Library Guide

Scripts to inject sample data to AlienVault OSSIM SIEM

I just published a few scripts I wrote to inject sample data to AlienVault or OSSIM (Open Source Version) Unified SIEM. Those can be found in Github:

https://github.com/santiago-bassett/Alienvault-Demo_scripts

The scripts are ready to emulate Syslog data coming from these sources: Aruba Wireless, Cisco ASA, Cisco PIX, ClamAV, Oracle Database, OSSEC HIDS, Sonicwall and SSH.

As well, the scripts are ready to inject malicious network traffic in a dummy interface so it can be analyzed by Snort NIDS. Some of the traffic injected is related to: botnets, C&C communications, Zeus, spambot or spyware. The pcap files can be found in this directory:

https://github.com/santiago-bassett/Alienvault-Demo_scripts/tree/master/pcaps

download file now

Set up GlusterFS with a volume replicated over 2 nodes

The servers setup:

To install the required packages run on both servers:

sudo apt-get install glusterfs-server

If you want a more up to date version of GlusterFS you can add the following repo:

sudo add-apt-repository ppa:semiosis/ubuntu-glusterfs-3.4

Now from one of the servers you must connect to the other:

sudo gluster peer probe <ip_of_the_other_server>

You should see the following output:

peer probe: success

You can check the status from any of the hosts with:

sudo gluster peer status

Now we need to create the volume where the data will reside. For this run the following comand:

sudo gluster volume create datastore1 replica 2 transport tcp <server1_IP>:/mnt/gfs_block <server2_IP>:/mnt/gfs_block

Where /mnt/gfs_block is the mount point where the data will be on each node and datastore1 is the name of the volume you are creating.

If this has been sucessful, you should see:

Creation of volume datastore1 has been successful. Please start the volume to access data.

As the message indicates, we now need to start the volume:

sudo gluster volume start datastore1

As a final test, to make sure the volume is available, run gluster volume info.

sudo gluster volume info 

Your GlusterFS volume is ready and will maintain replication across two nodes.
If you want to Restrict Access to the Volume, you can use the following command:

sudo gluster volume set datastore1 auth.allow gluster_client1_ip,gluster_client2_ip

If you need to remove the restriction at any point, you can type:

sudo gluster volume set volume1 auth.allow *

Setup the clients:

Install the needed packages with:

sudo apt-get install glusterfs-client

To mount the volume you must edit the fstab file:

sudo vi /etc/fstab

And append the following to it:

[HOST1]:/[VOLUME]    /[MOUNT] glusterfs defaults,_netdev,backupvolfile-server=[HOST2] 0 0

Where [HOST1] is the IP address of one of the servers and [HOST2] is the IP of the other server. [VOLUME] is the Volume name, in our case datastore1 and [MOUNT] is the path where you whant the files on the client.

Or, you can also mount the volume using a volume config file:

Create a volume config file for your GlusterFS client.

vi /etc/glusterfs/datastore.vol

Create the above file and replace [HOST1] with your GlusterFS server 1, [HOST2] with your GlusterFS server 2 and [VOLNAME] with the Gluster FS volume to mount.

 volume remote1
 type protocol/client
 option transport-type tcp
 option remote-host [HOST1]
 option remote-subvolume [VOLNAME]
 end-volume

 volume remote2
 type protocol/client
 option transport-type tcp
 option remote-host [HOST2]
 option remote-subvolume [VOLNAME]
 end-volume

 volume replicate
 type cluster/replicate
 subvolumes remote1 remote2
 end-volume

 volume writebehind
 type performance/write-behind
 option window-size 1MB
 subvolumes replicate
 end-volume

 volume cache
 type performance/io-cache
 option cache-size 512MB
 subvolumes writebehind
 end-volume

Finally, edit fstab to add this config file and its mount point. Replace [MOUNT] with the location to mount the storage to.

/etc/glusterfs/datastore.vol [MOUNT] glusterfs rw,allow_other,default_permissions,max_read=131072 0 0

download file now

SERVICE OPTIC PS 2

Kalau tema -teman pernah ngalami berarti optik ps2 teman perlu sedikit maintenance.
Ini saya share tutorial maintenance optic ps2.

Pertama kita siapin keperluan dan bahannya sbb:

1. Obeng kuncup (obeng +) kalo ada dari semua ukuran.
2. Kapas secukupnya.
3. Lens cleaner.
4. Cotton bud.

Ok sudah cukup segitu aja dulu.
Langsung kita kerjakan.....siap grak... uss ini bukan upacara bendera!!

Pertama buka penutup baut pada bagian bawah ps2, ambil obeng lepaskan baut-bautnya, terus buka cover atas ps2



Buka cover cd tray dengan melepas baut-baut kecil diatasnya, ada juga yang tidak mengunakan baut, hanya pakai pengunci tergantung type dan seri ps2. Seperti gambara dibawah.


Tancapkan steker /colokan ps2 ke stop kontak, hidupin saklar belakang ps2, eject cd tray nya, kalo cd tray nya udah keluar segera matikan saklar belakang ps2 dan cabut colokan/steker dari stop kontak untuk menghindari hal-hal yang tidak di inginkan. seperti gambar dibawah.


Selanjutnya buka tutup optik, cari-cari pengunci nya, dorong penguncinya dengan obeng kecil.



Ambil cotton bud basahi ujung-ujung nya dengan lens cleaner(jangan terlalu basah/cukup setengah basah) bersihkan permukaan lensa optik. Gosok dan bersihkan dengan hati-hati sekali.
seperti gambar di bawah.



Jangan lupa berihkan juga lensa optic pada bagian bawah, angkat sedikit lensa optik yang atas dengan cotton bud, seperti gambar di bawah.


Sampai disini teman sudah bisa menutup cover optiknya, dan cover cdrom ps2 bisa kita tutup, kita mau lihat hasil kerja kita... ok setuju.
Selanjutnya tancapkan steker ps2 di stop kontak, hidupin saklar belakang ps2 dan terus pencet reset, maka cd tray akan tertutp. Open/eject cd tray masukin dvd game dan....tunggu.....jreng, game langsung loading siap untuk nge game.

Bila belum ada hasil, padahal teman sudah melakukan semua langkah tutorial diatas, dan terdengar sura aneh sepeti krek...krek di dalam cdrom ps2, berati kita perlu maintenance tambahan. Untuk maintenace tambahan baca tutorial selengkapnya, dan di download dulu disini

SELAMAT MENCOBA

download file now