4.1 Server Configuration Demo Part 1

00:01

Hey, folks. Welcome to Lesson Four of intro to Security Onion. I'm your instructor, Carl, and in this lesson we will install a distributed security onion environment.

00:12

So for the agenda, first we'll discuss this to distributed environment architecture.

00:17

We will then review the typical process for installing and setting up the system,

00:22

and after that will touch briefly on the tools that I'll use in this demonstration.

00:26

And finally, we will have a demo of the configuration process on some already installed servers.

00:34

So there are three server types that we will be using in this demonstration. The first is the manager. This is the one that will be running our Web server and will be managing the rest of our environment.

00:45

It is not sniffing any traffic or storing much data, so the system does not need as many resource is as some of the servers in the environment.

00:55

Thus, we are okay to use a V M for the manager. In a typical environment,

01:00

the next two servers are the forward note and the storage node.

01:03

Now these servers will be processing and storing much more in data, so they should be on hardware that has been properly sized to the environment

01:11

that you're using.

01:14

Now it's out of the scope of this course to really dive into sizing servers for your environment, so I'd recommend you read through the security onion documentation.

01:23

I will say, though,

01:25

go for fast bus speed, a ton of storage and a raid array and as much memory and as many fast to CP use as you can afford,

01:34

then probably double it.

01:36

There will always be more traffic than you expect.

01:40

The typical procedure for installing a distributed environment starts how pretty similar to the stand alone server and that you download your eye so image than deployed on your servers or V EMS.

01:52

Now, for this demonstration, we will be deploying all of our servers in a virtual environment.

01:57

Now. This typically isn't recommended, as your forward and storage nodes need. Dedicated resource is.

02:02

But for this demo, which will be five

02:06

that once the ice so is deployed and we install the OS, we will typically update the system with soup

02:12

and, after the system is updated, will need to add some user accounts on the manager so it can manage the child nodes.

02:19

Then finally, we will run the configuration scripts for each of the servers

02:25

not to make it easier to follow along with what I'm doing. Well, talk briefly about the tools that I'm using. Now, all of the servers at Miss Demo are located on my virtual ization server and those air managed with virtual box. Now, the Web interface for my virtual box environment is through PHP virtual box.

02:44

And this allows me to manage everything remotely.

02:47

I will also be connecting to the servers a remotely over S S h using putty. And since we will still want to use the security Onion configuration script, which has a gooey we

03:00

we'll make use of ex Mingus server, which enables X 11 forwarding and putty