mirror of
https://github.com/angolo40/mikrocata2selks.git
synced 2025-05-12 08:27:22 +00:00
121 lines
4.3 KiB
Markdown
121 lines
4.3 KiB
Markdown
<h1 align="center">Welcome to Mikrocata2SELKS 👋</h1>
|
|
<p>
|
|
<img alt="Version" src="https://img.shields.io/badge/version-2.2.1-blue.svg?cacheSeconds=2592000" />
|
|
<a href="https://github.com/angolo40/mikrocata2selks" target="_blank">
|
|
<img alt="License: MIT" src="https://img.shields.io/github/license/angolo40/Mikrocata2SELKS" />
|
|
</a>
|
|
</p>
|
|
|
|
## 📋 Introduction
|
|
|
|
This repository is designed to simplify the installation process for the IDS/IPS Suricata for packet analysis from Mikrotik devices.
|
|
|
|
**Minimum Requirements:**
|
|
- 4 CPU cores
|
|
- 10 GB of free RAM
|
|
- Minimum 10 GB of free disk space (actual disk occupation will mainly depend of the number of rules and the amount of traffic on the network - 200GB+ SSD grade recommended).
|
|
|
|
|
|
## 🚀 Install
|
|
|
|
- Setup a fresh Debian 12 install on a dedicated machine (server or vm)
|
|
- Login as root
|
|
- Install git with 'apt install git'
|
|
- Clone this git repo 'git clone https://github.com/angolo40/mikrocata2selks.git'
|
|
- Edit easyinstall.sh with path where to install SELKS and how many Mikrotik to handle
|
|
- Run ./easyinstall.sh
|
|
- Once finished edit /usr/local/bin/mikrocataTZSP0.py with your Mikrotik and Telegram parameters and then reload service with 'systemctl restart mikrocataTZSP0.service'
|
|
- Configure Mikrotik
|
|
|
|
|
|
## 📡 Mikrotik Setup
|
|
|
|
- /tool sniffer set filter-stream=yes streaming-enabled=yes streaming-server=<DEBIANIP>:37008 (37008 is default port for Mikrotik0)
|
|
- /tool sniffer start
|
|
- /ip/firewall/raw/add action=drop chain=prerouting comment="IPS-drop_in_bad_traffic" src-address-list=Suricata
|
|
- /ip/firewall/raw/add action=drop chain=prerouting comment="IPS-drop_out_bad_traffic" dst-address-list=Suricata
|
|
Enabling Mikrotik API:
|
|
- /ip service set api-ssl address=<DEBIANIP> enabled=yes
|
|
Add Mikrocata user in Mikrotik:
|
|
- /user/add name=mikrocata2selks password=xxxxxxxxxxxxx group=full (change password)
|
|
|
|
|
|
## 🛠️ Handle Multiple Mikrotik Devices
|
|
|
|
- Setting more than 1 Mikrotik it will create for each device a dedicated dummy interface and dedicated mikrocata service.
|
|
- Example:
|
|
- - for Mikrotik0 will create tzsp0 interface listening at 37008 port and /usr/local/bin/mikrocataTZSP0.py
|
|
- - for Mikrotik1 will create tzsp1 interface listening at 37009 port and /usr/local/bin/mikrocataTZSP1.py
|
|
- - for Mikrotik2 will create tzsp2 interface listening at 37010 port and /usr/local/bin/mikrocataTZSP2.py
|
|
- - and so on...
|
|
- - So you have to edit:
|
|
- - /usr/local/bin/mikrocataTZSP0.py with specific Mikrotik0 value and enable sniffer on Mikrotik0 sending data to 37008 port.
|
|
- - /usr/local/bin/mikrocataTZSP1.py with specific Mikrotik1 value and enable sniffer on Mikrotik1 sending data to 37009 port
|
|
- - /usr/local/bin/mikrocataTZSP2.py with specific Mikrotik2 value and enable sniffer on Mikrotik2 sending data to 37010 port.
|
|
- - and so on...
|
|
|
|
|
|
## 💡 Functions
|
|
|
|
- Installs Docker and Docker Compose.
|
|
- Installs Python.
|
|
- Download and install SELKS repo (https://github.com/StamusNetworks/SELKS)
|
|
- Download and install Mikrocata
|
|
- Installs TZSP interface.
|
|
- Enables notifications over Telegram when an IP is blocked.
|
|
|
|
|
|
## 🔄 Changelog
|
|
|
|
### 2.2.1
|
|
- Fixed bug causing microcata.py script crash during Suricata logrotate.
|
|
|
|
### 2.2
|
|
- Migrated compatibility to Debian 12.
|
|
|
|
### 2.1
|
|
- Improved stability of the read_json function.(thanks to bekhzad-khamidullaev)
|
|
|
|
|
|
## 🔧 Troubleshooting
|
|
|
|
- Check if packets are coming to VM from mikrotik through dummy interface
|
|
```sh
|
|
tcpdump -i tzsp0
|
|
```
|
|
- Check if mikrocata service and tzsp0 interface are up and running
|
|
```sh
|
|
systemctl status mikrocataTZSP0.service
|
|
systemctl status TZSPreplay37008@tzsp0.service
|
|
```
|
|
- Check if suricata docker is up and running
|
|
```sh
|
|
docker logs -f suricata
|
|
```
|
|
|
|
## 📝 Notes
|
|
- default account of SELKS:
|
|
- - Username: selks-user
|
|
- Password: selks-user
|
|
|
|
## 👤 Author
|
|
|
|
**Giuseppe Trifilio**
|
|
|
|
- [Website](https://github.com/angolo40/mikrocata2selks)
|
|
- [Github](https://github.com/angolo40)
|
|
|
|
Inspired by [zzbe/mikrocata](https://github.com/zzbe/mikrocata).
|
|
|
|
## 🤝 Contributing
|
|
|
|
Contributions, issues, and feature requests are welcome. Check the [issues page](https://github.com/angolo40/mikrocata2selks).
|
|
|
|
## 🌟 Show Your Support
|
|
|
|
Give a ⭐️ if this project helped you!
|
|
|
|
- **BTC**: `bc1qad42pe2ux24y6vek07stmr7dknrq7dzrcws4k7`
|
|
- **BNB**: `0x5fe7087ea857b0b5e509e81cbe120c3bd7524e1f`
|
|
- **XMR**: `87LLkcvwm7JUZAVjusKsnwNRPfhegxe73X7X3mWXDPMnTBCb6JDFnspbN8qdKZA6StHXqnJxMp3VgRK7DcS2sgnW3wH7Xhw`
|