本文详细介绍了如何为 Arkime 配置 Elasticsearch 版本，并提供了 Docker 部署、RPM 包下载、安装步骤、配置文件详解和额外信息。从基本安装到 IP-Geo/ASN 功能设置，涵盖了 Moloch 的完整部署流程。
准备：
Elasticsearch
首先，Arkime对数据库Elasticsearch有版本要求，这可以使用现有的docker镜像来提供，这里就不多说了，附上docker-compose配置：
Arkime 2.7 requires ES 7.4+
version: '2.2'
services:
elasticsearch:
image: elasticsearch:7.8.1
container_name: elasticsearch_server
environment:
TAKE_FILE_OWNERSHIP: 'true'
TZ: Asia/Shanghai
bootstrap.memory_lock: 'true'
discovery.type: single-node
ulimits:
memlock:
hard: -1
soft: -1
nofile:
hard: 262144
soft: 262144
volumes:
- /etc/localtime:/etc/localtime:ro
RPM包下载位置
官网现下访问有点问题，这里另外找到了下载的链接位置：https://s3.amazonaws.com/files.molo.ch/builds/centos-7/moloch-2.7.1-1.x86_64.rpm
官方的安装步骤：
Instructions for using the prebuilt Arkime packages.
Please report any bugs or feature requests by opening an issue at https://github.com/arkime/arkime/issues
Basic Arkime Installation steps:
1) 下载对应的安装包（这里使CentOS7，所以下载的RPM包）
2) 安装包
3) 运行Configure脚本进行配置，只需运行一次
/data/moloch/bin/Configure
4) Configure脚本可以安装elasticsearch，也可以自行安装
systemctl start elasticsearch.service
5) 安装或升级ES的配置
a) 第一次安装或者想重置数据
/data/moloch/db/db.pl http://ESHOST:9200 init
b) 如果这是一次更新升级
/data/moloch/db/db.pl http://ESHOST:9200 upgrade
6) 如果是新安装的，或者重置数据库，则添加管理用户
/data/moloch/bin/moloch_add_user.sh admin "Admin User" THEPASSWORD --admin
7) 启动
systemctl start molochcapture.service
systemctl start molochviewer.service
8) 这里是两个日志文件
/data/moloch/logs/viewer.log
/data/moloch/logs/capture.log
9) 可以通过浏览器访问 http://MOLOCHHOST:8005
user: admin
password: THEPASSWORD from step #6
If you want IP -> Geo/ASN to work, you need to setup a maxmind account and the geoipupdate program.
See https://arkime.com/faq#maxmind
Any configuration changes can be made to /data/moloch/etc/config.ini
See https://arkime.com/faq#moloch-is-not-working for issues
Additional information can be found at:
* https://arkime.com/faq
* https://arkime.com/settings
相关命令
rpm的依赖包：
yum install -y net-tools perl-libwww-perl perl-JSON ethtool libyaml-devel perl-LWP-Protocol-https
直接启动容器环境命令：
docker run -it --name=test --network host centos:7
运行python自带的http服务命令，端口默认8000：
python3 -m http.server
构建镜像命令：
docker build -f DockerFile . --network host -t moloch:2.7.1
DockerFile
手动安装过程中，会执行Configure脚本，不过可以执行后把配置文件拿到即可不用该脚本。
FROM centos:7 as build
ENV DOWN_URL http://127.0.0.1:8000
ENV MOLOCH_RPM moloch-2.7.1-1.x86_64.rpm
RUN echo "[INFO] Setup Moloch"
RUN yum install -y net-tools perl-libwww-perl perl-JSON ethtool libyaml-devel perl-LWP-Protocol-https
RUN mkdir /tmp/download && \
curl -o /tmp/$MOLOCH_RPM $DOWN_URL/$MOLOCH_RPM && \
rpm -ivh /tmp/$MOLOCH_RPM
RUN mkdir /usr/share/GeoIP && \
curl -o /usr/share/GeoIP/GeoLite2-ASN.mmdb $DOWN_URL/GeoIP_20200526/GeoLite2-ASN.mmdb && \
curl -o /usr/share/GeoIP/GeoLite2-City.mmdb $DOWN_URL/GeoIP_20200526/GeoLite2-City.mmdb && \
curl -o /usr/share/GeoIP/GeoLite2-Country.mmdb $DOWN_URL/GeoIP_20200526/GeoLite2-Country.mmdb
RUN curl -o /data/moloch/etc/ipv4-address-space.csv $DOWN_URL/etc/ipv4-address-space.csv && \
curl -o /data/moloch/etc/oui.txt $DOWN_URL/etc/oui.txt && \
rm -f /data/moloch/etc/config.ini && \
curl -o /data/moloch/etc/config.ini $DOWN_URL/etc/config.ini
# 去掉一些解析模块
RUN mv /data/moloch/parsers /data/moloch/parsers.bk && mkdir /data/moloch/parsers && \
cp /data/moloch/parsers.bk/arp.so /data/moloch/parsers.bk/icmp.so /data/moloch/parsers.bk/tcp.so /data/moloch/parsers.bk/udp.so /data/moloch/parsers
RUN curl -o /home/start.sh $DOWN_URL/start.sh
RUN mkdir /data/moloch/logs
CMD ["/bin/bash", "/home/start.sh"]
附：config.ini配置文件
# Latest settings documentation: https://molo.ch/settings
#
# Moloch uses a tiered system for configuration variables. This allows Moloch
# to share one config file for many machines. The ordering of sections in this
# file doesn't matter.
#
# Order of config variables:
# 1st) [optional] The section titled with the node name is used first.
# 2nd) [optional] If a node has a nodeClass variable, the section titled with
# the nodeClass name is used next. Sessions will be tagged with
# class:<node class name> which may be useful if watching different networks.
# 3rd) The section titled "default" is used last.
[default]
# Comma seperated list of elasticsearch host:port combinations. If not using a
# Elasticsearch load balancer, a different elasticsearch node in the cluster can be specified
# for each Moloch node to help spread load on high volume clusters. For user/password
# use http://user:pass@host:port
elasticsearch=http://localhost:9200
# How often to create a new elasticsearch index. hourly,hourly6,daily,weekly,monthly
# Changing the value will cause previous sessions to be unreachable
rotateIndex=daily
# Cert file to use, comment out to use http instead
# certFile=/data/moloch/etc/moloch.cert
# File with trusted roots/certs. WARNING! this replaces default roots
# Useful with self signed certs and can be set per node.
# caTrustFile=/data/moloch/etc/roots.cert
# Private key file to use, comment out to use http instead
# keyFile=/data/moloch/etc/moloch.key
# Password Hash and S2S secret - Must be in default section. Since elasticsearch
# is wide open by default, we encrypt the stored password hashes with this
# so a malicous person can't insert a working new account. It is also used
# for secure S2S communication. Comment out for no user authentication.
# Changing the value will make all previously stored passwords no longer work.
# Make this RANDOM, you never need to type in
passwordSecret = password
# Use a different password for S2S communication then passwordSecret.
# Must be in default section. Make this RANDOM, you never need to type in
#serverSecret=
# HTTP Digest Realm - Must be in default section. Changing the value
# will make all previously stored passwords no longer work
httpRealm = Moloch
# The base path for Moloch web access. Must end with a / or bad things will happen
# Default: "/"
# webBasePath = /moloch/
# Semicolon ';' seperated list of interfaces to listen on for traffic
interface=em1
# The bpf filter of traffic to ignore
#bpf=not port 9200
# The yara file name
#yara=
# Host to connect to for wiseService
#wiseHost=127.0.0.1
# Log viewer access requests to a different log file
#accessLogFile = /data/moloch/logs/access.log
# Control the log format for access requests. This uses URI % encoding.
#accessLogFormat = :date :username %1b[1m:method%1b[0m %1b[33m:url%1b[0m :status :res[content-length] bytes :response-time ms
# The directory to save raw pcap files to
pcapDir = /data/moloch/raw
# The max raw pcap file size in gigabytes, with a max value of 36G.
# The disk should have room for at least 10*maxFileSizeG
maxFileSizeG = 12
# The max time in minutes between rotating pcap files. Default is 0, which means
# only rotate based on current file size and the maxFileSizeG variable
#maxFileTimeM = 60
# TCP timeout value. Moloch writes a session record after this many seconds
# of inactivity.
tcpTimeout = 600
# Moloch writes a session record after this many seconds, no matter if
# active or inactive
tcpSaveTimeout = 720
# UDP timeout value. Moloch assumes the UDP session is ended after this
# many seconds of inactivity.
udpTimeout = 30
# ICMP timeout value. Moloch assumes the ICMP session is ended after this
# many seconds of inactivity.
icmpTimeout = 10
# An aproximiate maximum number of active sessions Moloch/libnids will try
# and monitor
maxStreams = 1000000
# Moloch writes a session record after this many packets
maxPackets = 10000
# Delete pcap files when free space is lower then this in gigabytes OR it can be
# expressed as a percentage (ex: 5%). This does NOT delete the session records in
# the database. It is recommended this value is between 5% and 10% of the disk.
# Database deletes are done by the db.pl expire script
freeSpaceG = 5%
# The port to listen on, by default 8005
viewPort = 8005
# The host/ip to listen on, by default 0.0.0.0 which is ALL
#viewHost = localhost
# By default the viewer process is https://hostname:<viewPort> for each node.
#viewUrl = https://HOSTNAME:8005
# NOTE: A MaxMind account is now required, we will try and use the old files or new files on the system. See
# https://molo.ch/faq#maxmind
geoLite2Country = /usr/share/GeoIP/GeoLite2-Country.mmdb
最低0.47元/天 解锁文章
扫一扫
2308
到【灌水乐园】发言
