-
Notifications
You must be signed in to change notification settings - Fork 0
/
install.sh
79 lines (66 loc) · 2.68 KB
/
install.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
#check if root
if [ "$EUID" -ne 0 ]
then echo "Please run as root"
exit
fi
yum -y update
yum -y install java
yum -y install net-tools
#configure GeoIP
cd /etc/
sed -i "s/EditionIDs GeoLite2-Country GeoLite2-City/EditionIDs GeoLite2-City GeoLite2-Country GeoLite2-ASN/g" /etc/GeoIP.conf
geoipupdate
cd /etc/cron.weekly/
sudo wget https://raw.githubusercontent.com/pclever1/pfELK-centos/master/geoipupdate
#install ELK
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
cd /etc/yum.repos.d/
sudo wget https://raw.githubusercontent.com/pclever1/pfELK-centos/master/elasticsearch.repo
yum -y install elasticsearch
yum -y install kibana
yum -y install logstash
cd /etc/logstash/conf.d
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/01-inputs.conf
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/05-syslog.conf
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/10-pf.conf
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/11-firewall.conf
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/50-outputs.conf
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/12-suricata.conf
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/13-snort.conf
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/15-others.conf
mkdir /etc/logstash/conf.d/patterns
cd /etc/logstash/conf.d/patterns/
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/patterns/pf-09.2019.grok
#check local IP
ip=$(eval "ifconfig | sed -En 's/127.0.0.1//;s/.*inet (addr:)?(([0-9]*\.){3}[0-9]*).*/\2/p'")
#configure kibana
sed -i "s/#server.port: 5601/server.port: 5601/g" /etc/kibana/kibana.yml
sed -i "s/#server.host/server.host/g" /etc/kibana/kibana.yml
sed -i "s/localhost/$ip/g" /etc/kibana/kibana.yml
#configure logstash
clear
echo '-------------------------'
echo '-------------------------'
echo '-------------------------'
read -p 'Enter your pfSense IP address: ' pfip
pfip=$(eval echo $pfip | sed 's/\./\\\\\\./g')
sed -i "s/172\\\.22\\\.33\\\.1/$pfip/g" /etc/logstash/conf.d/05-syslog.conf
#start services on boot
/bin/systemctl daemon-reload
/bin/systemctl enable elasticsearch.service
/bin/systemctl enable kibana.service
/bin/systemctl enable logstash.service
#configure firewall
systemctl stop firewalld
systemctl disable firewalld
#start services
systemctl start elasticsearch
systemctl start kibana
systemctl start logstash
clear
echo
echo '-------------------------'
echo "Install has completed."
echo "You must configure pfSense to forward logs to $ip:5140"
echo "ELK is now running, you can access it at $ip:5601"
echo '-------------------------'