如何首次为 Bionic 配置 Prewikka？

Question

首次安装 Prelude 和 Prewikka 包：

安装前，我们需要一个数据库来存储警报，我选择在 MySQL 中创建数据库

$ mysql -u root -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 8.0.13 MySQL Community Server - GPL    
Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.    
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.    
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.    
mysql>CREATE USER user1@localhost IDENTIFIED BY 'pass';
Query OK, 1 row affected (0,11 sec)    
mysql>CREATE DATABASE prelude;
Query OK, 1 row affected (2,09 sec)    
mysql> GRANT ALL PRIVILEGES ON prelude.* TO user1@localhost;
Query OK, 0 rows affected (0,93 sec)    
mysql>CREATE DATABASE prewikka;
Query OK, 1 row affected (2,10 sec)    
mysql> GRANT ALL PRIVILEGES ON prelude.* TO user1@localhost;
Query OK, 0 rows affected (0,94 sec)    
mysql>FLUSH PRIVILEGES;
mysql>EXIT;

需要安装 Prelude 和 Prewikka

$ sudo apt install prelude-utils prelude-manager prelude-lml libpreludedb*
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following additional packages will be installed:
  dbconfig-common libmaxminddb0 prelude-lml-rules
Suggested packages:
  dbconfig-mysql | dbconfig-pgsql | dbconfig-sqlite | dbconfig-sqlite3 | dbconfig-no-thanks mmdb-bin
Recommended packages:
  default-mysql-client | postgresql-client
The following NEW packages will be installed:
  dbconfig-common libmaxminddb0 libpreludedb0 libpreludedb7 libpreludedbcpp2 libpreludedb-dev libpreludedb-doc libpreludedb7-mysql libpreludedb7-pgsql libpreludedb7-sqlite prelude-lml prelude-lml-rules
  prelude-manager
0 upgraded, 13 newly installed, 0 to remove and 0 not upgraded.
Need to get 968 kB of archives.
After this operation, 3.881 kB of additional disk space will be used.
Do you want to continue? [Y/n] y

dpkg在配置时，我们将创建一个用户数据库、名称数据库和密码数据库，存储在上dbconfig-common。如果我们像我的情况一样忘记了它们，我们可以在/etc/prewikka/prewikka.conf文件中检查它们。

代理注册的配置。

管理器代理和 LML 客户端代理需要作为分析器登录 Prelude 管理员来运行命令包。

首先要添加管理代理，如下所示：

$ prelude-admin add prelude-manager --uid 0 --gid 0 #for user id and group id, you can check on `/etc/passwd` file.
Generating 2048 bits RSA private key... This might take a very long time.
[Increasing system activity will speed-up the process].
Generation in progress... 
Created profile 'prelude-manager' with analyzerID 'xxxxxxxxxxxxxxxx'.

注册 LML 代理的第二件事如下：

$ prelude-admin register prelude-lml "idmef:w admin:r" 127.0.0.1 --uid 0 --gid 0
Generating 2048 bits RSA private key... This might take a very long time.
[Increasing system activity will speed-up the process].
Generation in progress...   
You now need to start "prelude-admin" registration-server on 127.0.0.1:
example: "prelude-admin registration-server prelude-manager"  
Enter the one-shot password provided on 127.0.0.1: 
Confirm the one-shot password provided on 127.0.0.1:  
Connecting to registration server (127.0.0.1:5553)... Authentication succeeded.
Successful registration to 127.0.0.1:5553.

在 Manager Agent 上运行：

$ prelude-admin registration-server prelude-manager
The "password" password will be requested by "prelude-admin register"
in order to connect. Please remove the quotes before using it.  
Generating 1024 bits Diffie-Hellman key for anonymous authentication...
Waiting for peers install request on 0.0.0.0:5553...
Waiting for peers install request on :::5553...      
Connection from 127.0.0.1:45796...
Registration request for analyzerID="xxxxxxxxxxxxxxxx" permission="idmef:w admin:r".
Approve registration? [y/n]: y
127.0.0.1:45796 successfully registered.

证书验证后，不忘记配置服务器在/etc/prelude/default/client.conf文件、/etc/prelude/default/global.conf文件、/etc/prelude-manager/prelude-manager.conf文件和/etc/prelude-lml/prelude-lml.conf文件上的监听器。然后我们可以启动 Prelude 的服务：

$ sudo systemctl enable prelude-manager
$ sudo systemctl start prelude-manager
$ sudo systemctl enable prelude-lml
$ sudo systemctl start prelude-lml

最后执行/usr/bin/prewikkapython脚本后，我们将获得监听服务器，0.0.0.0:8000我们可以输入进行浏览localhost:8000，如果没有出现输出错误，那么它将如下所示：

资料来源：Prelude-WikiStart，从源代码安装，从软件包安装Ubuntu。

Answer 1