EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI Pakiti

EGI-InSPIRE RI Pakiti Overview Patch monitoring Unpatched vulnerabilities present severe security threat Client - server architecture In production use by EGI CSIRT Nagios probe against WNs Development by EGI CSIRT

EGI-InSPIRE RI Utilization in EGI

EGI-InSPIRE RI Excerise Install your own Pakiti server Collect report from a node Identify unpatched vulnerabilities

EGI-InSPIRE RI Installation steps Installation of server package Configuration of Apache Configuration of MySQL Configuration of Pakiti server Using Pakiti client

EGI-InSPIRE RI Server package RPM from EGI AppDB 1.rpm --import ch=0x930D2233A28C25A6 2.wget -O /etc/yum.repos.d/pakiti.repo pakiti/pakiti2/releases/repofiles/sl-6- i386.repo 3.yum update 4.yum install pakiti2-server

EGI-InSPIRE RI Apache Configuration Enable https and Pakiti virtual host 1.Remove default https virtual host /etc/httpd/conf.d/ssl.conf 2.Copy Pakiti definition cp /usr/share/doc/pakiti2-server /pakiti2.apache2 /etc/httpd/conf.d/pakiti2.conf 3.Adapt to your preferred authN system 4.Check firewall configuration

EGI-InSPIRE RI MySQL Create Pakiti database and MySQL user: 1.CREATE DATABASE pakiti; 2.CREATE USER IDENTIFIED BY 'really_random_password'; 3.GRANT ALL PRIVILEGES ON pakiti.* to ; 4.FLUSH PRIVILEGES; Create schema: 1.cd /usr/share/doc/pakiti2-server-2.1.6/ 2.mysql -D pakiti -u pakiti -p < pakiti2.sql

EGI-InSPIRE RI Pakiti server Update mysql password/username: 1./etc/pakiti2/pakiti2-server.conf Browse to and adapt Settings (top right) 1. m.redhat.rhsa-2014.xmlhttp:// m.redhat.rhsa-2014.xml 2.Release 4,5,6

EGI-InSPIRE RI Server configuration

EGI-InSPIRE RI Putting it together Install Pakiti client 1.yum install pakiti2-client-manual Configure the client /usr/share/doc/pakiti2-client-manual /pakiti2-client 1.SERVERS="localhost:443“ 2.#CA_PATH="/etc/ssl/certs/" Run the client and check the results

EGI-InSPIRE RI EGI-InSPIRE EGI-InSPIRE RI Central Log Collecting

EGI-InSPIRE RI Motivation Logs can point to an attack and vector Attackers wipe logs once they have root access Having logs stored locally doesn’t scale A single point where to analyse data Local logs are not trustworthy

EGI-InSPIRE RI Solutions syslog, former default logging system replaced by rsyslog (syslog clients can send to rsyslog) syslog-ng (OSE and Premium Edition, additional plugins under proprietary license) Commercial solutions splunk (volume based licensing/can get expensive)

EGI-InSPIRE RI Rsyslog Server Decide whether secure channel is required TLS is supported Decide what directory structure is needed Make sure you have free space on storage Enable monitoring of the server Rsyslog is well documented

EGI-InSPIRE RI Rsyslog client Decide what message to send out Find out security requirements 1.$DefaultNetstreamDriverCAFile /etc/ssl/certs/AddTrust_External_Root.pem 2.$DefaultNetstreamDriver gtls 3.$ActionSendStreamDriverMode 1 4.$ActionSendStreamDriverAuthMode x509/certvalid # server is NOT authenticated 5.*.*

EGI-InSPIRE RI Processing Collected Data Usual tools like grep, etc. Files are available from /var/log/remote-hosts More volumes data needs advanced tools Indexing, filtering ElasticSearch, Kibana Processing logs using cloud tools

EGI-InSPIRE RI Kibana

EGI-InSPIRE RI Excercise Configure your client to log remotely is provided as a VO server Check the log contents Files ssh /var/log/remote-hosts Kibana: board/file/logstashesb.json