mrcharles
7d4f2e54f3
ci / audit (push) Successful in 19s
VM created on pfv-tsys5 (stopped, onboot=0, 200G local-nonprod, sniffing NIC link-down); ISO GPG-verified on node against SO published fingerprint; human runs the SO installer per docs/runbook-install-51017.md. https://projects.knownelement.com/issues/772
42 lines
2.3 KiB
Markdown
42 lines
2.3 KiB
Markdown
# Security Onion install runbook — VM 51017 (sectestbed lane)
|
|
|
|
> Ticket [#772](https://projects.knownelement.com/issues/772) · Lane index
|
|
> https://community.turnsys.com/t/297 · Provenance: plan from the security-lane
|
|
> merge (2026-09-04); VM + ISO staged by the OAM agent 2026-09-05.
|
|
> Human (Charles) drives the actual SO install per plan.
|
|
|
|
## Prepped state (2026-09-05, all on pfv-tsys5)
|
|
|
|
| item | value |
|
|
|---|---|
|
|
| VMID / name | 51017 / `sectestbed-securityonion` |
|
|
| sizing | 4 cores (host), 16 GB RAM, 200 GB disk (`local-nonprod`, thin) |
|
|
| NICs | net0 mgmt on vmbr0 · net1 sniffing on vmbr0 (**link_down** — connect to the SPAN/mirror source before install) |
|
|
| boot | disk first, falls through to the attached ISO while the disk is empty |
|
|
| autostart | **off** (lane rule: non-prod stays down across host reboots) |
|
|
| ISO | `securityonion-3.2.0-20260729.iso` attached as ide2, GPG-verified on the node against SO's published key `C804 A93D 36BE 0C73 3EA1 9644 7C10 60B7 FE50 7013` (sig + KEYS also saved beside the ISO) |
|
|
| guest agent | SO ships qemu-guest-agent in the image; confirm `qm agent 51017 ping` after install, install `qemu-guest-agent` if absent |
|
|
|
|
## Install steps (human)
|
|
|
|
1. `qm start 51017` (console via PVE noVNC).
|
|
2. SO 3.2.0 installer → **Standalone** deployment.
|
|
3. Follow the SO installer prompts (management iface = the DHCP/eth0 NIC;
|
|
agree to the attack-surface reduction; set the SO admin account).
|
|
4. After first boot + setup completes: detach ide2 (`qm set 51017 --ide2 none,media=cdrom`)
|
|
and set `--boot order=scsi0`.
|
|
5. Connect the sniffing path: attach net1 to the bridge that carries the
|
|
mirrored traffic (OPNsense port mirror) — `qm set 51017 --net1 virtio,bridge=<span-bridge>`
|
|
then `qm set 51017 --link_down 0` semantics via editing, or just attach and `qm start`.
|
|
6. Register the VM in GLPI + Uptime Kuma (ping monitor), and add the host to
|
|
the KNELIAC inventory (`virtual_guests`).
|
|
7. Hook-ups owned by this lane (post-install): Wazuh/SO input matrix
|
|
(README coverage matrix), OPNsense netflow (nprobe/netflow target =
|
|
SO's Zeek/suricata + flow input), syslog routing decision (Wazuh vs SO
|
|
Elastic ingest) — tracked in the README matrix.
|
|
|
|
## Rollback
|
|
|
|
VM is unregistered-from-nothing and dataless before install: destroy with
|
|
`qm destroy 51017` if the plan changes (ISO + sig remain staged on the node).
|