Self-security
Introduction
Self security module will check network interfaces and will analyse traffic to check if there are cybersecurity attacks.
Features
This module focuses on deploying an Intrusion Detection System (IDS) based on suricata on a kubernetes cluster or docker. It aims to monitor network traffic towards the nodes of the cluster as described above.
Place in architecture
The following figure describe the self-security module inside the IE and the relationship with another self-* modules.
User guide
The primary objective is to monitor the network traffic directed towards the nodes of our Kubernetes cluster. We can alternatively use two infrastructures to implement Suricata depending on our needs:
K8s infrastructure
Helm
Non K8s infrastructure
Prerequisities
Docker, Docker-compose or kubectl and helm are necesary to deploy this component.
Installation
Helm
Before deploying, the file values.yaml should be updated with the URL of the endpoint, the Trust Manager endpoint server, in:
etl:
endpointURL: "http://ENDPOINT_URL/notification"
In order to deploy the self-security module with Helm, it can be done in two ways:
Option 1: Deploy from source code
helm install self-security self-security/
Option 2: Deploy from the https://gitlab.aeros-project.eu/aeros-public/common-deployments self-security package
helm repo add --username <username> --password <token> aeros-common https://gitlab.aeros-project.eu/api/v4/projects/65/packages/helm/stable helm repo update helm install self-security aeros-common/self-security
K8s
Before deploying our file suricata-daemonset.yaml, we will have to configure the URL of the endpoint server in the:
- name: ENDPOINT_URL
value: "http://ENDPOINT_URL"
In the case of a k8s infrastructure, we can choose the Suricata implementation through:
1. Setting up the configuration
We can modify the suricata.yaml/suricata-suricata.yaml and suricata.rules/suricata-rules.yaml configuration files as required depending on the Option we use to apply the configuration, as seen below.
2. Applying settings
There are two options to apply the configuration to the Kubernetes cluster:
Option 1:
kubectl create -f suricata-suricata.yaml kubectl create -f suricata-rules.yaml kubectl create -f suricata-daemonset.yaml
Option 2:
kubectl create configmap suricata-config --from-file=suricata.yaml=suricata.yaml kubectl create configmap suricata-rules --from-file=suricata.rules kubectl create -f suricata-daemonset.yaml
Non K8s
In the case of a non-Kubernetes (non-k8s) infrastructure, we have this configuration:
Update the system
It is advisable to update the system:
sudo apt update && sudo apt upgrade
Install the necessary dependencies for Suricata and the ETL script etl.py:
sudo apt install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev \ libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \ libcap-ng-dev libcap-ng0 make libmagic-dev libjansson-dev \ libnss3-dev libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \ python3 python3-yaml
pip3 install requests
Install Suricata
sudo apt install suricata
Check the location of Suricata configuration files
This helps obtain more information about its installation:
ls /etc/suricata/Place the ETL script
Put the etl.py script in the directory where we want to execute it later.
Testing
Helm/K8s
After deploying Suricata, you can test its functionality by sending ICMP packets using the ping command. The rules configured in suricata.rules or suricata-rules.yaml will determine Suricata’s response.
Test Suricata using the following command:
nmap <target_IP> -Pn -A -T4
Verify Suricata’s activity:
kubectl exec -it <POD_NAME> -- cat /var/log/suricata/fast.log
Non K8s
Run Suricata
sudo suricata -c /etc/suricata/suricata.yaml -i <INTERFACE>
Note
Select the network interface that will be used.
Run the etl.py script, specifying the endpoint URL:
python3 etl.pyGenerate traffic to verify that Suricata is working and generating data:
nmap <target_IP> -Pn -A -T4
Verify Suricata’s activity:
cat /var/log/suricata/fast.log
Developer guide
Helm
Clone the repository.
Change the values in values.yaml(k8s-infra/helm/self-security/values.yaml) and change the value for http://ENDPOINT_URL.
Deploy the suricata configuration and check firewall rules if we are using cloud services.
Perform the test using NMAP traffic.
Check Suricata activity.
Check the data on the endpoint (Trust Manager).
K8s
Clone the repository.
Change the values we want in suricata.yaml/suricata-suricata.yaml and suricata.rules/suricata-rules.yaml.
Change the value for http://ENDPOINT_URL in suricata-daemonset.yaml.
Deploy the suricata configuration and check firewall rules if we are using cloud services.
Perform the test using Nmap.
Check Suricata activity.
Check the data on the endpoint (trust Manager).
Non K8s
Clone the repository.
Change the values we want in suricata.yaml and suricata.rules.
Install Suricata and the necessary dependencies and install Python library requests.
Copy suricata.yaml to path /etc/suricata/ and suricata.rules to path /var/lib/suricata/rules/
Run Suricata.
Run the etl.py.
Perform the test using Nmap.
Check Suricata activity.
Check the data the endpoint (Trust Manager).