• No results found

SYSTEM BACKUP AND RESTORE (AlienVault USM 4.8+)

N/A
N/A
Info
Download
Protected

Academic year: 2021

Share "SYSTEM BACKUP AND RESTORE (AlienVault USM 4.8+)"

Copied!
11
0
0

Loading.... (view fulltext now)

Download now ( 11 Page )

Full text

(1)

Copyright© 2014 AlienVault. All rights reserved.

AlienVault Unified Security Management™ Solution

Complete. Simple. Affordable

SYSTEM BACKUP AND RESTORE

(AlienVault USM 4.8+)

(2)

AlienVault™, AlienVault Unified Security Management™, AlienVault USM™, AlienVault Open Threat Exchange™, AlienVault OTX™, Open Threat Exchange™, AlienVault OTX Reputation Monitor™, AlienVault OTX Reputation Monitor Alert™, AlienVault OSSIM™ and

(3)

DC-00146 Edition 01 Copyright© 2015 AlienVault. All rights reserved. Page 3 of 11

CONTENTS

1.

INTRODUCTION ... 4

2.

SCOPE ... 4

3.

HOW TO BACKUP AN ALIENVAULT APPLIANCE ... 4

3.1. Payload Backup ... 6

3.2. Environment Backup ... 6

3.3. “Raw Data” Backup ... 7

3.4. Saving Generated Backup Files ... 7

4.

HOW TO RESTORE AN ALIENVAULT APPLIANCE BACKUP ... 7

4.1. Copy the backup files into the appliance ... 8

4.2. Stop appliance services ... 9

4.3. Payload Restore ... 9

4.4. MongoDB Dump Recovery ... 9

4.5. Environment Restore ... 10

4.6. “Raw Data” Restore ... 10

(4)

AlienVault Unified Security Management™ Solution SYSTEM BACKUP AND RESTORE

(AlienVault USM 4.8+)

DC-00146 Edition 01 Copyright© 2015 AlienVault. All rights reserved. Page 4 of 11

1.

INTRODUCTION

This document describes how to perform a full backup of an AlienVault USM appliance (4.8+) so the system can be recovered - or replaced by another system - after proceeding with the restore process.

The appliance to be recovered MUST have the same software version used during the backup process.

2.

SCOPE

This procedure will save all the information from your system required for recovery purposes:

• Payload: events, alarms, assets, users, reports, tickets, historic data... • Environment: processes configuration, plugins, keys...

• Raw Data: Logger data and Netflows

All the steps described in the following sections must be done, in the order here defined, to perform the full backup and restore of the system.

Do not use this procedure to try to clone/duplicate data or configuration across your deployment.

3.

HOW TO BACKUP AN ALIENVAULT APPLIANCE

The backup procedure requires the users to have full access to the appliance console (local or remote access). To get remote access:

• Open a console terminal and type the following command:

ssh root@IP_address

(5)

DC-00146 Edition 01 Copyright© 2015 AlienVault. All rights reserved. Page 5 of 11 The AlienVault Setup main menu should be displayed after the user authentication. • On the computer keyboard, press the arrow keys to move to option 3: “Jailbreak

System”. Then, press Enter to accept the selection (<OK>).

• Execute the following command:

screen

The instructions below will generate the following backup files:

• Payload − alienvault-dbs.sql.gz − alienvault-mongo.tgz • Environment − Alienvault-environment.tgz • Raw Data − alienvault-data.tgz

Please, keep these files in a secure location. They are needed in order to recover your appliance.

(6)

AlienVault Unified Security Management™ Solution SYSTEM BACKUP AND RESTORE

(AlienVault USM 4.8+)

DC-00146 Edition 01 Copyright© 2015 AlienVault. All rights reserved. Page 6 of 11

3.1. PAYLOAD BACKUP

The entire “payload” data managed by AlienVault appliances is stored in two databases: • MySQL: events, alarms, assets info, users and permissions, reports, tickets... • Mongo DB: IDM historic data

So saving up a dump from these databases will provide the “payload” backup.

3.1.1.

MYSQL DATABASE DUMP

1. Execute the following command:

mysqldump -p`grep ^pass /etc/ossim/ossim_setup.conf | sed 's/pass=//'` --no-autocommit --single-transaction --all-databases | gzip >

alienvault-dbs.sql.gz

2. The alienvault-dbs.sql.gz backup file should be created.

3.1.2.

MONGO DATABASE DUMP

1. Execute this command to dump your database:

mongodump --host localhost

2. A directory called dump should be generated.

3. Compress the dump file. Type the following command:

tar cvzf alienvault-mongo.tgz dump

4. The alienvault-mongo.tgz file should be successfully created.

3.2. ENVIRONMENT BACKUP

This section describes how to save the environment configuration files related to the appliance platform, processes, plugins, keys...

1. Execute the following command:

if [[ ! f /etc/alienvaultcenter/alienvaultcenteruuid ]]; then dmidecode -s -sy-stem-uuid | awk '{print tolower($0)}' >

(7)

/etc/alienvault-DC-00146 Edition 01 Copyright© 2015 AlienVault. All rights reserved. Page 7 of 11 center/alienvault-center-uuid ; fi

2. Backup the appliance configuration:

tar cvzf alienvault-environment.tgz /etc/ossim/ /etc/alienvault/

/etc/alienvault-center/ /etc/ansible/ /root/.ssh/ /home/avapi/ /home/avforw/ /home/avserver/ /var/ossec/ /etc/snort/ /etc/suricata/ /etc/nagios3/

/etc/openvpn/ /var/cache/openvas/ /var/lib/openvas/ /etc/logrotate.d/ /etc/rsyslog.d/ /etc/apache2/ /usr/share/alienvault-center/ /etc/nfsen/ /etc/mysql/ /var/ossim/keys/ /var/ossim/ssl/ /etc/hosts /etc/resolv.conf

3. The alienvault-environment.tgz file should be created.

3.3. “RAW DATA” BACKUP

1. Create a compressed file containing the Logger and Netflows data:

tar cvzf alienvault-data.tgz /var/ossim/logs /var/nfsen /var/cache/nfdump

2. The alienvault-data.tgz file should be created.

3.4. SAVING GENERATED BACKUP FILES

Do not forget to copy the generated backup files in a secure location. You can use any SCP application; for example, WinSCP (for Windows) or SCP command (for Linux):

• alienvault-dbs.sql.gz • alienvault-mongo.tgz • alienvault-environment.tgz • alienvault-data.tgz

4.

HOW TO RESTORE AN ALIENVAULT APPLIANCE BACKUP

The appliance to be recovered MUST have the same software version used during the backup process.

The restore procedure requires the users to have full access to the appliance console (local or remote access). To get remote access:

(8)

AlienVault Unified Security Management™ Solution SYSTEM BACKUP AND RESTORE

(AlienVault USM 4.8+)

DC-00146 Edition 01 Copyright© 2015 AlienVault. All rights reserved. Page 8 of 11 • Open a console terminal and type the following command:

ssh root@IP_address

IP_address refers to the default IP of your appliance.

The AlienVault Setup main menu should be displayed after the user authentication. • On the computer keyboard, press the arrow keys to move to option 3: “Jailbreak

System”. Then, press Enter to accept the selection (<OK>).

• Execute the following command:

screen

4.1. COPY THE BACKUP FILES INTO THE APPLIANCE

The following files, previously saved, must be copied into your target appliance in order to restore the backup. You can use any SCP application; for example, WinSCP (for Windows) or SCP command (for Linux):

• alienvault-dbs.sql.gz • alienvault-mongo.tgz • alienvault-environment.tgz • alienvault-data.tgz

(9)

DC-00146 Edition 01 Copyright© 2015 AlienVault. All rights reserved. Page 9 of 11

4.2. STOP APPLIANCE SERVICES

1. Stop the following services in the appliance:

/etc/init.d/monit stop /etc/init.d/ossim-server stop /etc/init.d/ossim-agent stop /etc/init.d/ossim-framework stop /etc/init.d/alienvault-idm stop /etc/init.d/alienvault-center stop /etc/init.d/alienvault-api stop

2. Create a backup of the AlienVault configuration file:

cp /etc/ossim/ossim_setup.conf /root/ossim_setup.conf_last

4.3. PAYLOAD RESTORE

4.3.1.

MYSQL DUMP RECOVERY

Enter the following command to restore the dump file:

zcat alienvault-dbs.sql.gz | ossim-db

4.4. MONGODB DUMP RECOVERY

1. Extract the tar file:

tar xvzf alienvault-mongo.tgz

2. Restore the mongoDB backup:

(10)

AlienVault Unified Security Management™ Solution SYSTEM BACKUP AND RESTORE

(AlienVault USM 4.8+)

DC-00146 Edition 01 Copyright© 2015 AlienVault. All rights reserved. Page 10 of 11

4.5. ENVIRONMENT RESTORE

1. Remove current configuration:

rm -rf /etc/ossim/ /etc/alienvault/ /etc/alienvault-center/ /etc/ansible/ /root/.ssh/ /home/avapi/ /home/avforw/ /home/avserver/ /var/ossec/ /etc/snort/ /etc/suricata/ /etc/nagios3/ /etc/openvpn/ /var/cache/openvas/

/var/lib/openvas/ /etc/logrotate.d/ /etc/rsyslog.d/ /etc/apache2/ /usr/share/alienvault-center/ /etc/nfsen/ /etc/mysql/ /var/ossim/keys/ /var/ossim/ssl/ /etc/hosts /etc/resolv.conf

2. Restore configuration from your backup. Extract the tar file into the “/” directory:

tar xvzf alienvault-environment.tgz -C /

3. Copy the Alienvault configuration file under /etc/ossim:

cp /root/ossim_setup.conf_last /etc/ossim/

4. Enter the following commands to update the files permissions:

tar tvzf alienvault-environment.tgz | tr -s ' ' > /root/file_list ulimit -s 65536

cd /

for i in `cat /root/file_list | cut -f2 -d" " | sort -u`; do user=`echo $i | cut -f1 -d"/"`; group=`echo $i | cut -f2 -d"/"`; chown $user:$group `grep $i root/file_list | cut -f6 -d" " | xargs`; done

ulimit -s 8192 cd /

4.6. “RAW DATA” RESTORE

1. Extract the tar file to the “/” directory:

tar xvzf alienvault-data.tgz -C /

2. Enter the following commands to update the files permissions:

(11)

DC-00146 Edition 01 Copyright© 2015 AlienVault. All rights reserved. Page 11 of 11 ulimit -s 65536

cd /

for i in `cat /root/file_list | cut -f2 -d" " | sort -u`; do user=`echo $i | cut -f1 -d"/"`; group=`echo $i | cut -f2 -d"/"`; chown $user:$group `grep $i root/file_list | cut -f6 -d" " | xargs`; done

ulimit -s 8192

4.7. START APPLIANCE SERVICES

1. Type the following command in the console:

ossim-reconfig -c -v -d

References

Download now ( PDF - 11 Page - 375.38 KB )

Related documents

Vol 4, No 8 (2016)

Software Puzzle is a best way for providing security to the data.It mainly focuses on enhancing the data security from DOS attacks which became serious threat now a

Integrated Solutions You Can Trust

Today, we are a leader in network security, Web and e-mail security and backup and recovery with offerings like our market leading Unified Threat Management solutions,

The FactPoint Group: 12 Ways Unified Threat Management Firewalls are Driving Security Consolidation

Researcher IDC defines Unified Threat Management as “security appliance products [that] include multiple security features integrated into one box.” The minimum set of

How To Understand Watchguard'S Security Portfolio

Security appliance vendors have responded to these needs with unified threat management (UTM) solutions, which provide a basic core of critical security applications, such

Upgrading to Websense Web Security v7.6

– Install Triton Unified Security Center, security management module(s), Log Server, Real-Time Monitor, Sync Service, Linking Service. – SQL Server 2008 R2 Express

Analysis of the Worldwide Physical Security Information Management Market. M November 2010

Quick Threat Detection and Unified User Interface Attracts more PSIM Users 12.. Physical Security Information Management

Cyberoam Next-Generation Security. 11 de Setembro de 2015

The acquisition expands and deepens Sophos’ already significant product portfolio in network security, by combining Cyberoam’s Unified Threat Management (UTM), next-generation

WHITE PAPER. Empowering the MSSP. Part 3: Monetizing Fortinet s Ecosystem in a Multi-Tenant Cloud Service

Tier 1 Comprehensive 50Meg security; fully managed, Unified Threat Management, dedicated virtual domain, customer portal read access and reporting visibility Customers (Year 1)