CentOS 6.4 – Configuring my openvswitch bridge

This in an updated version from an older post published last year. Many things have changed and thanks to the rhel/README.RHEL file included in openvswitch I’ve integrated openvswitch in my CentOS network scripts. HP N40L offers a 10/100/1000 NIC which is detected as eth0, and I want to add it to a network bridge under ovswitch.

First I add a new network config script for the new bridge br0: /etc/sysconfig/network-scripts/ifcfg-br0

The most important part is at the bottom of the script, we have to tell CentOS that the type of bridge is OVSBridge and our device type is ovs, this way the openvswitch kernel module will be used.

DEVICE="br0"
BOOTPROTO="none"
BROADCAST="192.168.1.255"
DNS1="192.168.1.1"
GATEWAY="192.168.1.1"
IPADDR="192.168.1.20"
NETMASK="255.255.255.0"
NM_CONTROLLED="yes"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="yes"
IPV6INIT=no
ONBOOT="yes"
TYPE="OVSBridge"
DEVICETYPE="ovs"

Then we have to modify ifcfg-eth0 network script so no ip address is set and eth0 is added to the bridge! (OVS_BRIGE=br0, TYPE=OVSPort and DEVICETYPE=ovs).

DEVICE="eth0"
NM_CONTROLLED="yes"
ONBOOT="yes"
IPV6INIT=no
TYPE="OVSPort"
DEVICETYPE="ovs"
OVS_BRIDGE=br0

If openvswitch daemons are running we will have to restart the network service, create the bridge and add eth0 interface to the br0 bridge. Check that openvswitch service is running.

# service openvswitch status
ovsdb-server is running with pid 1011
ovs-vswitchd is running with pid 1021

Please be careful. If you’re executing these commands remotely you may lost connection, check what you’re doing!! I was connected via SSH with my N40 server and I had to concatenate the commands unless I wanted to connect a screen and a keyboard to my server 😀 so please proceed with caution.

service network restart;ovs-vsctl add-br br0;ovs-vsctl add-port br0 eth0

Ok, if everything’s fine we can check the openvswitch bridge configuration with this command

# ovs-vsctl show
f579b845-0b4c-43cb-a776-4e641ac07f92
Bridge "br0"
   Port "eth0"
      Interface "eth0"
   Port "br0"
      Interface "br0"
         type: internal
ovs_version: "1.10.90"

Brilliant! my server has a new openvswitch bridge. Thanks Openvswitch for this software and its documentation.

Snorby on CentOS 6.3

Update: 02/06/2013. I’ve created a new post for CentOS 6.4 ig you have problems with CentOS 6.3 try to check this post first.

If I want to have fun with Suricata IDS I think it will be useful to have a monitoring tool to track possible alerts. I’ve chosen Snorby as it seems to have a nice and intuitive GUI. Snorby uses ruby on rails and a mysql database. After many attempts I’ve finally got it running so I want to share with you the steps I’ve followed.

According to its web page, Snorby requires:

• Ruby > 0.9.2
• ImageMagick > 6.6.4
• Rails > 3.0.0
• Wkhtmltopdf

Unfortunately, packages in CentOS 6.3 repositories have older versions, maybe you can find newer versions in other repositories but time I’ll stick with the official repositories. Compilation fun! Warning: if you use the following commands check if newer versions of downloaded packages exist and change directories and names accordingly.

1. We’ll start installing some packages using yum 

   yum groupinstall "Development Tools"
   yum install openssl-devel readline-devel libxml2-devel libxslt-devel mysql mysql-devel mysql-libs mysql-server urw-fonts
   

2. Let’s compile ImageMagick.

   cd /opt
   wget ftp://ftp.sunet.se/pub/multimedia/graphics/ImageMagick/ImageMagick-6.8.3-7.tar.gz
   cd ImageMagick-6.8.3-7
   ./configure
   make
   make install
   ldconfig /usr/local/lib
   

3. Time for Wkhtmltopdf. I’ve downloaded the source files because I had problems with the static versions of Wkhtmltopdf. I’ve used the readme file (README_WKHTMLTOPDF) which comes with wkhtmltopdf as a guide, but notice that the gitorious repository is not found.Warning: this step is going to take a loooong time so if you don’t need pdf reporting skip it.

   Warning: if you see squares in your pdf report instead of text install with yum the urw-fonts package. This information is provided thanks to this stackoverflow question.

   cd /opt
   git clone git://github.com/jcsalterego/wkhtmltopdf-qt.git wkhtmltopdf-qt
   cd wkhtmltopdf-qt
   ./configure -nomake tools,examples,demos,docs,translations -opensource -prefix ../wkqt
   make -j3
   make install
   
   cd /opt
   wget http://wkhtmltopdf.googlecode.com/files/wkhtmltopdf-0.11.0_rc1.tar.bz2
   tar jxvf wkhtmltopdf-0.11.0_rc1.tar.bz2
   cd wkhtmltopdf-0.11.0_rc1
   ../wkqt/bin/qmake
   make
   ldconfig
   ln -s /opt/wkhtmltopdf-0.11.0_rc1/bin/wkhtmltopdf /usr/local/bin/wkhtmltopdf
   

4. MySQL!. Start the service and if it’s the first time you install it use the mysql_secure_installation to set root’s password and remove unnecessary tables.

   service mysqld start
   mysql_secure_installation
   chkconfig mysqld on
   

5. And now we need Ruby and RubyGems. I’m installing ruby 9.3 from ruby’s webpage.

   cd /opt
   wget http://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.3-p392.tar.gz
   tar xvfz ruby-1.9.3-p392.tar.gz
   cd ruby-1.9.3-p392
   ./configure
   make
   make install
   
   cd /opt
   wget http://production.cf.rubygems.org/rubygems/rubygems-2.0.2.tgz
   tar xvfz rubygems-2.0.2.tgz
   cd rubygems-2.0.2
   ruby setup.rb
   

6. We now have gem installed and we’re going to install bundler gem which is needed by Snorby setup.

   cd /opt
   gem install bundler
   

7. OK. I want to use Snorby so I need to download it!. I’ve had problems with the latest git version of snorby so I had to use the zip with the stable version (which is linked from Snorby’s webpage).

   wget -O snorby.zip https://github.com/Snorby/snorby/zipball/v2.5.6
   unzip snorby.zip
   cd Snorby-snorby-42dd6d5
   

8. Now, pay attention! I’ve found many problems trying to use bundle with ruby 9.3 and I spent several hours finding out what to do. This is what I’ve done, I can guarantee that it’ll work with a newer ruby or snorby version but at least if you find the same problem you won’t suffer. If you find any error please contact me maybe I can help you and update the post so it’s useful for other users.

   Edit the Gemfile file and change this line: gem 'rake', '0.9.2'   to:  gem 'rake', '> 0.9.2' unless you want this error to show when using bundler: "error: /usr/local/lib/ruby/gems/1.9.1/gems/bundler-1.3.1/lib/bundler/fetcher.rb:112:in `specs': undefined method `each' for nil:NilClass (NoMethodError)"
   
   Edit the Gemfile file and add this line: gem 'orm_adapter' after the line: gem netaddr , unless you want this error when using bundler: 'orm_adapter' file not found
   
   Edit Gemfile.lock and change rake (0.9.2) to rake(0.9.2.2) so rake setup does not complain about a different rake version.
   

   //Create a snorby_config.yml file. Edit the production section and set your domain
   cp config/snorby_config.yml.example config/snorby_config.yml
   
   // Create a database.yml config file. Edit the file and set the root password and MySQL server location
   cp config/database.yml.example config/database.yml
   

9. OK! Now let’s install Snorby. And don’t forget to read the README.md file provided by Snorby’s developers

   // We are in the snorby directory //
   bundle install
   rake snorby:setup
   
   // This is the command's output //
   [datamapper] Created database 'snorby'
   [datamapper] Finished auto_upgrade! for :default repository 'snorby'
   [~] Adding `index_timestamp_cid_sid` index to the event table
   [~] Adding `id` to the event table
   [~] Building `aggregated_events` database view
   [~] Building `events_with_join` database view
   * Removing old jobs
   * Starting the Snorby worker process.
   * Adding jobs to the queue
   

10. Snorby is installed woohoo! Before launching it let’s create an iptables rule (TCP 3000 is the default port)

    iptables -I INPUT -p tcp --dport 3000 -m state --state=NEW,ESTABLISHED,RELATED -j ACCEP
    

11. And now finally let’s start Snorby in my CentOS 6.3 server:

    rails server -e production
    
    Booting WEBrick
    => Rails 3.1.10 application starting in production on http://0.0.0.0:3000
    => Call with -d to detach
    => Ctrl-C to shutdown server
    [2013-03-08 19:01:18] INFO WEBrick 1.3.1
    [2013-03-08 19:01:18] INFO ruby 1.9.3 (2013-02-22) [x86_64-linux]
    [2013-03-08 19:01:18] INFO WEBrick::HTTPServer#start: pid=1347 port=3000
    

12. If all is fine, open a web browser http://x.x.x.x:3000 and use the default user/password: snorby@snorby.org / snorby. Here, two screenshots so you can check that I haven’t lied to you.

Ok. Soon I’ll update this post or create another one explaining how to configure other important things (mail, sensor…)

P.S: You should create a snorby user in your mysql server and change it in the database.yml config file so the root user is not used. e.g: grant all privileges on snorby.* to snorby@localhost identified by ‘password’;

P.S 2 (2013-03-10): PDF reporting problem with wkhtmltopdf has been solved after compiling wkhtmltopdf and QT (be patient you’ll need time). This is a Snorby Report sample.

Tcpdump fun! What kind of traffic is coming from Internet?

A short post. Just before using Suricata IDS and a honeypot in my virtual lab, I wanted to check that port mirroring was working fine. Also I was curious about what kind of traffic would I receive from Internet so I run tcpdump and this is the result (3 hours listening):

• 88% of the traffic was ssh login attempts from a China host: user root, oracle, nagios and postgres.
• 3% of the traffic was bittorrent (lost packages?).
• 3% of the traffic is against TCP 10021 and TCP 34900 ports.
• 3% of the traffic is SSDP protocol (trying to configure and detect wireless devices?)
• The rest of traffic is a mixture of mysql, telnet, ms-sql and http connection attempts.

What will I find when I start the honeypot? What will Suricata detect?