mrcharles
7d4f2e54f3
ci / audit (push) Successful in 19s
VM created on pfv-tsys5 (stopped, onboot=0, 200G local-nonprod, sniffing NIC link-down); ISO GPG-verified on node against SO published fingerprint; human runs the SO installer per docs/runbook-install-51017.md. https://projects.knownelement.com/issues/772
2.3 KiB
2.3 KiB
Security Onion install runbook — VM 51017 (sectestbed lane)
Ticket #772 · Lane index https://community.turnsys.com/t/297 · Provenance: plan from the security-lane merge (2026-09-04); VM + ISO staged by the OAM agent 2026-09-05. Human (Charles) drives the actual SO install per plan.
Prepped state (2026-09-05, all on pfv-tsys5)
| item | value |
|---|---|
| VMID / name | 51017 / sectestbed-securityonion |
| sizing | 4 cores (host), 16 GB RAM, 200 GB disk (local-nonprod, thin) |
| NICs | net0 mgmt on vmbr0 · net1 sniffing on vmbr0 (link_down — connect to the SPAN/mirror source before install) |
| boot | disk first, falls through to the attached ISO while the disk is empty |
| autostart | off (lane rule: non-prod stays down across host reboots) |
| ISO | securityonion-3.2.0-20260729.iso attached as ide2, GPG-verified on the node against SO's published key C804 A93D 36BE 0C73 3EA1 9644 7C10 60B7 FE50 7013 (sig + KEYS also saved beside the ISO) |
| guest agent | SO ships qemu-guest-agent in the image; confirm qm agent 51017 ping after install, install qemu-guest-agent if absent |
Install steps (human)
qm start 51017(console via PVE noVNC).- SO 3.2.0 installer → Standalone deployment.
- Follow the SO installer prompts (management iface = the DHCP/eth0 NIC; agree to the attack-surface reduction; set the SO admin account).
- After first boot + setup completes: detach ide2 (
qm set 51017 --ide2 none,media=cdrom) and set--boot order=scsi0. - Connect the sniffing path: attach net1 to the bridge that carries the
mirrored traffic (OPNsense port mirror) —
qm set 51017 --net1 virtio,bridge=<span-bridge>thenqm set 51017 --link_down 0semantics via editing, or just attach andqm start. - Register the VM in GLPI + Uptime Kuma (ping monitor), and add the host to
the KNELIAC inventory (
virtual_guests). - Hook-ups owned by this lane (post-install): Wazuh/SO input matrix (README coverage matrix), OPNsense netflow (nprobe/netflow target = SO's Zeek/suricata + flow input), syslog routing decision (Wazuh vs SO Elastic ingest) — tracked in the README matrix.
Rollback
VM is unregistered-from-nothing and dataless before install: destroy with
qm destroy 51017 if the plan changes (ISO + sig remain staged on the node).