Friday, March 15, 2013

Installing CIF on a Ubuntu 12.04 VM on top of Security Onion (Part 2)

Lets review, so far we have;

  • Lived with Security Onion for awhile and couldnt fall asleep at night because you were thinking of ways to tweak snort (or is that just me)
  • Installed VirtualBox
  • Downloaded Ubuntu ISO
  • Created a VM from the command line

Now comes the sticky wicket, how do we view the console of the new CIF VM so we can install Ubuntu?
( I tried running "sudo vboxheadless -s "CIF" and playing with ufw rules, but couldnt get it to work, running in bridged mode might work, but I didnt want to mess with my Security Onion interfaces file)

  • If you are on the console of your Security Onion server (lucky you)
    • launch the VirtualBox GUI, start the VM and install Ubuntu
  • If you are using ssh to get to the Security Onion server you have a few things to configure
    • Install xming (http://sourceforge.net/projects/xming/)
    • Change your putty config to enable X11 forwarding, dont forget to save the session
    • ssh back to your Security Onion server with your saved session
    • set $DISPLAY localhost:10.0 ( this might be different for you)
    • test with "xterm &" - if that works
    • sudo VBoxManage startvm "CIF"
Run though the install, I assume you have installed Ubuntu before, since we are running on a Security Onion host...

If the "Loading Additional Components" step fails there is something wrong with the network setup
  • Shut down the VM, be rude, just kill it
  • load the VirtualBox Configuration GUI and check your settings, NAT should work
  • restart the install
hint: In the Ubuntu install at the "Software Selection" screen only choose OpenSSH Server

Ubuntu should finish its install and reboot, log in and find out what your IP is and write it down.
 sudo ifconfig eth0 | grep inet
Shut down the VM and might as well remove the DVD from the drive
sudo VBoxManage storageattach "CIF" --storagectl "IDE Controller" --port 0  --device 0 --type dvddrive --medium none
Configuring the VM Network and ufw to allow connections to the new CIF VM (Part 3)




No comments:

Post a Comment