE='static'
|
|
# MGMT_CONFIG_TYPE='DHCP'
|
|
|
|
# If MGMT_CONFIG_TYPE=static, then provide the details here:
|
|
ADDRESS='192.168.39.10'
|
|
NETMASK='255.255.255.0'
|
|
GATEWAY='192.168.39.1'
|
|
NAMESERVER='192.168.39.1'
|
|
DOMAIN='example.com'
|
|
|
|
################################
|
|
# Sniffing interface(s)
|
|
################################
|
|
# Which interface(s) will be sniffing network traffic?
|
|
# For multiple interfaces, please separate them with spaces.
|
|
# For example:
|
|
# SNIFFING_INTERFACES='eth1 eth2'
|
|
SNIFFING_INTERFACES='eth0 eth1'
|
|
|
|
################################
|
|
# Master Server
|
|
################################
|
|
|
|
# SERVER
|
|
# If set to 1, then this box will be a Master server:
|
|
# SERVER=1
|
|
# If set to 0, then this box will connect to a separate Master server:
|
|
# SERVER=0
|
|
SERVER=1
|
|
|
|
# SERVERNAME
|
|
# If SERVER=1, then this should be 'localhost':
|
|
# SERVERNAME='localhost'
|
|
# If SERVER=0, then this should be the name/IP of the separate Master server:
|
|
# SERVERNAME='sguilserver.example.com'
|
|
SERVERNAME='localhost'
|
|
|
|
# SSH_USERNAME
|
|
# If SERVER=0, then this should be the name of an
|
|
# account on the separate Master server that has sudo privileges.
|
|
# sudo privileges can be revoked after sosetup is complete.
|
|
# SSH_USERNAME='sensor1'
|
|
SSH_USERNAME=''
|
|
|
|
# SGUIL_SERVER_NAME
|
|
# If SERVER=1, then this is the name of the Sguil server we'll create.
|
|
# You probably shouldn't change this value.
|
|
SGUIL_SERVER_NAME='securityonion'
|
|
|
|
# SGUIL_CLIENT_USERNAME
|
|
# If SERVER=1, then this is the username that we'll create
|
|
# for Sguil/Squert/ELSA.
|
|
# Please use alphanumeric characters only!
|
|
SGUIL_CLIENT_USERNAME='vagrant'
|
|
|
|
# SGUIL_CLIENT_PASSWORD_1
|
|
# If SERVER=1, then this is the password that we'll create
|
|
# for Sguil/Squert/ELSA.
|
|
# If you set a password here, you may want to change it later and/or
|
|
# shred this file.
|
|
SGUIL_CLIENT_PASSWORD_1='vagrant'
|
|
|
|
################################
|
|
# Master server services
|
|
################################
|
|
# If SERVER=0, then no server services will run.
|
|
# If SERVER=1, then the following services can be enabled/disabled.
|
|
|
|
# Do you want to run Xplico? yes/no
|
|
XPLICO_ENABLED='no'
|
|
|
|
################################
|
|
# ELSA
|
|
################################
|
|
|
|
# ELSA
|
|
# If set to YES, then this box will run ELSA components:
|
|
# ELSA=YES
|
|
# If set to NO, then this box will not run ELSA components:
|
|
# ELSA=NO
|
|
# If you want to run ELSA, then you should enable this setting on every box in your deployment.
|
|
ELSA=YES
|
|
|
|
# UPDATE_ELSA_SERVER
|
|
# If SERVER=0, then the server's elsa_web.conf will need
|
|
# to be updated and Apache restarted for it to recognize
|
|
# this new ELSA node. Restarting Apache will interrupt
|
|
# any running ELSA queries.
|
|
# To automatically update the server's elsa_web.conf and
|
|
# restart Apache, set this option to 'YES':
|
|
# UPDATE_ELSA_SERVER='YES'
|
|
# If you'd rather update the server's elsa_web.conf yourself
|
|
# and manually restart Apache, set this option to 'NO':
|
|
# UPDATE_ELSA_SERVER='NO'
|
|
UPDATE_ELSA_SERVER='YES'
|
|
|
|
# LOG_SIZE_LIMIT
|
|
# This setting controls how much disk space ELSA uses.
|
|
# 10TB = 10000000000000
|
|
# LOG_SIZE_LIMIT='10000000000000'
|
|
# 1TB = 1000000000000
|
|
# LOG_SIZE_LIMIT='1000000000000'
|
|
# 100GB = 100000000000
|
|
# LOG_SIZE_LIMIT='100000000000'
|
|
# 10GB = 10000000000
|
|
LOG_SIZE_LIMIT='10000000000'
|
|
|
|
################################
|
|
# Enable/disable services
|
|
################################
|
|
|
|
# The OSSEC agent sends OSSEC HIDS alerts into the Sguil database.
|
|
# Do you want to run the OSSEC Agent? yes/no
|
|
OSSEC_AGENT_ENABLED='no'
|
|
|
|
# OSSEC_AGENT_LEVEL specifies the level at which OSSEC alerts are sent to sguild.
|
|
OSSEC_AGENT_LEVEL='5'
|
|
|
|
# Salt allows you to manage your entire Security Onion deployment
|
|
# as one cohesive whole. It provides configuration management
|
|
# and remote code execution.
|
|
# Do you want to enable Salt? yes/no
|
|
SALT='no'
|
|
|
|
################################
|
|
# Sensor components
|
|
################################
|
|
# SENSOR
|
|
# If set to 1, then this box will run sensor components and sniff ethernet interfaces:
|
|
# SENSOR=1
|
|
# If set to 0, then this box will not run sensor components:
|
|
# SENSOR=0
|
|
SENSOR=1
|
|
|
|
################################
|
|
# Enable/disable sensor services
|
|
################################
|
|
# If SENSOR=0, then no sensor services will run.
|
|
# If SENSOR=1, then the following services can be enabled/disabled.
|
|
|
|
# BRO_ENABLED
|
|
# Do you want to run Bro? yes/no
|
|
BRO_ENABLED='yes'
|
|
|
|
# IDS_ENGINE_ENABLED
|
|
# Do you want to run an IDS engine (Snort/Suricata)? yes/no
|
|
IDS_ENGINE_ENABLED='yes'
|
|
|
|
# SNORT_AGENT_ENABLED
|
|
# Do you want to run the Snort agent? yes/no
|
|
# The Snort agent sends Snort IDS alerts to the Sguil database.
|
|
SNORT_AGENT_ENABLED='yes'
|
|
|
|
# BARNYARD2_ENABLED
|
|
# Do you want to run Barnyard2? yes/no
|
|
# Barnyard2 sends IDS alerts from Snort/Suricata to
|
|
# Sguil's Snort agent and syslog (ELSA).
|
|
BARNYARD2_ENABLED='yes'
|
|
|
|
# PCAP_ENABLED
|
|
# Do you want to run full packet capture? yes/no
|
|
PCAP_ENABLED='yes'
|
|
|
|
# PCAP_AGENT_ENABLED
|
|
# Do you want to run Sguil's pcap_agent? yes/no
|
|
# The pcap_agent allows Sguil to access the pcap store.
|
|
PCAP_AGENT_ENABLED='yes'
|
|
|
|
# PRADS_ENABLED
|
|
# Do you want to run Prads? yes/no
|
|
# Prads writes session data and asset data.
|
|
# Bro provides the same data types plus more, so most
|
|
# folks don't run Prads.
|
|
PRADS_ENABLED='no'
|
|
|
|
# SANCP_AGENT_ENABLED
|
|
# Do you want to run the sancp_agent? yes/no
|
|
# sancp_agent sends session data from Prads to Sguil.
|
|
SANCP_AGENT_ENABLED='no'
|
|
|
|
# PADS_AGENT_ENABLED
|
|
# Do you want to run the pads_agent? yes/no
|
|
# pads_agent sends asset data from Prads to Sguil.
|
|
PADS_AGENT_ENABLED='no'
|
|
|
|
# HTTP_AGENT_ENABLED
|
|
# Do you want to run the http_agent? yes/no
|
|
# http_agent sends http logs from Bro to Sguil.
|
|
# If you're running ELSA, then you probably want to disable this.
|
|
HTTP_AGENT_ENABLED='no'
|
|
|
|
# ARGUS_ENABLED
|
|
# Do you want to run Argus? yes/no
|
|
# Argus writes session data, also provided by Bro and Prads.
|
|
# Most folks don't run Argus.
|
|
ARGUS_ENABLED='no'
|
|
|
|
################################
|
|
# Rules
|
|
################################
|
|
|
|
# IDS_RULESET
|
|
# This setting is only necessary on a master server.
|
|
# Sensors automatically inherit ruleset from the master server.
|
|
# Which IDS ruleset would you like to use?
|
|
# Emerging Threats Open (no oinkcode required):
|
|
# ETOPEN
|
|
# Emerging Threats PRO (requires ETPRO oinkcode):
|
|
# ETPRO
|
|
# Sourcefire VRT (requires VRT oinkcode):
|
|
# VRT
|
|
# VRT and ET (requires VRT oinkcode):
|
|
# VRTET
|
|
IDS_RULESET='ETOPEN'
|
|
|
|
# OINKCODE
|
|
# This setting is only necessary on a master server.
|
|
# Sensors automatically inherit ruleset from the master server.
|
|
# If you're running VRT or ETPRO rulesets, you'll need to supply your
|
|
# oinkcode here.
|
|
OINKCODE=''
|
|
|
|
################################
|
|
# PF_RING Config
|
|
################################
|
|
|
|
# PF_RING_SLOTS
|
|
# The default is 4096.
|
|
# High traffic networks may need to increase this.
|
|
PF_RING_SLOTS=4096
|
|
|
|
################################
|
|
# IDS Config
|
|
################################
|
|
|
|
# IDS_ENGINE
|
|
# Which IDS engine would you like to run? snort/suricata
|
|
# Whatever you choose here will apply to the master server
|
|
# and then sensors inherit this setting from the master server.
|
|
# To run Snort:
|
|
# IDS_ENGINE='snort'
|
|
# To run Suricata:
|
|
# IDS_ENGINE='suricata'
|
|
IDS_ENGINE='snort'
|
|
|
|
# IDS_LB_PROCS
|
|
# How many PF_RING load-balanced processes would you like to run?
|
|
# This value should be lower than your number of CPU cores.
|
|
IDS_LB_PROCS='1'
|
|
|
|
# HOME_NET
|
|
# Setup by default configures Snort/Suricata's HOME_NET variable
|
|
# as RFC 1918 (192.168.0.0/16,10.0.0.0/8,172.16.0.0/12).
|
|
# If you wish to provide a custom value, enter it below,
|
|
# ensuring a comma is placed after each range, with no spaces in between.
|
|
# Ex. HOME_NET='192.168.0.0/16,10.0.0.0/8,172.16.0.0/12'
|
|
HOME_NET='192.168.0.0/16,10.0.0.0/8,172.16.0.0/12'
|
|
|
|
################################
|
|
# Bro Config
|
|
################################
|
|
|
|
# BRO_LB_PROCS
|
|
# How many PF_RING load-balanced processes would you like Bro to run?
|
|
# This value should be lower than your number of CPU cores.
|
|
BRO_LB_PROCS='1'
|
|
|
|
# EXTRACT_FILES
|
|
# Do you want Bro to automatically extract Windows EXEs and write them to disk? yes/no
|
|
EXTRACT_FILES='yes'
|
|
|
|
################################
|
|
# PCAP Config
|
|
################################
|
|
|
|
# PCAP_SIZE
|
|
# How large do you want your pcap files to be?
|
|
# The default is 150MB.
|
|
PCAP_SIZE='150'
|
|
|
|
# PCAP_RING_SIZE
|
|
# How big of a ring buffer should be allocated for netsniff-ng?
|
|
# The default is 64MB.
|
|
PCAP_RING_SIZE='64'
|
|
|
|
# PCAP_OPTIONS
|
|
# The default option here of '-c' is intended for low-volume environments.
|
|
# If monitoring lots of traffic, you will want to remove the -c to use
|
|
# netsniff-ng's default scatter/gather I/O or consider netsniff-ng's --mmap option.
|
|
PCAP_OPTIONS='-c'
|
|
|
|
################################
|
|
# Maintenance
|
|
################################
|
|
|
|
# WARN_DISK_USAGE
|
|
# Begin warning when disk usage reaches this level
|
|
WARN_DISK_USAGE='80'
|
|
|
|
# CRIT_DISK_USAGE
|
|
# Begin purging old files when disk usage reaches this level
|
|
CRIT_DISK_USAGE='90'
|
|
|
|
# DAYSTOKEEP
|
|
# Only applies to Sguil database ('securityonion_db')
|
|
DAYSTOKEEP='30'
|
|
|
|
# DAYSTOREPAIR
|
|
# Only applies to Sguil database ('securityonion_db')
|
|
DAYSTOREPAIR='7'
|