##################### Self-security ##################### .. contents:: :local: :depth: 1 Introduction ============ Self security module will check network interfaces and will analyse traffic to check if there are cybersecurity attacks. Features ======== This module focuses on deploying an Intrusion Detection System (IDS) based on suricata on a kubernetes cluster or docker. It aims to monitor network traffic towards the nodes of the cluster as described above. Place in architecture ===================== The following figure describe the self-security module inside the IE and the relationship with another self-* modules. .. image:: ./self_capabilities_relationships.png :alt: self-awareness module inside the IE and the relationships with another self-* modules :align: center User guide ========== The primary objective is to monitor the network traffic directed towards the nodes of our Kubernetes cluster. We can alternatively use two infrastructures to implement Suricata depending on our needs: - K8s infrastructure - Helm - Non K8s infrastructure Prerequisities ============== Docker, Docker-compose or kubectl and helm are necesary to deploy this component. Installation ============ **Helm** Before deploying, the file `values.yaml` should be updated with the URL of the endpoint, the Trust Manager endpoint server, in: .. code-block:: yaml etl: endpointURL: "http://ENDPOINT_URL/notification" In order to deploy the self-security module with Helm, it can be done in two ways: - **Option 1: Deploy from source code** .. code-block:: bash helm install self-security self-security/ - **Option 2: Deploy from the** https://gitlab.aeros-project.eu/aeros-public/common-deployments **self-security package** .. code-block:: bash helm repo add --username --password aeros-common https://gitlab.aeros-project.eu/api/v4/projects/65/packages/helm/stable helm repo update helm install self-security aeros-common/self-security **K8s** Before deploying our file `suricata-daemonset.yaml`, we will have to configure the URL of the endpoint server in the: .. code-block:: yaml - name: ENDPOINT_URL value: "http://ENDPOINT_URL" In the case of a k8s infrastructure, we can choose the Suricata implementation through: **1. Setting up the configuration** We can modify the `suricata.yaml`/`suricata-suricata.yaml` and `suricata.rules`/`suricata-rules.yaml` configuration files as required depending on the *Option* we use to apply the configuration, as seen below. **2. Applying settings** There are two options to apply the configuration to the Kubernetes cluster: - **Option 1:** .. code-block:: shell kubectl create -f suricata-suricata.yaml kubectl create -f suricata-rules.yaml kubectl create -f suricata-daemonset.yaml - **Option 2:** .. code-block:: shell kubectl create configmap suricata-config --from-file=suricata.yaml=suricata.yaml kubectl create configmap suricata-rules --from-file=suricata.rules kubectl create -f suricata-daemonset.yaml **Non K8s** In the case of a non-Kubernetes (non-k8s) infrastructure, we have this configuration: 1. **Update the system** It is advisable to update the system: .. code-block:: bash sudo apt update && sudo apt upgrade 2. **Install the necessary dependencies for Suricata and the ETL script** `etl.py`: .. code-block:: bash sudo apt install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev \ libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \ libcap-ng-dev libcap-ng0 make libmagic-dev libjansson-dev \ libnss3-dev libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \ python3 python3-yaml .. code-block:: bash pip3 install requests 3. **Install Suricata** .. code-block:: bash sudo apt install suricata 4. **Check the location of Suricata configuration files** This helps obtain more information about its installation: .. code-block:: bash ls /etc/suricata/ 5. **Place the ETL script** Put the `etl.py` script in the directory where we want to execute it later. Testing ===================== **Helm/K8s** After deploying Suricata, you can test its functionality by sending ICMP packets using the `ping` command. The rules configured in `suricata.rules` or `suricata-rules.yaml` will determine Suricata's response. 1. **Test Suricata using the following command:** .. code-block:: shell nmap -Pn -A -T4 2. **Verify Suricata's activity:** .. code-block:: shell kubectl exec -it -- cat /var/log/suricata/fast.log **Non K8s** 1. **Run Suricata** .. code-block:: shell sudo suricata -c /etc/suricata/suricata.yaml -i .. note:: Select the network interface that will be used. 2. **Run the** `etl.py` **script, specifying the endpoint URL:** .. code-block:: bash python3 etl.py 3. **Generate traffic to verify that Suricata is working and generating data:** .. code-block:: shell nmap -Pn -A -T4 4. **Verify Suricata's activity:** .. code-block:: shell cat /var/log/suricata/fast.log Developer guide =============== **Helm** 1. Clone the repository. 2. Change the values in values.yaml(k8s-infra/helm/self-security/values.yaml) and change the value for `http://ENDPOINT_URL`. 3. Deploy the suricata configuration and check firewall rules if we are using cloud services. 4. Perform the test using NMAP traffic. 5. Check Suricata activity. 6. Check the data on the endpoint (Trust Manager). **K8s** 1. Clone the repository. 2. Change the values we want in `suricata.yaml`/`suricata-suricata.yaml` and `suricata.rules`/`suricata-rules.yaml`. 3. Change the value for `http://ENDPOINT_URL` in `suricata-daemonset.yaml`. 4. Deploy the suricata configuration and check firewall rules if we are using cloud services. 5. Perform the test using Nmap. 6. Check Suricata activity. 7. Check the data on the endpoint (trust Manager). **Non K8s** 1. Clone the repository. 2. Change the values we want in `suricata.yaml` and `suricata.rules`. 3. Install Suricata and the necessary dependencies and install Python library `requests`. 4. Copy `suricata.yaml` to path `/etc/suricata/` and `suricata.rules` to path `/var/lib/suricata/rules/` 5. Run Suricata. 6. Run the `etl.py`. 7. Perform the test using Nmap. 8. Check Suricata activity. 9. Check the data the endpoint (Trust Manager). Authors ======= Ramiro Torres (@rtorres_S21Sec), Jon Egaña (@jonegana_s21sec) and Oscar Lopez (@olopez) as part of the S21Sec team License ======= Notice (dependencies) =====================