broplatform/brolive repository overview

⁠Notes

Webpage https://www.bro.org/brolive/⁠.

This image contains Bro 2.4 with working BroCtl.

Manual Use: docker run -it --cap-add=NET_RAW broplatform/brolive bash

This repo will always contain the latest stable Bro release for training

To be used with the following project: [2⁠]

⁠Bro Live!

Our training environment is designed to have users SSH into a host system which runs and places them into a container based on the Brolive Docker image. Then each user will have their own environment to play with Bro, including a mounted directory of Bro exercises and PCAP files. This alleviates the burden of passing around, or downloading, and configuring VM's of Bro which in our experience takes too much time, being slow, and a few people always have a few issues that put them behind everyone else. We can enhance the experience at conference training events whereby attendees only need an SSH client by a container based platform for training.

To replicate our Bro Live! training system 3 things must be completed:

1. ISLET must be installed [3⁠] including dependencies
2. This Docker image (broplatform/brolive) must be installed
3. The host system running the Docker daemon (1.2.0+) must be configured to use it

⁠Automated Installation

Begin with a fresh Ubuntu machine. The following commands will install latest Docker, ISLET, and the BroLive Docker image.

apt-get install sqlite make

git clone https://github.com/jonschipp/islet && cd islet && make bro-training

⁠Use

Password: demo - Replace with your server's ip or domain name. ssh [email protected]

⁠General Considerations

Conferences and training events typically span multiple days like in the case of BroCon. Because of this it's desirable to keep the user's work in their container for the duration of the event. Our account management system allows them to re-attach to their container in an automated fashion. Once the conference ends, the container is automatically removed from the system.

⁠Security Considerations

1. By nature, the containers are isolated environments, similar in nature to VM's.
2. Containers and users are removed after a period of time (e.g. conference duration)
3. System resources are limited per container to prevent selfishness and abuse
4. Networking is disabled in each container, preventing network attacks against other hosts
5. Each container is limited in size (possible when using devicemapper storage backend)

This page will be updated frequently in the next week in preparation for BroCon. For configuring the host system please see the project's documentation: https://github.com/bro/bro-live/blob/master/README.md⁠

⁠Image Details

The image has the following additional software installed over the base ubuntu docker image:

1. Bro 2.4
2. wget and gawk
3. tmux and screen
4. vim, emacs, and nano
5. Shell helper functions for Bro e.g. bro-grep, bro-column, etc.

Image Configuration:

1. Unprivileged user account named demo is used by student (via ISLET)
2. Bro is installed in /opt/bro
3. Students can use Bro in online and offline mode (-r, -i )
4. Students can use BroCtl (e.g. broctl install, broctl start)
5. Linux capabilities are used so the demo user is able to sniff (NET_RAW)

To start Bro via BroCtl the student must be instructed to edit /opt/bro/etc/node.cfg and to replace the interface with the name of the one that’s available in the container. If networking is disabled in the container (default) then they should choose the loopback interface.