.png){kind=link}
Welcome to (pfSense/OPNsense) + Elastic Stack
You can view installation guide guide on 3ilson.org YouTube Channel.
Prerequisites
- Ubuntu Server v18.04+
- pfSense v2.4.4+ or OPNsense 19.7.4+
- The following was tested with Java v12 and Elastic Stack v7.4
Preparation
1. Add Oracle Java Repository
sudo add-apt-repository ppa:linuxuprising/java2. Add Maxmind Repository
sudo add-apt-repository ppa:maxmind/ppa3. Download and install the public GPG signing key
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -4. Download and install apt-transport-https package
sudo apt-get install apt-transport-https5. Add Elasticsearch|Logstash|Kibana Repositories (version 7+)
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list6. Update
sudo apt-get update7. Install Java 12
sudo apt-get install oracle-java12-installer8. Install Maxmind
sudo apt install geoipupdate9. Configure Maxmind
sudo nano /etc/GeoIP.conf- Append line 25 as follows:
EditionIDs GeoLite2-City GeoLite2-Country GeoLite2-ASN8. Download Maxmind Databases
sudo geoipupdate9. Add cron (automatically updates Maxmind everyweek on Sunday at 1700hrs)
sudo nano /etc/cron.weekly/geoipupdate- Add the following and save/exit
00 17 * * 0 geoipupdateInstall
- Elasticsearch v7+ | Kibana v7+ | Logstash v7+
10. Install Elasticsearch|Kibana|Logstash
sudo apt-get install elasticsearch && sudo apt-get install kibana && sudo apt-get install logstashConfigure Kibana|v7+
11. Configure Kibana
sudo nano /etc/kibana/kibana.yml12. Amend host file (/etc/kibana/kibana.yml)
- server.port: 5601
- server.host: "0.0.0.0"
Configure Logstash|v7+
13. Change Directory
cd /etc/logstash/conf.d14. Download the following configuration files
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/01-inputs.confsudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/05-syslog.confsudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/10-pf.confsudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/11-firewall.confsudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/50-outputs.conf14a. (Optional) Download the following configuration files
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/12-suricata.confsudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/13-snort.confsudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/15-others.conf15. Make Patterns Folder
sudo mkdir /etc/logstash/conf.d/patterns16. Navigate to Patterns Folder
cd /etc/logstash/conf.d/patterns/17. Download the following configuration file
sudo wget https://raw.githubusercontent.com/a3ilson/pfelk/master/conf.d/patterns/pf-09.2019.grok18. Edit (05-syslog.conf)
sudo nano /etc/logstash/conf.d/05-syslog.conf19. Revise/Update w/pf IP address (05-syslog.conf)
Change line 3; the "if [host]..." should point to your pf IP address
Change line 9 to point to your second PF IP address or ignoreConfigure Services
Start Services on Boot as Services (you'll need to reboot or start manually to proceed)
sudo /bin/systemctl daemon-reload
sudo /bin/systemctl enable elasticsearch.service
sudo /bin/systemctl enable kibana.service
sudo /bin/systemctl enable logstash.serviceStart Services Manually
systemctl start elasticsearch
systemctl start kibana
systemctl start logstash Status
systemctl status elasticsearch.service
systemctl status kibana.service
systemctl status logstash.serviceTroubleshooting
cat/nano/vi the files within this location to view Logstash logsIf this helped, feel free to donate a drink:
