voxpupuli/puppet-misp

Name: puppet-misp

Owner: Vox Pupuli

Description: This module installs and configures MISP (Malware Information Sharing Platform)

Created: 2017-03-30 09:38:02.0

Updated: 2018-05-23 05:57:16.0

Pushed: 2018-05-23 05:57:14.0

Homepage:

Size: 227

Language: HTML

GitHub Committers

UserMost Recent Commit# Commits

Other Committers

UserEmailMost Recent Commit# Commits

README

MISP MODULE

Build Status Code Coverage Puppet Forge Puppet Forge - downloads Puppet Forge - endorsement Puppet Forge - scores

Table of Contents
  1. Overview
  2. Module Description - What the module does and why it is useful
  3. Setup - Getting started with the misp module
  4. Usage - Configuration options and additional functionality
  5. Parameters of the MISP Class

This module installs and configures MISP (Malware Information Sharing Platform) on CentOS 7. It has been tested on Puppet 3.8.7 and with MISP versions 2.4.50 and 2.4.51.

Module Description

This module installs and configures MISP on CentOS 7. It installs all the needed dependencies, configures MISP and starts the services. However it does not set up the database nor the GPG key, that is up to the administrator to do. In addition it does not set up the web server on top of which MISP would run, meaning that Apache, Nginx or another web server of your choice would be needed (nevertheless the module need to know to know the name of the service of the web server (e.g. httpd)).

As mentioned before the database would need to be set up, the schema imported and then a user with rights to access the 'misp' database created. If GPG would be used, the GPG key would need to be created and placed in the configured directory (by default '/var/www/MISP/').

The module follows the installation instructions that can be found here. Also details about the database and GPG key creation and set up can be found there.

NOTE: the configuration and database files of MISP are used as templates on the module, therefore if the are major changes on the version of MISP the template might cause troubles and need to be updated.

Setup
What MISP affects

The MISP module will not alter any OS files, all the configuration will happen in '/config_dir/' (by default /install_dir/app/Config/') where the core.php, bootstrap.php, database.php and config.php files will be deployed with the established values.

This module needs the following packages:

* gcc: Needed for compiling Python modules
* git: Needed for pulling the MISP code and other git repositories which MISP depends on
* zip, redis, haveged and maria db
* python-devel, python2-pip, python-lxml, python-dateutil, python-six,: Python related packages
* rh-php56, rh-php56-php-fpm, rh-php56-php-devel, rh-php56-php-mysqlnd, rh-php56-php-mbstring, php-pecl-redis, php-pear: PHP 5.6 related packages
* php-mbstring, php-pear-crypt-gpg: Python package required by Crypt_GPG
* sclo-php56-php-pecl-redis: Redis related packages
* libxslt-devel', 'zlib-devel
* haveged

The services needed by MISP are:

* rh-php56-php-fpm
* haveged
* redis: This package installs the redis server, therefore it would only be installed if the 'redis' parameter is 
set to true. 
* The 4 workers and the scheduler [CakeResque]
Usage
Basic usage

In order to use the module it would be enough to include the module:

ude ::misp,

Or the class:

s{ ::misp:}

And the module will use all parameters with default values, these values are specified later on.

Another usage example
s {'::misp':
git_tag          => 'v2.4.67',
email            => 'someone.someother@somewhere.ch',
contact          => 'someone.someother@somewhere.ch',
salt             => 'Rooraenietu8Eeyo<Qu2eeNfterd-dd+',
cipherseed       => '9999999999999999999999999999999999999999999999999999999999999999',
Parameters of the MIPS Class

The MISP class can take many parameters to change the configuration of MISP. However, they all have the default value set to the recommended value so there is no need to change it. The parameters can be classified in the ones needed for the installation of MISP itself, for the database, for the configuration and for the services. The parameters are the following:

MISP installation
Database configuration

This module does not install the MariaDB server. However, if that was needed it could be done, in your manifest, in a similar manner as the following puppet fragment:

ysql_passwd = mysql_password('mispdb')

ass {'mariadb::server':
root_password => 'mispdb',
users                         => {
  'misp@localhost' => {
    ensure                   => 'present',
    max_connections_per_hour => '0',
    max_queries_per_hour     => '0',
    max_updates_per_hour     => '0',
    max_user_connections     => '0',
    password_hash            => $mysql_passwd,
    tls_options              => ['NONE'],
  },
},
grants => {
  'misp@localhost/misp.*' => {
    ensure     => 'present',
    options    => ['GRANT'],
    privileges => ['ALL'],
    table      => 'misp.*',
    user       => 'misp@localhost',
  },
  'misp@localhost/*.*' => {
    ensure     => 'present',
    options    => ['GRANT'],
    privileges => ['USAGE'],
    table      => '*.*',
    user       => 'misp@localhost',
    options    => "IDENTIFIED BY ${$mysql_passwd}",
  },
},
databases   => {
  'misp'  => {
    ensure  => 'present',
    charset => 'utf8',
  },
},

Note that it requires the edestecd-mariadb module.

Redis
MISP configuration
Site Configuration

This two parameters are recommended to be set to 0 and false respectively. However, if needed they can be set to tru to find errors with names/tables in the database. In this case it would be better to just set to true 'site_admin_debug' instead of the whole instance.

Security MISP GPG SMIME Proxy SecureAuth Session Plugin ApacheShibbAuth
Services
GnuPG

To set up GPG fist you need to generate a gpg key with:

--gen-key

Note that the email should be the email set up in the GnuPG part of the configuration (gpg_email parameter), and the same applies for the password (gpg_password parameter). There are known cases of errors when using it with a password (instead of passwordless as in the default configuration). If it gives an error run is as root.

Then move the key to the directory set up as home directory (gpg_homedir parameter), set apache as owner and group and the selinux context httpd_sys_rw_content_t.

/.gnupg /var/www/MISP/
n -R apache:apache /var/www/MISP/.gnupg
n -R -t httpd_sys_rw_content_t /var/www/MISP/.gnupg

Finally export the public key to the webroot

 -u apache gpg --homedir /var/www/MISP/.gnupg --export --armor YOUR-EMAIL > /var/www/MISP/app/webroot/gpg.asc
This work is supported by the National Institutes of Health's National Center for Advancing Translational Sciences, Grant Number U24TR002306. This work is solely the responsibility of the creators and does not necessarily represent the official views of the National Institutes of Health.