Wazuh SIEM(SOC 1 of 3)

 Get Wazuh

• # project: https://github.com/wazuh/wazuh-docker
• git clone https://github.com/wazuh/wazuh-docker.git -b v4.12.0

Cert

• sudo docker-compose -f generate-indexer-certs.yml run --rm generator

Run

• Set ufw 9200/tcp,1514-1516/tcp/udp,443/tcp
• sudo docker-compose up -d
• open https://ip:your_port or space(443) check status
  use default account admin and password SecretPassword to login

Agent

• Windows:install Agent and modify ip point to wazuh ip before start service
• Linux: https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html
• sudo -s
• check curl be install
• GPG Key
  curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
• REPO
  echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
• sudo apt-get update
• CONFIG
  sudo apt-get install gnupg apt-transport-https
  curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
• WAZUH_MANAGER="<wazuh_ip>
• apt-get install wazuh-agent
• SERVICE
  sudo systemctl daemon-reload
  sudo systemctl enable wazuh-agent
  sudo systemctl start wazuh-agent
• STOP UPDATE: agent update use manager control panel
  sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list
  sudo apt-get update

SOC Home

 SOC Home

• Level 1
  High Risk to Level 2
• Wazuh 
• Graylog 
• Zeek 
• Level 2
  Create Joe to Level 3
• TheHive
• Cortex
• MISP
• CISA-KEV
• Level 3
  Create Auto playload
• SOAR
• n8n
• Level 4 Wait
  Event Reort
• Level 5 Wait
  Full Check

Wazuh SIEM (SOC Level 1 of 3) Update

Down

• cd $HOME/wazuh-docker/single-node
• sudo docker compose down

New Version # https://github.com/wazuh/wazuh-docker

• cd $HOME/wazuh-docker/
• git fetch --all --tags
• git reset --hard
• git checkout v4.14.5

Cert

• sudo docker-compose -f generate-indexer-certs.yml run --rm generator

Run

• sudo docker-compose up -d
• login and upgrade agent

Graylog SIEM (SOC Level 2 of 3)

Get Graylog

• git clone https://github.com/Graylog2/docker-compose.git

Config

• cd docker-compose/cluster
  #set your_new_password
  #get your_new_password_sha from : echo -n your_new_password | shasum -a 256
• sudo nano .env.example
  keyin your_new_password and your_new_password_sha
• sudo mv .env.example .env

Run

• sudo docker-compose up -d
• sudo ufw open ports 9000,1514~1516(tcp/udp),12201(tcp/udp)
• http://yourip:9000/welcome

OpenVAS : Vulnerability Scanning

See 

• https://greenbone.github.io > Greenbone Community Containers
• https://greenbone.github.io/docs/latest/22.4/container/index.html

Ubuntu

• Install Docker
• sudo usermod -aG docker $USER && su $USER
• export DOWNLOAD_DIR=$HOME/greenbone-community-container && mkdir -p $DOWNLOAD_DIR
• curl -f -O -L https://greenbone.github.io/docs/latest/_static/compose.yaml --output-dir "$DOWNLOAD_DIR"
• sudo nano $DOWNLOAD_DIR/compose.yaml
• find 127.0.0.1:443:443 change 127.0.0.1 to 0.0.0.0
• find 127.0.0.1:9392:9392 change 127.0.0.1 to 0.0.0.0
• docker compose -f $DOWNLOAD_DIR/compose.yaml pull
• docker compose -f $DOWNLOAD_DIR/compose.yaml up -d
• docker compose -f $DOWNLOAD_DIR/compose.yaml logs -f
• Ctrl+C
• docker compose -f $DOWNLOAD_DIR/compose.yaml \
  exec -u gvmd gvmd gvmd --user=admin --new-password='<password>'

Test

• xdg-open "https://127.0.0.1" 2>/dev/null >/dev/null &

Firewall

• sudo ufw allow 9393/tcp
• sudo ufw reload

Config

• open https://ip:9393/dashboards
• admin
• Setting
• change utc to your timezone
• administration > feed status , all of those is newest
  #see scan db https://www.ichiayi.com/tech/openvas
• Configuration > Scan Configs, refresh to download items before is null
  # https://greenbone.github.io/docs/latest/22.4/container/workflows.html
• docker compose -f $DOWNLOAD_DIR/compose.yaml pull notus-data vulnerability-tests scap-data dfn-cert-data cert-bund-data report-formats data-objects
• docker compose -f $DOWNLOAD_DIR/compose.yaml up -d notus-data vulnerability-tests scap-data dfn-cert-data cert-bund-data report-formats data-objects

Scan Work

• open https://ip:9393/dashboards
• type1:take a scan, Scans > Tasks, click:Task Wizard, keyin ip and click scan of button
• type2:Authenticated Scan,
• Configuration > Credentials
• menu Username + Password or Username + ssh key
• Configuration > Targets, keyin name/ip/Credentials
• Scans > Tasks and click New Task
• Scan Targets choose above info
• Scan Config choose full and fast
• start after save
• report:Scans > Reports, click date and time to watch or download

modify openwebui open file will happen error when user not admin

• backup files.py

sudo docker exec -it open-webui /bin/bash cd /app/backend/open_webui/routers/ cp files.py files1.py

• modify files.py

sudo docker cp open-webui:/app/backend/open_webui/routers/files.py files.py sudo nano files.py find all  if file and (file.user_id == user.id or user.role == "admin"): and add front remark like this #if file and (file.user_id == user.id or user.role == "admin"): and add code under this line if file:

• replace files.py

sudo docker cp files.py open-webui:/app/backend/open_webui/routers/files.py

docker clean

 #remove old container and images

• run all container
• remove old container and images,volume
• docker system prune
• docker volume prune
• docker builder prune
• stop all container{docker stop $(docker ps -q)}
• stop docker desktop{Stop-Process -Name "Docker Desktop"}
• wsl --shutdown
• Optimize-VHD -Path C:\Users\yourname\AppData\Local\Docker\wsl\data\ext4.vhdx -Mode Full
• Optimize-VHD -Path C:\Users\yourname\AppData\Local\Docker\wsl\main\ext4.vhdx -Mode Full
• wsl
• start docker desktop{Start-Process "Docker Desktop"}
• start all container{docker start $(docker ps -aq)}

searxng

• docker pull searxng/searxng
• docker run -d -p 4000:8080 -e "BASE_URL=http://localhost:4000/" -e "INSTANCE_NAME=searxng" searxng/searxng

Install docker on ubuntu

• sudo apt update
• sudo apt install apt-transport-https ca-certificates curl software-properties-common
• curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
• sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
• sudo apt update
• sudo apt install docker-ce
• sudo docker run hello-world
• sudo apt install docker-compose

Fail2ban for ubuntu

 

• sudo apt install fail2ban -y
• sudo systemctl enable fail2ban
• sudo systemctl start fail2ban
• sudo systemctl status fail2ban

• sudo -s
• cd /etc/fail2ban/
• sudo cp fail2ban.conf fail2ban.local
• sudo cp jail.conf jail.local

iRedMail Renew Cert

Connect MailServer 

• check certs
  sudo openssl x509 -enddate -noout -in /etc/letsencrypt/live/your_domain/fullchain.pem
• Stop service
  sudo systemctl stop nginx
  sudo systemctl stop postfix
  sudo systemctl stop dovecot
• check http port can connect
  firewall open http
  sudo ufw allow http
• Renew cert
  sudo certbot certonly --standalone -d your_domain --preferred-challenges http
• check cert
  sudo openssl x509 -enddate -noout -in /etc/letsencrypt/live/your_domain/fullchain.pem
• close http port
  sudo ufw delete allow http
  firewall close http
• cert permission
  sudo chown root:root /etc/letsencrypt/live/your_domain/privkey.pem
  sudo chmod 600 /etc/letsencrypt/live/your_domain/privkey.pem
• Start service
  sudo systemctl start nginx
  sudo systemctl start postfix
  sudo systemctl start dovecot

Auto Renew Config

• sudo crontab -e
• choose 1, and add below line in end
  0 3 * * * /usr/bin/certbot renew --quiet && systemctl reload nginx postfix dovecot
• save

postgresql

•  ubuntu 24.04 install postgresql

• sudo apt install postgresql postgresql-contrib > Y
• sudo systemctl enable postgresql.service
• sudo systemctl start postgresql.service

• test
• sudo -i -u postgres
• psql
• \q
• exit

• create user
• sudo -i -u postgres
• createuser --interactive
• >myuser
• >n,n,n
• createdb mydb
• psql
• sudo -u postgres psql
• ALTER USER myuser WITH PASSWORD 'pass';
• GRANT ALL PRIVILEGES ON DATABASE mydb TO myuser;
• \q

• connect config
• sudo nano /etc/postgresql/XX/main/postgresql.conf
• listen_addresses = '*'
• sudo nano /etc/postgresql/16/main/pg_hba.conf
• IPV4
• host    db       user       ip           mode:md5(trust)

• firewall config
• sudo ufw enable
• sudo ufw start
• sudo ufw allow ssh
• sudo ufw allow 5432/tcp
• sudo ufw status numbered
• sudo ufw logging on

• debug can not connect
• sudo lsof -i :5432
• test connect
• psql -h out_host -U user -d database  

• Note
• $ sudo -u postgres psql
• postgres=# CREATE DATABASE yourdbname;
• postgres=# CREATE USER youruser WITH ENCRYPTED PASSWORD 'yourpass';
• postgres=# GRANT ALL PRIVILEGES ON DATABASE yourdbname TO youruser;

iTOP

•  https://www.combodo.com/itop-193
• docker run -d -p 8080:80 --name=my-itop -v my-itop-conf-volume:/var/www/html/conf -v my-itop-db-volume:/var/lib/mysql vbkunin/itop

• docker exec my-itop chown www-data:www-data /var/www/html/conf
• get mysql pass to install:
• win>
• docker logs my-itop | Select-String -Pattern "Your MySQL user 'admin' has password:" -Context 1,7
• linux>
• docker logs my-itop | grep -A7 -B1 "Your MySQL user 'admin' has password:"
• http://localhost:8080/ install and use itil

Wazuh

•  git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.2

• cd wazuh-docker/single-node/
• modify docker-compose.yml
• #change 443 to your port
• #modify memory or  CPU limit
• docker-compose -f generate-indexer-certs.yml run --rm generator
• docker-compose up -d

• open https://ip:your_port or space(443) to check is running
• admin:SecretPassword
• modify default password

• Agent
• https://wazuh.com/install/
• docker ps
• docker exec -it single-node-wazuh.manager-1 or com-id /bin/bash
• bash-5.2# /var/ossec/bin/manage_agents
• ****************************************
• * Wazuh v4.9.2 Agent manager.          *
• * The following options are available: *
• ****************************************
•    (A)dd an agent (A).
•    (E)xtract key for an agent (E).
•    (L)ist already added agents (L).
•    (R)emove an agent (R).
•    (Q)uit.
• Choose your action: A,E,L,R or Q:
• 1.Press (A) to set a new agent with name (Computer's name), IP (any)
• 2.Press (L) to find ID 00x
• 3.Press (E) to create auth key
• get the auth key to keyin agent on win or linux
• check wazuh run on services.msc

install ubuntu

• install ubunto 24.04.1 

• sudo apt-get install openssh-server
• sudo systemctl start ssh
• sudo systemctl enable ssh

• sudo ufw enable
• sudo ufw allow ssh

• sudo reboot

• sudo apt upgrade -y && sudo apt update -y
• sudo apt upgrade -y && sudo apt update -y

clamav for linux

• sudo apt update && sudo apt upgrade
• sudo apt install clamav clamav-daemon -y 
• sudo systemctl stop clamav-freshclam.service
• sudo freshclam
• sudo systemctl start clamav-freshclam.service
• #sudo clamscan -r /path/to/folder
• sudo systemctl enable clamav-daemon
• sudo systemctl enable clamav-freshclam.service

create ocs on docker

•  git clone https://github.com/OCSInventory-NG/OCSInventory-Docker-Image
• cd OCSInventory-Docker-Image
• cd new_version
• modify docker-compose.yml config ports
• PS>docker-compose up -d

F5-TTS

Env

• conda create -n f5tts python=3.10
• conda activate f5tts

(apt install -y ffmpeg)

Python

• pip uninstall torch torchvision torchaudio transformers
• pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu118
• pip install transformers

Git

• git clone https://github.com/SWivid/F5-TTS.git

Run

• cd F5-TTS
• pip install -e .
• f5-tts_infer-gradio --port 7865 --host 0.0.0.0 --share

Kotaemon AI/RAG

Install on docker

• docker run -e GRADIO_SERVER_NAME=0.0.0.0 -e GRADIO_SERVER_PORT=7860 -p 7860:7860 --name kotaemon -d ghcr.io/cinnamon/kotaemon:main-full 
• no --it --rm

iRedMail Old to New

Ubuntu 24.04

Install iRedMail : https://docs.iredmail.org/install.iredmail.on.debian.ubuntu.html

Check : Important things you MUST know after installation

Conf : https://docs.iredmail.org/file.locations.html

Addtion: https://spiderd.io/ 

• Roundcube webmail: https://your_server/mail/
• SOGo Groupware: https://your_server/SOGo
• Web admin panel (iRedAdmin): https://your_server/iredadmin/

Ubuntu: 

• sudo systemctl enable ufw 
• sudo ufw allow smtps pop3s
• sudo reboot

Use old dkim : https://docs.iredmail.org/sign.dkim.signature.for.new.domain.html#use-existing-dkim-key-for-new-mail-domain

• copy pem from oldsvr, path /var/lib/dkim/domain.pem to newsvr(use:sudo su)
• modify newsvr /etc/amavis/conf.d/50-user before # Disclaimer settings(see oldsvr /etc/amavisd/amavisd.conf)
  dkim_key('domain.com', 'dkim', '/var/lib/dkim/domain.com.pem');
  @dkim_signature_options_bysender_maps = ({
      # 'd' defaults to a domain of an author/sender address,
      # 's' defaults to whatever selector is offered by a matching key
      # Per-domain dkim key
      #"domain.com"  => { d => "domain.com", a => 'rsa-sha256', ttl => 10*24*3600 },
      # catch-all (one dkim key for all domains)
      '.' => {d => 'domain.com',
                 a => 'rsa-sha256',
                 c => 'relaxed/simple',
                 ttl => 30*24*3600 },
      });
• sudo reboot
• sudo amavisd testkeys (=>pass)

Fail2Ban

• modify /etc/fail2ban/jail.local
• modify /etc/postfix/helo_access.pcre
• sudo su, cd /opt/iredapd/tools
  python wblist_admin.py --list --whitelist for oldsvr to list....
  sudo python3 wblist_admin.py --list --whitelist for newsvr ....
  >> sudo python3 wblist_admin.py --add --whitelist ip or domain from oldsvr

Create Cert

Let's Encrypt offers FREE SSL certificate.

https://docs.iredmail.org/letsencrypt.html

• sudo apt install -y certbot
• sudo certbot certonly --webroot --dry-run -w /var/www/html -d mail.domain.com
• sudo certbot certonly --webroot -w /var/www/html -d mail.domain.com

Backup Cert

• mv /etc/ssl/certs/iRedMail.crt /etc/ssl/certs/iRedMail.crt.bak
• mv /etc/ssl/private/iRedMail.key /etc/ssl/private/iRedMail.key.bak

Use New Cert

• ln -s /etc/letsencrypt/live/mail.domain.com/fullchain.pem /etc/ssl/certs/iRedMail.crt
• ln -s /etc/letsencrypt/live/mail.domain.com/privkey.pem /etc/ssl/private/iRedMail.key

Restart Service

• sudo systemctl restart postfix dovecot nginx