In this demo,
I will show you how to perform all the tasks we covered in the last clip.
We will start with verifying Zeek is installed on a machine dedicated to
Zeek management for the Globomantics network.
Once that first step is complete and we know that Zeek is installed, I'll create
Zeek user account that will be used for remote management.
Then I will show you how to generate the SSH public and private
keys that will be used for authentication.
When all these tasks are complete,
I will show you how to modify the default
configuration from standalone to cluster.
I have connected to the command line interface of the Zeek management host
and have already identified that Zeek is not installed.
I will quickly install it using the package from the
operating system's software repository.
Zeek installation is covered in depth in the Getting Started
with Zeek course. We will instead focus on configuring and
deploying Zeek in this course.
Now that Zeek is installed,
I will create a Zeek user account and add it to the
wheel group so it has sudo access.
Remember, this account will be used to connect and configure any remote
systems in the cluster. Once the user account is created and I've changed
the ownership of the Zeek installation directory to allow the Zeek user
full access to all the files, I will generate the SSH public and private
key pairs as the Zeek user.
Pay attention to which user account you're using when you get to
this step. When the SSH keys are being generated, Zeek requires
that the passphrase be left blank, so you will need to limit
untrusted access to this system.
The last task to complete is to enable cluster operation by
editing the Zeek node.cfg configuration file.
I've already captured the IP address for the management host.
You can see that by default Zeek has the standalone configuration enabled.
We're going to change this and enable the manager and proxy
nodes. Keep in mind that the names can be changed to fit your
environment, and the type is what determines the function of each
node in the configuration file.
I did not enable the logger node because when the longer node is active,
Zeek aggregate all the logs sent to the management
host into one monolithic file.
Instead, what I want are the individual files for each protocol.
You will see later in this course that the Filebeat's agent
expects the Zeek logs to be multiple files.