Body
This machine is a work in progress.
Opening the Virtual Machines
The NDR has been built with MINIForumns MS01 running proxmox.
To access the device, plug the left ethernet cable into the back of the MS01:
once it has an IP open your computer and do
nslookup snoc1.sysadmin.suny.edu
example:
Navigate to the IP:8006. In this example it would be https://10.141.70.23:8006/
You will be prompted with the following login page. The password can be found in 1password called "SNOC1 Root Password"
About Virtual Machines
If you look on the left side of the screen you will see 3 Virtual Machines
100 (VM 100) - Security Onion
101 (OPNSense) - Firewall/Router Running OPNSense
102 (VM 102) - Jumpbox that connects to AWS
Below you can find a network diagram of each VM and how they communicate:
Navigating Security Onion Remotely
Similar to how the mini PC's are setup, we use ssh callback scripts to allow you to ssh into the machines remotely. In order to be able to properly manage the machine (both the PROXMOX host itself and the VMS in the proxmox host) 2 callbacks are needed and can be see below:
(both password can be found under "SNOC1 Root Password")
ssh root@localhost -p 56002: This will allow you to ssh into the proxmox host
ssh root@localhost -p 56001: This will allow you to ssh into the proxmox jump host which puts you into the security onion network.
Storage
PCAP storage is stored in the pcap storage node.
We have to figure out how to send pcaps to this node in the security onion console
