Up to this point,
we have configured the management host and identified a sensor
strategy that requires three remote Zeek sensors.
Now we will look at how to configure these sensors,
which are also called workers in Zeek parlance.
Just like the management host,
we need to ensure that Zeek is installed, and as a best practice,
we should check that the software versions are the same across the cluster.
The next step is to create a user account that has the exact same name as
the Zeek user that was created on the management host.
Normal user accounts do not have access to put network interfaces into
promiscuous mode or access raw packets, so we must enable some operating
system level features that will allow Zeek and the zeekctl binaries to
function without a privileged account.
Once these steps are complete,
we will need to keep track of the IP address for each
sensor and the monitoring interface.
This information will be used when we pivot back to the management host and
continue updating the cluster configuration file. On the management host, I will
first test connectivity to each of the Zeek sensors.
If that test is successful,
I will modify the Zeek cluster configuration to reflect the three
worker nodes we have deployed on our network.
Then I will copy the SSH public key for the Zeek user to the server sensor, and
ensure that I can remotely log in without using a password.
The same process will unfold for the DMZ sensor and the user sensor.
We are almost complete. And the last step is to deploy the cluster configuration
to all the remote systems using the zeekctl deploy command.
The deployment process is relatively short and depends on
how many sensors are deployed; however, when the deployment is complete,
we can check the status by using the zeekctl status command.
The output should show each system in the cluster and if there are
any errors during the deployment. In the next clip,
we will take a look at a demo of this entire process.