Elasticsearch/kibana - Versionsgeschichte

Thomas.will: /* Installion */

2024-04-14T06:09:47Z

Installion

Thomas.will am 9. April 2024 um 17:33 Uhr

2024-04-09T17:33:24Z

Thomas.will am 9. April 2024 um 17:27 Uhr

2024-04-09T17:27:05Z

Thomas.will: Der Seiteninhalt wurde durch einen anderen Text ersetzt: „*ELK Kali Purple“

2024-04-09T17:26:21Z

Der Seiteninhalt wurde durch einen anderen Text ersetzt: „*ELK Kali Purple“

Thomas.will: /* Install elasticsearch */

2024-04-09T17:16:26Z

Install elasticsearch

Thomas.will: /* Enroll Kibana */

2023-12-19T14:57:37Z

Enroll Kibana

Thomas.will: /* Enable HTTPS for Kibana */

2023-12-19T14:57:21Z

Enable HTTPS for Kibana

Thomas.will am 19. Dezember 2023 um 14:57 Uhr

2023-12-19T14:57:10Z

Thomas.will am 19. Dezember 2023 um 14:53 Uhr

2023-12-19T14:53:15Z

Thomas.will: /* Install elasticsearch */

2023-12-19T14:52:30Z

Install elasticsearch

@@ Zeile 1: / Zeile 1: @@
 =Schaubild=
 {{#drawio:ELK Kali Purple-1}}
-=Installion=
+=Installation=
 *[[ELK Kali Purple]]

← Nächstältere Version		Version vom 9. April 2024, 17:33 Uhr
Zeile 1:		Zeile 1:
		+	=Schaubild=
	{{#drawio:ELK Kali Purple-1}}		{{#drawio:ELK Kali Purple-1}}
		+	=Installion=
	*[[ELK Kali Purple]]		*[[ELK Kali Purple]]

← Nächstältere Version		Version vom 9. April 2024, 17:27 Uhr
Zeile 1:		Zeile 1:
		+	{{#drawio:ELK Kali Purple-1}}
	*[[ELK Kali Purple]]		*[[ELK Kali Purple]]

← Nächstältere Version		Version vom 9. April 2024, 17:26 Uhr
Zeile 1:		Zeile 1:
−	~~=Install elasticsearch=~~	+	*[[ELK Kali Purple]]
−	*~~sudo apt update && sudo apt upgrade~~
−	*sudo bash -c "export HOSTNAME=purple.cyber.local; apt-get install elasticsearch -y"
−	~~'''take note of "elastic" user password'''~~
−
−	~~=Convert to single-node setup (or replace fqdn name in initial_master_nodes list with IP address)=~~
−	sudo sed -e '/cluster.initial_master_nodes/ s/^#/#/' -i /etc/elasticsearch/elasticsearch.yml
−	*echo "discovery.type: single-node" \| sudo tee -a /etc/elasticsearch/elasticsearch.yml
−	~~=Install Kibana=~~
−	*sudo apt install kibana
−	*sudo apt install kibana
−	*sudo /usr/share/kibana/bin/kibana-encryption-keys generate -q
−	~~==Add keys to /etc/kibana/kibana.yml==~~
−	*echo "server.host: \"kali-purple.kali.purple\"" \| sudo tee -a /etc/kibana/kibana.yml
−	~~==Ensure kali-purple.kali.purple is only mapped to 192.168.253.5 in /etc/hosts in order to bind Kibana to that interface==~~
−	*sudo systemctl enable elasticsearch kibana --now
−	~~=Enroll Kibana=~~
−	*sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
−	~~#open browser and navigate to http://192.168.253.5:5601 enter username=elastic and password as displayed after installation paste token from above~~
−	*sudo /usr/share/kibana/bin/kibana-verification-code
−	~~#enter verification code into Kibana when prompted~~
−
−	~~=Enable HTTPS for Kibana=~~
−	*sudo /usr/share/elasticsearch/bin/elasticsearch-certutil ca
−	*sudo /usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --dns kali-purple.kali.purple,elastic.kali.purple,kali-purple --out kibana-server.p12
−	*sudo openssl pkcs12 -in /usr/share/elasticsearch/elastic-stack-ca.p12 -clcerts -nokeys -out /etc/kibana/kibana-server_ca.crt
−	*sudo openssl pkcs12 -in /usr/share/elasticsearch/kibana-server.p12 -out /etc/kibana/kibana-server.crt -clcerts -nokeys
−	*sudo openssl pkcs12 -in /usr/share/elasticsearch/kibana-server.p12 -out /etc/kibana/kibana-server.key -nocerts -nodes
−	*sudo chown root:kibana /etc/kibana/kibana-server_ca.crt
−	*sudo chown root:kibana /etc/kibana/kibana-server.key
−	*sudo chown root:kibana /etc/kibana/kibana-server.crt
−	*sudo chmod 660 /etc/kibana/kibana-server_ca.crt
−	*sudo chmod 660 /etc/kibana/kibana-server.key
−	*sudo chmod 660 /etc/kibana/kibana-server.crt
−
−	*echo "server.ssl.enabled: true" \| sudo tee -a /etc/kibana/kibana.yml
−	*echo "server.ssl.certificate: /etc/kibana/kibana-server.crt" \| sudo tee -a /etc/kibana/kibana.yml
−	*echo "server.ssl.key: /etc/kibana/kibana-server.key" \| sudo tee -a /etc/kibana/kibana.yml
−	*echo "server.publicBaseUrl: \"https://kali-purple.kali.purple:5601\"" \| sudo tee -a /etc/kibana/kibana.yml
−
−	*sudo /usr/share/kibana/bin/kibana-encryption-keys generate
−	~~#Copy the generated keys into /etc/kibana/kibana.yml~~
−
−	*sudo systemctl restart kibana
−
−	~~=Links=~~
−	*https://gitlab.com/kalilinux/kali-purple/documentation/-/wikis/301_31:-Elastic-Stack-Installation

@@ Zeile 1: / Zeile 1: @@
 =Install elasticsearch=
 *sudo apt update && sudo apt upgrade
-*sudo bash -c "export HOSTNAME=kali-purple.kali.purple; apt-get install elasticsearch -y"
+*sudo bash -c "export HOSTNAME=purple.cyber.local; apt-get install elasticsearch -y"
 '''take note of "elastic" user password'''
 =Convert to single-node setup (or replace fqdn name in initial_master_nodes list with IP address)=
 *sudo sed -e '/cluster.initial_master_nodes/ s/^#*/#/' -i /etc/elasticsearch/elasticsearch.yml

@@ Zeile 16: / Zeile 16: @@
 =Enroll Kibana=
 *sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
-open browser and navigate to http://192.168.253.5:5601 enter username=elastic and password as displayed after installation paste token from above
+ #open browser and navigate to http://192.168.253.5:5601 enter username=elastic and password as displayed after installation paste token from above
 *sudo /usr/share/kibana/bin/kibana-verification-code
-enter verification code into Kibana when prompted
+ #enter verification code into Kibana when prompted
 =Enable HTTPS for Kibana=
 *sudo /usr/share/elasticsearch/bin/elasticsearch-certutil ca

@@ Zeile 38: / Zeile 38: @@
 *sudo /usr/share/kibana/bin/kibana-encryption-keys generate
-Copy the generated keys into /etc/kibana/kibana.yml
+ #Copy the generated keys into /etc/kibana/kibana.yml
 *sudo systemctl restart kibana
 =Links=
 *https://gitlab.com/kalilinux/kali-purple/documentation/-/wikis/301_31:-Elastic-Stack-Installation