如何在 Ubuntu 22.04 上安装 Malcolm 网络流量分析工具？

Malcolm 是一个简单易用且功能强大的网络流量分析工具，它能够捕获工件（PCAP 文件）和 Zeek 日志，Malcolm 提供了一个相互关联的框架，使其大于各个部分的总和，Malcolm 简单、灵活的部署和强大的工具组合填补了网络安全领域的空白，并使公共和私营部门的许多人都可以访问高级网络流量分析。

在这篇文章中，我们将向您展示如何在 Ubuntu 22.04 上安装 Malcolm 网络流量分析工具。

先决条件

• 运行 Ubuntu 22.04 的服务器。
• 至少 16 GB RAM 和 4 个 CPU 内核。
• 在服务器上配置了 root 密码。

创建 Malcolm 系统用户

首先，您需要创建一个专用用户帐户来运行 Malcolm，您可以使用以下命令创建它：

useradd -m -d /opt/malcolm -s /bin/bash -G sudo malcolm

接下来，使用以下命令设置用户密码：

passwd malcolm

接下来，使用以下命令检查 Malcolm 用户的 UID：

id malcolm

您应该看到以下输出：

uid=1000(malcolm) gid=1000(malcolm) groups=1000(malcolm),27(sudo)

安装 Malcolm Ubuntu 22.04

首先，将用户切换到 Malcolm 并使用以下命令下载最新版本的 Malcolm：

u - malcolm
git clone https://github.com/idaholab/Malcolm

下载完成后，将目录更改为下载的目录并使用以下命令开始安装 Malcolm：

cd Malcolm 
sudo ./scripts/install.py

在安装过程中，你会被问到几个问题，如下：

Installing required packages: ['apache2-utils', 'make', 'openssl', 'python3-dialog']

"docker info" failed, attempt to install Docker? (Y/n): Y

Attempt to install Docker using official repositories? (Y/n): Y
Installing required packages: ['apt-transport-https', 'ca-certificates', 'curl', 'gnupg-agent', 'software-properties-common']


Installing docker packages: ['docker-ce', 'docker-ce-cli', 'containerd.io']
Installation of docker packages apparently succeeded

Add a non-root user to the "docker" group?: Y

Enter user account: malcolm

Add another non-root user to the "docker" group?: n

"docker-compose version" failed, attempt to install docker-compose? (Y/n): Y

Install docker-compose directly from docker github? (Y/n): Y
Download and installation of docker-compose apparently succeeded


fs.file-max increases allowed maximum for file handles
fs.file-max= appears to be missing from /etc/sysctl.conf, append it? (Y/n): Y


fs.inotify.max_user_watches increases allowed maximum for monitored files
fs.inotify.max_user_watches= appears to be missing from /etc/sysctl.conf, append it? (Y/n): Y


fs.inotify.max_queued_events increases queue size for monitored files
fs.inotify.max_queued_events= appears to be missing from /etc/sysctl.conf, append it? (Y/n): Y


fs.inotify.max_user_instances increases allowed maximum monitor file watchers
fs.inotify.max_user_instances= appears to be missing from /etc/sysctl.conf, append it? (Y/n): Y

vm.max_map_count increases allowed maximum for memory segments
vm.max_map_count= appears to be missing from /etc/sysctl.conf, append it? (Y/n): Y


net.core.somaxconn increases allowed maximum for socket connections
net.core.somaxconn= appears to be missing from /etc/sysctl.conf, append it? (Y/n): Y

vm.dirty_background_ratio defines the percentage of system memory fillable with "dirty" pages before flushing
vm.dirty_background_ratio= appears to be missing from /etc/sysctl.conf, append it? (Y/n): Y

vm.dirty_ratio defines the maximum percentage of dirty system memory before committing everything
vm.dirty_ratio= appears to be missing from /etc/sysctl.conf, append it? (Y/n): Y

/etc/security/limits.d/limits.conf increases the allowed maximums for file handles and memlocked segments
/etc/security/limits.d/limits.conf does not exist, create it? (Y/n): Y

安装 Malcolm 后，您可以继续下一步。

创建 Malcolm 管理员帐户

接下来，您需要创建一个管理帐户来访问 Malcolm Web 界面。

首先，将用户切换到 Malcolm 并使用以下命令导航到 Malcolm 目录：

su - malcolm
cd ~/Malcolm

接下来，运行以下命令来创建一个管理员帐户：

./scripts/auth_setup

拉取 Malcolm Docker 镜像

接下来，您需要从 Docker Hub 注册表下载所有必需的 Docker 映像，您可以使用以下命令下载所有内容：

docker-compose pull

下载所有图像后，使用以下命令验证所有图像：

docker images

您应该得到以下输出：

REPOSITORY                        TAG       IMAGE ID       CREATED       SIZE
malcolmnetsec/filebeat-oss        6.2.0     5e9fa4c8ea2d   11 days ago   648MB
malcolmnetsec/arkime              6.2.0     4f4e6025c82d   11 days ago   793MB
malcolmnetsec/zeek                6.2.0     5b117ad2b4bb   11 days ago   1.4GB
malcolmnetsec/dashboards          6.2.0     9dcaff859eec   11 days ago   1.13GB
malcolmnetsec/logstash-oss        6.2.0     cf4d75dcf4af   11 days ago   1.64GB
malcolmnetsec/file-monitor        6.2.0     26227c3c7dc9   11 days ago   589MB
malcolmnetsec/nginx-proxy         6.2.0     3b8b5413b52e   11 days ago   121MB
malcolmnetsec/file-upload         6.2.0     2c704be24433   11 days ago   263MB
malcolmnetsec/api                 6.2.0     90f964b5d728   11 days ago   148MB
malcolmnetsec/suricata            6.2.0     cbdb091d2df4   11 days ago   274MB
malcolmnetsec/htadmin             6.2.0     2b55630700d1   11 days ago   242MB
malcolmnetsec/opensearch          6.2.0     9ccb4665bd6c   11 days ago   1.25GB
malcolmnetsec/pcap-monitor        6.2.0     d957d803bdbb   11 days ago   214MB
malcolmnetsec/freq                6.2.0     3959a9daa952   11 days ago   131MB
malcolmnetsec/dashboards-helper   6.2.0     7da9699a72b3   11 days ago   168MB
malcolmnetsec/pcap-capture        6.2.0     df63e8daa369   11 days ago   121MB
malcolmnetsec/name-map-ui         6.2.0     6bd6c7c58d36   11 days ago   120MB

启动 Malcolm 服务

至此，Malcolm 所需的所有组件都已准备就绪，您现在可以使用以下命令启动 Malcolm 服务：

./scripts/start

等待一段时间以启动所有服务，启动所有服务后，使用以下命令验证所有正在运行的服务：

docker ps -a

您应该在以下输出中看到所有正在运行的容器：

CONTAINER ID   IMAGE                                   COMMAND                  CREATED          STATUS                             PORTS                                                                                            NAMES
840ea2b0e9ad   malcolmnetsec/nginx-proxy:6.2.0         "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          0.0.0.0:443->443/tcp, 127.0.0.1:5601->5601/tcp, 0.0.0.0:488->488/tcp, 127.0.0.1:9200->9200/tcp   malcolm-nginx-proxy-1
dd5c8c63816c   malcolmnetsec/suricata:6.2.0            "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)                                                                                                           malcolm-suricata-1
3112e1bd8f73   malcolmnetsec/filebeat-oss:6.2.0        "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          127.0.0.1:5045->5045/tcp                                                                         malcolm-filebeat-1
c93cfe93ad7e   malcolmnetsec/file-upload:6.2.0         "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          80/tcp, 127.0.0.1:8022->22/tcp                                                                   malcolm-upload-1
18ee20b46f3c   malcolmnetsec/dashboards:6.2.0          "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          5601/tcp                                                                                         malcolm-dashboards-1
2c34206c06e4   malcolmnetsec/zeek:6.2.0                "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)                                                                                                           malcolm-zeek-1
41103ef99ce1   malcolmnetsec/logstash-oss:6.2.0        "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          9001/tcp, 127.0.0.1:5044->5044/tcp, 9600/tcp                                                     malcolm-logstash-1
0408f42a76c3   malcolmnetsec/dashboards-helper:6.2.0   "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          28991/tcp                                                                                        malcolm-dashboards-helper-1
3e78024620de   malcolmnetsec/arkime:6.2.0              "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          8000/tcp, 8005/tcp, 8081/tcp                                                                     malcolm-arkime-1
58cd869beced   malcolmnetsec/pcap-monitor:6.2.0        "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          30441/tcp                                                                                        malcolm-pcap-monitor-1
1040fa8bd6df   malcolmnetsec/file-monitor:6.2.0        "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          3310/tcp, 8440/tcp                                                                               malcolm-file-monitor-1
25c83f14413d   malcolmnetsec/zeek:6.2.0                "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes                                                                                                                       malcolm-zeek-live-1
b321a96c0362   malcolmnetsec/api:6.2.0                 "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          5000/tcp                                                                                         malcolm-api-1
0f1f4ac023f9   malcolmnetsec/name-map-ui:6.2.0         "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          8080/tcp                                                                                         malcolm-name-map-ui-1
ba4d553cf6b5   malcolmnetsec/suricata:6.2.0            "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes                                                                                                                       malcolm-suricata-live-1
e4637d0ec04d   malcolmnetsec/opensearch:6.2.0          "/usr/local/bin/dock…"   17 minutes ago   Up 13 minutes (health: starting)   9200/tcp, 9300/tcp, 9600/tcp, 9650/tcp                                                           malcolm-opensearch-1
ac002e31d9be   malcolmnetsec/htadmin:6.2.0             "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          80/tcp                                                                                           malcolm-htadmin-1
7223d5244a7b   malcolmnetsec/pcap-capture:6.2.0        "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes                                                                                                                       malcolm-pcap-capture-1
971931b21788   malcolmnetsec/freq:6.2.0                "/usr/local/bin/dock…"   17 minutes ago   Up 17 minutes (unhealthy)          10004/tcp                                                                                        malcolm-freq-1

您还可以使用以下命令验证所有侦听端口：

ss -atlnp | grep -i docker

您应该看到以下输出：

LISTEN 0      65535      127.0.0.1:5601       0.0.0.0:*    users:(("docker-proxy",pid=7480,fd=4))   
LISTEN 0      65535        0.0.0.0:488        0.0.0.0:*    users:(("docker-proxy",pid=7519,fd=4))   
LISTEN 0      65535      127.0.0.1:9200       0.0.0.0:*    users:(("docker-proxy",pid=7443,fd=4))   
LISTEN 0      65535      127.0.0.1:5044       0.0.0.0:*    users:(("docker-proxy",pid=6247,fd=4))   
LISTEN 0      65535      127.0.0.1:5045       0.0.0.0:*    users:(("docker-proxy",pid=7063,fd=4))   
LISTEN 0      65535      127.0.0.1:8022       0.0.0.0:*    users:(("docker-proxy",pid=6826,fd=4))   
LISTEN 0      65535        0.0.0.0:443        0.0.0.0:*    users:(("docker-proxy",pid=7567,fd=4))

访问 Malcolm

您现在可以使用 URL https://your-server-ip/dashboards/ 访问 Malcolm OpenSearch 仪表板，您将被要求提供您的管理员用户名和密码：

提供您的管理员用户名、密码，然后单击登录按钮，您应该在以下屏幕上看到 OpenSearch 仪表板：

要访问 Malcolm 捕获文件和日志存档上传屏幕，请键入 URL https://your-server-ip/upload/。

要访问主机和子网名称映射编辑器，请键入 URL https://your-server-ip/name-map-ui/。

要访问帐户管理屏幕，请使用 URL https://your-server-ip:488/

恭喜！您已经在 Ubuntu 22.04 上成功安装并配置了 Malcolm 网络流量分析工具。