{{tag>[flowviewer centos 7]}}
=====FlowViewer on CentOS 7=====
This page describes the installation of [[http://sourceforge.net/p/flowviewer/wiki/Home/|FlowViewer]] on CentOS 7 for NetFlow reporting.
Quote FlowViewer wiki: //"FlowViewer has been developed for NASA’s Earth Sciences Data and Information System (ESDIS) networks, and credit goes to NASA for their usual outstanding support of innovation."//
=====Prerequisites=====
* Install development tools:yum groupinstall development tools
yum install glib2-devel
* Install libraries and source code:yum install zlib zlib-devel lzo lzo-devel libpcap libpcap-devel gnutls gnutls-devel python-devel c-ares c-ares-devel openssl-devel
* Install webserver and dependencies:yum install httpd gd perl-GD perl-GDGraph perl-GDTextUtil rrdtool
systemctl enable httpd
systemctl start httpd
* Download, compile and install libxbuf from [[http://tools.netsa.cert.org/fixbuf/]]:tar zxvf libfixbuf-1.6.2.tar.gz
./configure && make && make install
* Download, compile and install netsa from [[http://tools.netsa.cert.org/netsa-python/index.html]]:tar zxvf netsa-python-1.4.3.tar.gz
python setup.py build
python setup.py install
* Download, compile and install libipa from [[http://tools.netsa.cert.org/ipa/download.html]]:tar zxvf ipa-0.5.2.tar.gz
./configure && make && make install
* Add /usr/local/lib to library path. echo /usr/local/lib >>/etc/ld.so.conf.d/local.conf
ldconfig -v
=====Install SiLK=====
* Download SiLK from: [[http://tools.netsa.cert.org/]]
* Extract tar.gz file:tar zxvf silk-3.10.1.tar.gz
* Configure and compile:
mkdir -p /opt/silk/data
./configure \
--enable-data-rootdir=/opt/silk/data \
--prefix=/opt/silk \
--enable-output-compression \
--with-libipa=/usr/local/lib/pkgconfig \
--with-libfixbuf=/usr/local/lib/pkgconfig
make
make install
************************************************************
Example site configuration files have been installed in
/opt/silk/share/silk/*-silk.conf
Choose the file that matches your packing logic plug-in
and/or installation, rename it to silk.conf, customize it,
and copy it to the root of the data directory:
/opt/silk/data/silk.conf
************************************************************
=====Configure SiLK=====
* Create /opt/data/silk.conf:cp /opt/silk/share/silk/twoway-silk.conf /opt/silk/data/silk.conf
* Edit silk.conf for example:sensor 0 uplink "Uplink"
class all
sensors uplink
end class
* Specify local address space:cd /opt/silk/share/silk
cp addrtype-templ.txt addresses.txt
vi addresses.txt
# My IP space (CMU)
128.2.0.0/16 internal
/opt/silk/bin/rwpmapbuild --input addresses.txt --output address_types.pmap
* Install Country Code mapping (legacy format). Download CSV from [[http://dev.maxmind.com/geoip/legacy/geolite/]]:unzip -p GeoIPCountryCSV.zip | \
/opt/silk/bin/rwgeoip2ccmap --csv-input > country_codes.pmap
cp country_codes.pmap /opt/silk/share/silk/country_codes.pmap
* Create /opt/silk/data/sensor.conf:probe uplink netflow-v9
listen-on-port 9901
protocol udp
accept-from-host 1.2.3.1
end probe
sensor uplink
netflow-v9-probes uplink
internal-ipblock 1.2.3.0/24
external-ipblock remainder
end sensor
* Create /opt/silk/etc/rwflowpack.conf:ENABLED=yes
BIN_DIR=/opt/silk/sbin
DATA_ROOTDIR=/opt/silk/data
PID_DIR=/var/run
SENSOR_CONFIG=/opt/silk/data/sensor.conf
SITE_CONFIG=/opt/silk/data/silk.conf
INPUT_MODE=stream
OUTPUT_MODE=local-storage
LOG_TYPE=legacy
LOG_DIR=/opt/silk/log
LOG_LEVEL=info
CREATE_DIRECTORIES=yes
* Enable (legacy) service:cp /root/silk-3.10.1/src/rwflowpack/rwflowpack.init.d /etc/init.d/rwflowpack
chkconfig rwflowpack on
service rwflowpack start
=====Configure NetFlow v9 for RouterOS=====
* Put source in trusted zone, add udp port:firewall-cmd --permanent --zone=trusted --add-source=1.2.3.1
firewall-cmd --permanent --zone=trusted --add-port=9901/udp
firewall-cmd --reload
firewall-cmd --zone=trusted --list-all
* On RouterOS add flow config:/ip traffic-flow target add version=9 address=1.2.3.4:9901
/ip traffic-flow set enabled=yes interfaces=bridge1-uplink
/ip firewall filter chain=output action=accept protocol=udp dst-address=1.2.3.6 dst-port=9901
=====Test query=====
* Test SiLK with a query:/opt/silk/bin/rwfilter --sensor=uplink --proto=0-255 --pass=stdout --type=all | /opt/silk/bin/rwcut | tail
=====Install FlowViewer=====
* Download FlowViewer: [[http://sourceforge.net/projects/flowviewer/files]]
* Open port to webserver:firewall-cmd --permanent --zone=trusted --add-service=http
firewall-cmd --reload
firewall-cmd --zone=trusted --list-all
* Untar into /var/www/cgi-bin subdirectory:cd /var/www/cgi-bin
tar xvf /root/FlowViewer_4.6.tar
* Configure FlowViewer_Configuration.pm variables as necessary.
* Allow write access for FlowViewer:semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/FlowGrapher(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/FlowMonitor(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/FlowViewer(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/FlowViewer_Dashboard(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/FlowViewer_Saves(/.*)?"
restorecon -Rv /var/www/html
* Create all necessary directories with proper permissions.
* Copy FlowViewer.css, FlowViewer.png to $reports_directory.
* Start FlowMonitor_Collector, FlowMonitor_Grapher in background.
* Point browser to FV.cgi