Suggestions for the Security Onion LiveCD

I'm currently working on the next version of the Security Onion LiveCD. What specific packages/features would you like to see added to the Security Onion LiveCD? Post a comment here or contact me on Twitter. Thanks!

The Security Onion LiveCD is now available!

The Security Onion LiveCD is now available! You can download it from the following location:
http://distro.ibiblio.org/pub/linux/distributions/security-onion/

What is it?
The Security Onion LiveCD is a bootable CD that contains software used for installing, configuring, and testing Intrusion Detection Systems.

What software does it contain?
The Security Onion LiveCD is based on Xubuntu 9.04 and contains Snort 2.8.4.1, Snort 3.0.0b3 (Beta), sguil, idswakeup, nmap, metasploit, scapy, hping, fragroute, fragrouter, netcat, paketto, tcpreplay, and many other security tools.

What can it be used for?

• The Security Onion LiveCD can be used for Intrusion Detection. Simply boot the CD and double-click either the Snort-Sguil or SnortSP-Sguil desktop shortcuts. The Snort and Sguil daemons will then start, listening on eth0 for any suspicious traffic and creating alerts in the Sguil console.
• The Security Onion LiveCD can be used to test an Intrusion Detection System. Simply boot the CD and use the included tools (such as nmap, metasploit, idswakeup, scapy, hping, and others) to test your existing IDS or to test the included Snort 2.8.4.1 and Snort 3.0 Beta 3.
• The Security Onion LiveCD can be used to install an Intrusion Detection System. Simply boot the CD and double-click the Install desktop shortcut. For more information about installation, please see the README desktop shortcut.

You can read more about the Security Onion LiveCD (and, specifically, the integration of Snort 3.0 and Sguil) in my SANS GCIA Gold Paper "Snort 3.0 Beta 3 for Analysts".

Please take a look at the Security Onion LiveCD and let me know what you think!

* Special thanks to:

• Marty Roesch and the whole SourceFire team for all of their work these last 10 years to get Snort to where it is today.
  
• The Sguil team for the best open-source tool to manage Snort alerts.
  
• The SecurixLive crew for their awesome NSMnow installer, the easiest way to install and configure Snort/Sguil on Ubuntu Linux.
• Ubuntu (and Debian) for their well-made Linux distribution(s).
• The Reconstructor team for a very easy to use tool for remastering Ubuntu LiveCDs.
• All developers in the open-source community who work so hard and produce such amazing tools.
  

Barnyard2, SanCP, Snort, and Sguil using NSMnow

In my last post, I mentioned that I was working on integrating BASE into the Security Onion LiveCD. I chose BASE because I wanted a quick and easy GUI for Snort until I could get Sguil up and running. Little did I know that there was a quick and easy way to get Sguil up and running (even easier than installing BASE).

The stars aligned and I stumbled upon NSMnow. This is an amazing little project that will analyze your system; download and install Barnyard2, SanCP, Snort, and Sguil; and automatically configure the whole thing! I ran NSMnow in a terminal chrooted into the Security Onion LiveCD build environment (courtesy of Reconstructor) and a few minutes later it was done. I generated a new ISO, booted it, ran the init script, and fired up the Sguil client. That was too easy!

Building Ubuntu LiveCDs with Reconstructor

As I mentioned previously, I'm currently working on the Security Onion LiveCD. I started building custom LiveCDs years ago by going through the painstakingly manual process of remastering Knoppix. Last year, I began using the Fedora Revisor tool which didn't require as much manual work, but it is limited in that it seems to require that software is installed using RPMs and configuration is done via kickstart file as the ISO is being generated. Earlier this year, I produced a custom BackTrack CD for the Greater Augusta ISSA using Gene Bransfield Jr.'s guide and the Linux Live scripts. For the Security Onion LiveCD, I decided to try a new approach. This is my first time using Reconstructor and it provides a good balance of automation while still allowing you to easily customize at any time.

The process hasn't been totally painless, however (I should mention that I'm using Reconstructor 2.8.1.):

• I ran into a squashfs bug, which required updating squashfs-tools to a newer version than is currently available in Ubuntu's repositories.
  
• In the main Customization interface, there is an Apply button above the Next button. When I first starting using Reconstructor, I assumed that when you click Next, your settings are automatically applied, but that is not the case. You must click Apply or else your settings will be lost.
  
• If you select a custom Gnome background color, Reconstructor seems to increment it each time it is launched. For example, I configured my background color to be #486ac1. The next time I opened Reconstructor, it showed the value as #486ac2. The next time I opened Reconstructor, it was #486ac3, and so on.
  
• As with any LiveCD, there is always the issue of space--one has to balance having every remotely-useful tool available with the size limitation of a 700MB CD. Reconstructor helps somewhat in that it estimates the ISO size before generation, but this estimation isn't always accurate. You still may have to fully generate the ISO before you know for sure that it is under 700MB.

Overall, Reconstructor is a very good tool. If you can work through the minor issues detailed above, it is the easiest way to build a fully customized LiveCD. I look forward to the upcoming Reconstructor 3.