Skip to content

Commit 3b1093e

Browse files
jeffgeigerjeffgeiger
authored
Merge pull request #109 from rocknsm/dcode/pull-102/fsf
Updates towards merging in FSF LGTM
2 parents 8e989f4 + 0e892eb commit 3b1093e

12 files changed

Lines changed: 304 additions & 66 deletions

‎ansible/files/logrotate-fsf.conf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
/data/fsf/*.log
2+
{
3+
rotate 3
4+
missingok
5+
compress
6+
create 0644 fsf fsf
7+
}

‎ansible/files/logstash-fsf-es.conf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
input {
2+
file {
3+
codec => "json"
4+
path => "/data/fsf/scan.log"
5+
add_field => { "[@metadata][stage]" => "fsf" }
6+
}
7+
}
8+
9+
filter {
10+
if "_jsonparsefailure" in [tags] {
11+
drop { }
12+
}
13+
if [@metadata][stage] == "fsf" {
14+
mutate { remove_field => ["path"] }
15+
}
16+
}
17+
18+
output {
19+
if [@metadata][stage] == "fsf" {
20+
#stdout { codec => rubydebug }
21+
elasticsearch {
22+
hosts => ["127.0.0.1"]
23+
index => "fsf-%{+YYYY.MM.dd}"
24+
document_type => "fsf"
25+
}
26+
}
27+
}

‎ansible/files/rock_start‎

Lines changed: 67 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,71 @@
11
#!/bin/bash
22

3-
echo "Starting Zookeeper..."
4-
systemctl start zookeeper
5-
sleep 5
6-
systemctl status zookeeper | egrep "^\s*Active"
7-
8-
echo "Starting Elasticsearch..."
9-
systemctl start elasticsearch
10-
sleep 5
11-
systemctl status elasticsearch | egrep "^\s*Active"
12-
13-
echo "Starting Kafka..."
14-
systemctl start kafka
15-
sleep 5
16-
systemctl status kafka | egrep "^\s*Active"
17-
18-
echo "Starting Logstash..."
19-
systemctl start logstash
20-
sleep 5
21-
systemctl status logstash | egrep "^\s*Active"
22-
23-
echo "Starting Kibana..."
24-
systemctl start kibana
25-
sleep 5
26-
systemctl status kibana | egrep "^\s*Active"
27-
28-
echo "Starting Suricata..."
29-
systemctl start suricata
30-
sleep 5
31-
systemctl status suricata | egrep "^\s*Active"
32-
33-
echo "Starting Bro..."
34-
systemctl start broctl
35-
sleep 5
36-
systemctl status broctl | egrep "^\s*Active"
37-
38-
#echo "Starting Stenographer..."
39-
#systemctl start stenographer
40-
#sleep 5
41-
#systemctl status stenographer | egrep "^\s*Active"
3+
function feature_enabled() {
4+
grep -qiE "^enable_$1: (true|yes)" /etc/rocknsm/config.yml;
5+
return $?
6+
}
7+
8+
if feature_enabled zookeeper; then
9+
echo "Starting Zookeeper..."
10+
systemctl start zookeeper
11+
sleep 5
12+
systemctl status zookeeper | egrep "^\s*Active"
13+
fi
14+
15+
if feature_enabled elasticsearch; then
16+
echo "Starting Elasticsearch..."
17+
systemctl start elasticsearch
18+
sleep 5
19+
systemctl status elasticsearch | egrep "^\s*Active"
20+
fi
21+
22+
if feature_enabled kafka; then
23+
echo "Starting Kafka..."
24+
systemctl start kafka
25+
sleep 5
26+
systemctl status kafka | egrep "^\s*Active"
27+
fi
28+
29+
if feature_enabled logstash; then
30+
echo "Starting Logstash..."
31+
systemctl start logstash
32+
sleep 5
33+
systemctl status logstash | egrep "^\s*Active"
34+
fi
35+
36+
if feature_enabled kibana; then
37+
echo "Starting Kibana..."
38+
systemctl start kibana
39+
sleep 5
40+
systemctl status kibana | egrep "^\s*Active"
41+
fi
42+
43+
if feature_enabled suricata; then
44+
echo "Starting Suricata..."
45+
systemctl start suricata
46+
sleep 5
47+
systemctl status suricata | egrep "^\s*Active"
48+
fi
49+
50+
if feature_enabled bro; then
51+
echo "Starting Bro..."
52+
systemctl start broctl
53+
sleep 5
54+
systemctl status broctl | egrep "^\s*Active"
55+
fi
56+
57+
if feature_enabled stenographer; then
58+
echo "Starting Stenographer..."
59+
systemctl start stenographer
60+
sleep 5
61+
systemctl status stenographer | egrep "^\s*Active"
62+
fi
63+
64+
if feature_enabled fsf; then
65+
echo "Starting FSF..."
66+
systemctl start fsf
67+
sleep 5
68+
systemctl status fsf | egrep "^\s*Active"
69+
fi
4270

4371
exit 0

‎ansible/files/rock_status‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,13 @@ export MON_IFS=$(cat /opt/bro/etc/node.cfg | grep interface | \
8484
systemctl status suricata
8585
}
8686

87+
#----------------------------------------------------------------------------
88+
## FSF
89+
##----------------------------------------------------------------------------
90+
@test "Check that FSF is running" {
91+
systemctl status fsf
92+
}
93+
8794
#----------------------------------------------------------------------------
8895
# ZOOKEEPER
8996
#----------------------------------------------------------------------------

‎ansible/files/rock_stop‎

Lines changed: 54 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,59 @@
11
#!/bin/bash
22

3-
#echo "Stopping Stenographer..."
4-
#systemctl stop stenographer
53

6-
echo "Stopping Suricata..."
7-
systemctl stop suricata
8-
9-
echo "Stopping Bro..."
10-
systemctl stop broctl
11-
12-
echo "Stopping Logstash..."
13-
systemctl stop logstash
14-
15-
echo "Stopping Kibana..."
16-
systemctl stop kibana
17-
18-
echo "Stopping Elasticsearch..."
19-
systemctl stop elasticsearch
20-
21-
echo "Stopping Kafka..."
22-
systemctl stop kafka
23-
24-
echo "Stopping Zookeeper..."
25-
systemctl stop zookeeper
4+
function feature_enabled() {
5+
grep -qiE "^enable_$1: (true|yes)" /etc/rocknsm/config.yml;
6+
return $?
7+
}
8+
9+
if feature_enabled fsf; then
10+
echo "Stopping FSF..."
11+
systemctl stop fsf
12+
fi
13+
14+
if feature_enabled suricata; then
15+
echo "Stopping Stenographer..."
16+
systemctl stop stenographer
17+
fi
18+
19+
if feature_enabled suricata; then
20+
echo "Stopping Suricata..."
21+
systemctl stop suricata
22+
fi
23+
24+
if feature_enabled snort; then
25+
echo "Stopping Snort..."
26+
systemctl stop snortd
27+
fi
28+
29+
if feature_enabled bro; then
30+
echo "Stopping Bro..."
31+
systemctl stop broctl
32+
fi
33+
34+
if feature_enabled logstash; then
35+
echo "Stopping Logstash..."
36+
systemctl stop logstash
37+
fi
38+
39+
if feature_enabled kibana; then
40+
echo "Stopping Kibana..."
41+
systemctl stop kibana
42+
fi
43+
44+
if feature_enabled elasticsearch; then
45+
echo "Stopping Elasticsearch..."
46+
systemctl stop elasticsearch
47+
fi
48+
49+
if feature_enabled kafka; then
50+
echo "Stopping Kafka..."
51+
systemctl stop kafka
52+
fi
53+
54+
if feature_enabled zookeeper; then
55+
echo "Stopping Zookeeper..."
56+
systemctl stop zookeeper
57+
fi
2658

2759
exit 0

‎ansible/files/rocknsm_config.dist.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,21 @@ with_kibana: true
2828
with_zookeeper: true
2929
with_kafka: true
3030
with_nginx: true
31+
with_fsf: true
32+
33+
# Feature options - Don't flip these unless you know what you're doing
34+
enable_stenographer: false
35+
enable_bro: true
36+
enable_suricata: true
37+
enable_snort: false
38+
enable_pulledpork: true
39+
enable_logstash: true
40+
enable_elasticsearch: true
41+
enable_kibana: true
42+
enable_zookeeper: true
43+
enable_kafka: true
44+
enable_nginx: true
45+
enable_fsf: false
3146

3247
rocknsm_package_list:
3348
- java-1.8.0-openjdk-headless
@@ -84,6 +99,11 @@ suricata_group: suricata
8499
suricata_data_dir: "{{ rock_data_dir }}/suricata"
85100
pulled_pork_repo: https://github.com/shirkdog/pulledpork.git
86101
pulled_pork_oinkcode: 796f26a2188c4c953ced38ff3ec899d8ae543350
102+
fsf_user: fsf
103+
fsf_group: fsf
104+
fsf_data_dir: "{{ rock_data_dir }}/fsf"
105+
fsf_archive_dir: "{{ fsf_data_dir }}/archive"
106+
fsf_client_logfile: "{{ fsf_data_dir }}/client.log"
87107
kafka_user: kafka
88108
kafka_group: kafka
89109
kafka_data_dir: "{{ rock_data_dir }}/kafka"

‎ansible/rock.yml‎

Lines changed: 74 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@
172172
- { pkg: zookeeper, test: "{{with_zookeeper}}", state: installed }
173173
- { pkg: kafka, test: "{{with_kafka}}", state: installed }
174174
- { pkg: kafkacat, test: "{{with_kafka}}", state: installed }
175+
- { pkg: fsf, test: "{{with_fsf}}", state: installed }
175176
- { pkg: chrony, state: installed }
176177
- { pkg: firewalld, state: installed }
177178
- { pkg: postfix, state: absent }
@@ -381,7 +382,6 @@
381382
git:
382383
repo: "{{ bro_rockscripts_repo }}"
383384
dest: /opt/bro/share/bro/site/scripts/rock
384-
depth: 1
385385
version: "{{ bro_rockscripts_branch }}"
386386
when: rock_online_install
387387

@@ -403,6 +403,17 @@
403403
force: yes
404404
when: not rock_online_install
405405

406+
- name: Update owner for ROCK NSM Bro scripts
407+
file:
408+
path: /opt/bro/share/bro/site/scripts/rock
409+
owner: "{{ bro_user }}"
410+
group: "{{ bro_group }}"
411+
state: directory
412+
recurse: yes
413+
follow: yes
414+
tags:
415+
- bro_scripts
416+
406417
- name: Add ROCK scripts to local.bro
407418
lineinfile:
408419
dest: /opt/bro/share/bro/site/local.bro
@@ -665,6 +676,59 @@
665676
{{ "/usr/bin/systemctl restart snortd;" if with_snort else None }}
666677
when: with_pulledpork
667678

679+
#######################################################
680+
######################## FSF ##########################
681+
#######################################################
682+
683+
- name: Create FSF data dir
684+
file:
685+
path: "{{ fsf_data_dir }}"
686+
mode: 0755
687+
owner: "{{ fsf_user }}"
688+
group: "{{ fsf_group }}"
689+
state: directory
690+
when: with_fsf
691+
692+
- name: Create FSF archive dir
693+
file:
694+
path: "{{ fsf_archive_dir }}"
695+
mode: 0755
696+
owner: "{{ fsf_user }}"
697+
group: "{{ fsf_group }}"
698+
state: directory
699+
when: with_fsf
700+
701+
- name: Configure logrotate for FSF logs
702+
copy:
703+
src: files/logrotate-fsf.conf
704+
dest: /etc/logrotate.d/fsf.conf
705+
mode: 0644
706+
owner: root
707+
group: root
708+
when: with_fsf
709+
710+
- name: Configure fsf-server
711+
template:
712+
src: templates/fsf-server-config.j2
713+
dest: /opt/fsf/fsf-server/conf/config.py
714+
owner: "{{ fsf_user }}"
715+
group: "{{ fsf_group }}"
716+
mode: 0644
717+
when: with_fsf
718+
719+
- name: Configure fsf-client
720+
template:
721+
src: templates/fsf-client-config.j2
722+
dest: /opt/fsf/fsf-client/conf/config.py
723+
owner: "{{ fsf_user }}"
724+
group: "{{ fsf_group }}"
725+
mode: 0644
726+
when: with_fsf
727+
728+
- name: Enable and start FSF
729+
service: name=fsf state=started enabled=yes
730+
when: with_fsf and enable_fsf
731+
668732
######################################################
669733
################### Setup Zookeeper ##################
670734
######################################################
@@ -831,6 +895,15 @@
831895
group: root
832896
when: with_logstash and with_suricata
833897

898+
- name: Configure Logstash to pickup the FSF scan.log
899+
copy:
900+
src: "files/logstash-fsf-es.conf"
901+
dest: "/etc/logstash/conf.d/fsf-es.conf"
902+
mode: 0644
903+
owner: root
904+
group: root
905+
when: with_logstash and with_fsf
906+
834907
- name: Enable and start Logstash
835908
service: name=logstash state=started enabled=yes
836909
when: with_logstash

0 commit comments

Comments
 (0)