DOCSEARCHbyAlgolia
Submit Docs

Libellux Documentation

website·Indexed 31 days ago

https://www.libellux.com/

Installation and configuration guides for security and networking tools, including Snort 3, Greenbone Vulnerability Manager Rev 14, ClamAV Antivirus Server Rev 6, OSSEC Host Intrusion Detection System Rev 4, CrowdSec, and Traefik.

Tokens
13.6K
Snippets
71
Records
78
Agent score
62%

What's inside Libellux

  1. Overview of CrowdSec Security Engine

    CrowdSec Security Engine is an all-in-one solution providing Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Web Application Firewall (WAF) capabilities.

  2. Libellux: Up and Running OS Support and Frameworks

    Libellux: Up and Running has transitioned its documentation framework from VuePress to VitePress (as of version 3.0.0). The project provides documentation and support for various Linux distributions, including Rocky Linux 9 (Blue Onyx), Rocky Linux 8.4 (Green Obsidian), and Ubuntu 20.04 (Focal Fossa) and 22.04 (Jammy Jellyfish).

  3. Enable HTTPS for Greenbone Security Assistant (GSAD)

    To enable HTTPS for the GSA web interface, generate SSL certificates using the gvm-manage-certs tool and update the gsad.service configuration. Note that the User and Group lines in the service file must be commented out to allow the service to bind to privileged ports (like 443).
    # Generate SSL certificates
/usr/local/bin/gvm-manage-certs -a

# Update gsad.service
cat << EOF > /etc/systemd/system/gsad.service
[Unit]
Description=Greenbone Security Assistant daemon (gsad)
Documentation=man:gsad(8) https://www.greenbone.net
After=network.target gvmd.service
Wants=gvmd.service

[Service]
Type=exec
#User=gvm
#Group=gvm
RuntimeDirectory=gsad
RuntimeDirectoryMode=2775
PIDFile=/run/gsad/gsad.pid
ExecStart=/usr/local/sbin/gsad --foreground --listen=127.0.0.1 --port=443 --rport=80 --ssl-private-key=/var/lib/gvm/private/CA/clientkey.pem --ssl-certificate=/var/lib/gvm/CA/clientcert.pem
Restart=always
TimeoutStopSec=10

[Install]
WantedBy=multi-user.target
Alias=greenbone-security-assistant.service
EOF

# Apply changes
sudo systemctl daemon-reload
sudo systemctl restart gsad.service

  4. Install Snort 3 dependencies on Ubuntu

    Before building Snort 3 from source on Ubuntu (supported versions include 22.04 Jammy Jellyfish), install the required build tools and development libraries.
    sudo apt-get update --assume-yes
sudo apt-get install --assume-yes \
build-essential \
libpcap-dev \
libpcre3-dev \
libnet1-dev \
zlib1g-dev \
luajit \
hwloc \
libdnet-dev \
libdumbnet-dev \
bison \
flex \
liblzma-dev \
openssl \
libssl-dev \
pkg-config \
libhwloc-dev \
cmake \
cpputest \
libsqlite3-dev \
uuid-dev \
libcmocka-dev \
libnetfilter-queue-dev \
libmnl-dev \
autotools-dev \
libluajit-5.1-dev \
libunwind-dev \
libfl-dev

  5. Configure a Linux client to use a remote ClamAV server

    To use a centralized ClamAV server, install the client packages but disable the local daemon and updater. Configure clamd.conf to point to the server's IP address via TCP instead of using a local socket.
    # Install packages
sudo apt-get install clamav clamav-daemon

# Disable local services to use remote server
sudo systemctl stop clamav-daemon.service
sudo systemctl stop clamav-freshclam.service
sudo systemctl disable clamav-daemon.service
sudo systemctl disable clamav-freshclam.service

# Edit /etc/clamav/clamd.conf
# Comment out LocalSocket /var/run/clamav/clamd.ctl
# Add the following:
TCPSocket 3310
TCPAddr 192.168.0.1

  6. Install Traefik v3.6.5 on Ubuntu or Debian

    Install the Traefik binary from GitHub releases, move it to the local bin directory, and ensure it is executable. This guide supports Ubuntu 24.04.3 and Debian 13.2.0.
    curl -L -O https://github.com/traefik/traefik/releases/download/v3.6.5/traefik_v3.6.5_linux_amd64.tar.gz
tar xzf traefik_v3.6.5_linux_amd64.tar.gz
sudo mv traefik /usr/local/bin/
sudo chmod +x /usr/local/bin/traefik

  7. Install dependencies for GVMD

    Before building the Greenbone Vulnerability Manager Daemon (GVMD), install the necessary system dependencies including PostgreSQL and various development tools.
    # Ubuntu/Debian
sudo apt-get install --assume-yes libglib2.0-dev libgnutls28-dev libpq-dev postgresql postgresql-server-dev-14 libical-dev xsltproc rsync libbsd-dev libgpgme-dev texlive-latex-extra texlive-fonts-recommended xmlstarlet zip rpm fakeroot dpkg nsis gnupg gpgsm wget sshpass openssh-client socat snmp python3 smbclient python3-lxml gnutls-bin xml-twig-tools xltoman doxygen graphviz

  8. Build and install ospd-openvas from source

    Download, verify, and install the ospd-openvas package. The process involves verifying the GPG signature against the Greenbone Community Feed integrity key before installing via pip.
    export OSPD_OPENVAS_VERSION=22.6.2
curl -f -L https://github.com/greenbone/ospd-openvas/archive/refs/tags/v$OSPD_OPENVAS_VERSION.tar.gz -o $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz
curl -f -L https://github.com/greenbone/ospd-openvas/releases/download/v$OSPD_OPENVAS_VERSION/ospd-openvas-v$OSPD_OPENVAS_VERSION.tar.gz.asc -o $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz.asc $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz

# Extraction and Installation (Ubuntu/Debian)
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION.tar.gz
cd $SOURCE_DIR/ospd-openvas-$OSPD_OPENVAS_VERSION
mkdir -p $INSTALL_DIR/ospd-openvas
python3 -m pip install --root=$INSTALL_DIR/ospd-openvas --no-warn-script-location .
sudo cp -rv $INSTALL_DIR/ospd-openvas/* /

  9. Build and install OpenVAS Scanner from source

    Install the OpenVAS Scanner. This requires a set of development libraries including bison, libpcap, and nmap. The build process uses CMake to define the feed lock path and the OSPD run directory.
    # Dependencies for Ubuntu/Debian
sudo apt-get install --assume-yes bison libglib2.0-dev libgnutls28-dev libgcrypt20-dev libpcap-dev libgpgme-dev libksba-dev rsync nmap libjson-glib-dev libbsd-dev python3-impacket libsnmp-dev

# Dependencies for Rocky Linux
sudo dnf install --assumeyes bison glib2-devel gnutls-devel libgcrypt-devel libpcap-devel gpgme-devel libksba-devel rsync nmap json-glib-devel libbsd-devel

# Download and Verify
export OPENVAS_SCANNER_VERSION=22.7.9
curl -f -L https://github.com/greenbone/openvas-scanner/archive/refs/tags/v$OPENVAS_SCANNER_VERSION.tar.gz -o $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz
curl -f -L https://github.com/greenbone/openvas-scanner/releases/download/v$OPENVAS_SCANNER_VERSION/openvas-scanner-v$OPENVAS_SCANNER_VERSION.tar.gz.asc -o $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz.asc
gpg --verify $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz.asc $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz

# Build and Install
tar -C $SOURCE_DIR -xvzf $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION.tar.gz
mkdir -p $BUILD_DIR/openvas-scanner && cd $BUILD_DIR/openvas-scanner
cmake $SOURCE_DIR/openvas-scanner-$OPENVAS_SCANNER_VERSION \
  -DCMAKE_INSTALL_PREFIX=$INSTALL_PREFIX \
  -DCMAKE_BUILD_TYPE=Release \
  -DSYSCONFDIR=/etc \
  -DLOCALSTATEDIR=/var \
  -DOPENVAS_FEED_LOCK_PATH=/var/lib/openvas/feed-update.lock \
  -DOPENVAS_RUN_DIR=/run/ospd
make -j$(nproc)
make DESTDIR=$INSTALL_DIR install
sudo cp -rv $INSTALL_DIR/* /
rm -rf $INSTALL_DIR/*

  10. Handle libjson-c dependencies for ClamAV 0.104.1 on Debian 11

    When compiling ClamAV version 0.104.1 specifically on Debian 11, you must manually install libjson-c5 and libjson-c-dev via .deb packages.
    wget http://ftp.se.debian.org/debian/pool/main/j/json-c/libjson-c5_0.15-2_amd64.deb && \
wget http://ftp.se.debian.org/debian/pool/main/j/json-c/libjson-c-dev_0.15-2_amd64.deb && \
sudo dpkg -i libjson-c5_0.15-2_amd64.deb && sudo dpkg -i libjson-c-dev_0.15-2_amd64.deb

  11. Configure systemd services for Greenbone Vulnerability Manager (GVM)

    To run GVM components as background services on Ubuntu, Debian, or Rocky Linux, create systemd unit files for the Notus Scanner, GVMD, and GSAD. After creating the files in /etc/systemd/system/, reload the daemon and enable the services.
    # 1. Create Notus Scanner service
cat << EOF > /etc/systemd/system/notus-scanner.service
[Unit]
Description=Notus Scanner
Documentation=https://github.com/greenbone/notus-scanner
After=mosquitto.service
Wants=mosquitto.service
ConditionKernelCommandLine=!recovery

[Service]
Type=exec
User=gvm
RuntimeDirectory=notus-scanner
RuntimeDirectoryMode=2775
PIDFile=/run/notus-scanner/notus-scanner.pid
ExecStart=/usr/local/bin/notus-scanner --foreground --products-directory /var/lib/notus/products --log-file /var/log/gvm/notus-scanner.log
SuccessExitStatus=SIGKILL
Restart=always
RestartSec=60

[Install]
WantedBy=multi-user.target
EOF

# 2. Create GVMD service
cat << EOF > /etc/systemd/system/gvmd.service
[Unit]
Description=Greenbone Vulnerability Manager daemon (gvmd)
After=network.target networking.service postgresql.service ospd-openvas.service
Wants=postgresql.service ospd-openvas.service
Documentation=man:gvmd(8)
ConditionKernelCommandLine=!recovery

[Service]
Type=exec
User=gvm
Group=gvm
PIDFile=/run/gvmd/gvmd.pid
RuntimeDirectory=gvmd
RuntimeDirectoryMode=2775
ExecStart=/usr/local/sbin/gvmd --foreground --osp-vt-update=/run/ospd/ospd-openvas.sock --listen-group=gvm
Restart=always
TimeoutStopSec=10

[Install]
WantedBy=multi-user.target
EOF

# 3. Create GSAD service (HTTP only)
cat << EOF > /etc/systemd/system/gsad.service
[Unit]
Description=Greenbone Security Assistant daemon (gsad)
Documentation=man:gsad(8) https://www.greenbone.net
After=network.target gvmd.service
Wants=gvmd.service

[Service]
Type=exec
User=gvm
Group=gvm
RuntimeDirectory=gsad
RuntimeDirectoryMode=2775
PIDFile=/run/gsad/gsad.pid
ExecStart=/usr/local/sbin/gsad --foreground --listen=127.0.0.1 --port=9392 --http-only
Restart=always
TimeoutStopSec=10

[Install]
WantedBy=multi-user.target
Alias=greenbone-security-assistant.service
EOF

# 4. Reload and Enable
sudo systemctl daemon-reload
sudo systemctl enable notus-scanner ospd-openvas gvmd gsad
sudo systemctl start ospd-openvas notus-scanner gvmd gsad

  12. Enable and start Traefik service

    Grant the Traefik binary permission to bind to privileged ports using setcap, then reload the systemd daemon to enable and start the service.
    # Grant permission to bind to ports 80/443
sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/traefik

# Start the service
sudo systemctl daemon-reload
sudo systemctl enable --now traefik
sudo systemctl status traefik