Installation: OpenSSL Signed Installation Guide

This type of installation is for users with some experience with linux administration. It is ideal for those that are required to build upon a baseline (gold disk) image. It also works very well for cloud based instances as a build script. It ensures that the most recent versions of the software are used and that it is configured the same way every time. Also note that all ciphers and keys are generated at run time and therefore are as unique as any script can make them.

This is a script that installs and configures, including the creation of systemd services if not included otherwise, the following items onto a base image of Ubuntu/Debian (need apt to work).

• CDQR 4.1.3 (pulls most recent from Git repo)
• CyLR 1.4.0 (pulls most recent from Git repo)
• ElasticSearch 6.x
• Logstash 6.x
• Kibana 6.x
• TimeSketch 20170721
• Neo4j 3.3.3
• Celery 4.1.0
• Redis 4.0.8
• PostgreSQL 9.5.11

Installation instructions

• Start with Ubuntu 16.04 LTS or equivalent Debian based installation
• Log into system with an account that has sudo privledges (The name doesn't have be cdqr but it is nostalgic)
• The build.ccf.sh script downloads the signed buildccf.tgz file and verifies the signature using openssl. If anything interrupts the download or if the signature doesn't match then the installation exits with an error message.
• Start the script from a terminal using the commands below

wget -O /tmp/buildccf.sh https://raw.githubusercontent.com/orlikoski/skadi/master/scripts/buildskadi.sh
bash /tmp/buildskadi.sh

• This could take anywhere from 5 - 60+ minutes depending on the speed of the internet connection

The final completion will look something like this (version numbers may change over time):

System Health Checks
  Bringing up elasticsearch
  Bringing up postgresql
  Bringing up celery
  Bringing up neo4j
  Bringing up redis
  Bringing up logstash
  Bringing up kibana
  Bringing up timesketch

  elasticsearch service is: active
  postgresql service is: active
  celery service is: active
  neo4j service is: active
  redis service is: active
  logstash service is: active
  kibana service is: active
  timesketch service is: active

Verifying versions of Plaso and CDQR
plaso - log2timeline version 20180127
CDQR Version: 4.1.3

TimeSketch Initial User Information (reset with 'tsctl add_user -u skadi -p <password>')
Username: skadi
Password: <random 32 character string>

Not 100% complete, but very close. The reason this is for advanced users is that the remaining items require loading sample data into the ElasticSearch in order to create the default index in Kibana as well as load the pre-made Dashboards, Visualizations, and Searches into Kibana (requires the correct indexes to work).

Complete the remaining simple steps:

• Run sample data through CDQR into the ElasticSearch database (sample Virtual Machines can be found at the DFIR Training site or by using CyLR to collect from a sample host (much faster).
• Sample Command: ~/cdqr.py -p win <disk image or CyLR resulting .zip file> --es_kb testing
• The first time logged into Kibana it asks to create a default index. Use case_cdqr-* for the index and ensure that the data is fully loaded from previous step
• In Kibana click Management -> Saved Objects -> Import and use the file that has all of the CCF-VM specific Dashboards/Visualizations/Searches kibana_6.x.json

That's it. The setup is complete.