Network Security on the Cheap, part 2: Graylog

So, I've spent the last couple of weeks setting up GrayLog in a cluster.

Giant pain in the butt.

My build was Ubuntu 16.04.  And that works fine.

Lots of stuff that is not mentioned, or even thought about.

A few things I had to solve...

1) Elasticsearch needs to be on the same version
2) Mongodb needs to be at least version 3 or higher.
3) The web URI information is badly documented.
4) A cluster won't form until you are using the same database for all servers.

I set up a router in front of my setup, resulting in a NAT'd public IP address and the cluster behind.  Gives plenty of room for growth without ever readdressing anything externally.

Based on recommendations, I changed the listening port to 12900.   Not sure the implications or reasoning of that.  But it seems to work for me.

So, private IP is IP of the server.
Public IP is the NAT'd IP of the server. 

rest_listen_uri =  private ip/api/

web_listen_uri = private ip

web_endpoint_uri = public ip/api/

rest_transport_uri = private ip/api

forgetting the /api/ on the web_endpoint_uri causes a specific issue

It's the cannot POST issue.

Don't forget the /api/ setting.

Once that is done

I also load balanced the web interface using HAProxy.

Final thing about Graylog, and one I wondered about...

Once I've got the cluster up and working, do I need to load balance my UDP syslog traffic?

Short answer: probably not.

Though it doesn't look like the other servers in the cluster are doing anything, they are.  Easy way to tell is look at the number of messages waiting and processing.  With 2 servers in my cluster, my waiting and processing at 4,000 messages per minute sits in the dozens.  There's never a queue.

So, with two low power computers and a whopping total of 14 GB of RAM, I process 4,000 messages a minute with zero wait.  That includes bursts of up to 6,000 messages per minute.

I'm not saying you won't need to load balance the UDP traffic.  I'm saying you need to base it off your scenario.  And figure out how many messages per minute you are getting.

Generally, UDP is low overhead network traffic anyways.  The general problem is not that you can't receive enough data.  It's that the data takes too long to process, resulting in a queue.  That's the purpose of building a cluster.

Total cost at this point?  3 cast off computers that aren't good for much else.  One of my computers runs 6 GB of RAM and runs 100% CPU usage.   Yet it still handles enough to reduce the load of the primary computer.

Network and Security on the cheap

Networking security and monitoring on the cheap

Building a complex network scheme requires a lot of knowledge and experience.  It also requires a bit of insight and guesswork into what can and should be used.  Trying to do all this without budget is even worse.  You basically don't have any chance to do it correctly.  

Or do you....   

See, part of the problem is not knowing the tools are there in the first place.  And because the Internet is big into open source, you've got plenty of options once you become aware of what they are.  So that's what I'm going to try to deal with here.  Trying to build a defensible architecture based off spending the least amount of money as possible.  Saving the money on these tools allows you to spend that money else where.  Like in good firewall. 

Love them or hate them, here's my recommendations.  

Network monitoring - Paessler PRTG

Log Management - GrayLog

SIEM - OSSIM

Firewall -  Palo Alto

Patch Management - WSUS

Now, before I get yelled at...  

1) I don't deal with much of a web presence, so I don't have to fight with Web Application Firewalls.   I mostly deal with brick and mortar.  If you've got a web front end to deal with, I can't really help you.  

2) Palo Alto is expensive.  But it is awesome.  Money spent there is well worth the spend.   

3) PRTG is only free for 100 sensors.  100 is better than 0, which is probably what you are monitoring now.   And running a ping here and there is not monitoring.   Don't even pretend.   

Sure, many of these platforms are free.  But you will spend a lot of time in sweat equity.  Don't expect an easy time with setup and tuning.  Expect to spend a lot of time beating your head on the wall, trying to figure something out. 

The other part of this is do what everyone says to do, but no one does: document.  

Documentation is the untold glue that holds all these train wrecks together.  Spend a lot more time documenting than you think you should.  Because that first time you have to rewrite a script to get your Graylog server to accept traffic on the correct port, you'll wish you had.  Because you'll forget about that script, and reboot.  And because you didn't write it down, you'll have to figure it out again.  No fun.

Or when your Graylog setup script gets overwritten due to an upgrade.  Fun times.  Fun times.

Han Solo was right

Han Solo was right.

Short-circuiting your thinking

Seems like I've spent a lot of time thinking about my thinking.  Strange and interesting to say the least.  Anyways, I came across an interesting thought. 

Instead of trying to short circuit your thinking in the moment, come up with something to short circuit your thinking that has already been prepared.  It seemed like a simple idea. 

Because I couldn't stop the train wreck of thoughts going through my head during the process.  Without a lot of practice, it's almost impossible.  Especially if you've been conditioned to think in the wrong manner.  And most of my thinking has been in the wrong manner.  It's hard to say that, but yeah.  Most of my thinking has been flat out wrong.  And has been wrong for years. 

To say it's wrong is to have some sort of argument with the knowledge that I know the right way.  Which is completely untrue.  I spent years being conditioned to think incorrectly.  It was probably me that caused a bunch of it.  But I never stopped it.  To say growing up sucked was an understatement.  But that crap conditioned me to think incorrectly.

So how in the world am I going to solve this problem?  I'm going to try something new.  And if it doesn't work, I'm going to try something else.  If that doesn't work, I'll try again.  Because what I have been doing hasn't been working.  There's just too much mental baggage to get my brain going in the correct direction without a prepared answer.  Too many years of not believing I was worth a damn. 

But what you can do is right down what you want to believe.  And listen to it frequently.  Listen to it? 

Here's the cheating part.  Because it's so damn easy. 

Come up with your script.  Come up with what you want to be. 
Write it down.
And record it in your own voice. 
And then, play it back frequently. 

Try it for a month.  See what happens.

See, because you don't rise to the occasion.  You fall to the level of your training.  So you have to develop a new form of training. 

And the easiest way to train yourself is auto-program responses.

Try it for a week or two.  I'm pretty sure you'll love the results.

Real Life vs Video Game Life

I'm often struck in the vast difference between video game life and real life, especially when it comes to war.  I just finished reading "With the Old Breed" by E.B. Sledge.  As a real to life account of war, it it vastly different than what is experienced in the average video game.  The average video game throws amazing circumstances at you and you end up fighting constantly, effectively dying and retrying.  Video games are full of banzai charges and insane attacks.  It's the kind of stuff that makes for great movie scenes.  It's also things that were learned and quit.

By the time of the battles at Pellilou and Okinawa, the Japanese banzai charge had gone the way of the dinosaur.  It was an ineffective action when faced down by a bunch of entrenched Marines.  It was replaced with deep emplacements and disciplined fire.   That led to slow slogging battles battles where every inch of ground was a difficult struggle. 

You don't see much of that in video games.  It's all blind charges and insane maneuvers as your bullet sponge avatar heroically destroys an obviously inferior enemy.  It's a sad blight on humanity.

I once thought of a movie to describe real war.  It would have been called Guard, and it would be four hours long in real time.  No quick cuts, no exciting scenes.  You have three people standing in a guard tower watching a mobile populace move through their day to day lives. 

It would have been the most boring movie known to man.  But then it would have been the most accurate war movie ever.  Just by observing you would learn the wonders of high intensity anxiety and tension.  It would have been beautiful. 

But then, I've never been a screen writer.  Or much less a story board person.  It would have been interesting. 

The general answer is that real life is not video games.  And that's about all there is to it. 

Financialness, or not

I've read a lot of financial books.  They all say pretty much the same thing.  The ideas are all pretty much the same.  Each one has a bit they think is different.  But at least a bunch of them realize what they're saying is not unique. 

Short answer: buy things that make money while you sleep. 

That's pretty much it.

Big shocker.  But yeah, that's it.  The path to that answer is always different, but it's roughly the same regardless of what choice you make.  Many will suggest you start buying that thing while you are still in debt.  Others will tell you to get out of debt first.  Others will tell you to use debt.  But it's all the same: buy something that makes money while you sleep.

Continue buying things that make money while you sleep until you make enough money to where you don't need to work, and then you are rich. 

Could be businesses.  Could be stocks.  Could be bonds.  Could be houses. 

So, before you read your next financial book go look for something you can buy that will make you money while you sleep.   Because that's what the financial book is going to tell you anyways. 

The only difference is when and what method. 

Truthfully, I was thinking of a longer version of this article.  It seemed like a good place to go in to the differences between Robert Kiyosaki, Dave Ramsey, Mr Money Mustache, and Suze Ormann.  But it's pretty much the same thing over and over again.  A lot depends on where you are in your journey and your risk tolerance. 

From Kiyosaki, I learned that you should have multiple plans.  From Ramsey, I learned the psychology of getting out of debt.  Mr. Money Mustache provided an end game idea.  Suze Ormann didn't teach me all that much. 

Stuff and Nonsense

Things are moving right along.  Except they really aren't.  Because although I've been doing a lot of things, I've been doing a lot of the wrong things.   Too much time has been spent solving problems that really aren't problems. 

I find that happens a lot in life.  A lot of time gets spent on things that don't really take you anywhere.  And the things that do end up taking you somewhere seem so inconsequential that you almost ignore them.  

I guess what I'm saying is that the real success in life is not the busy work you continue to do. 

It's the project you don't have time for. 
It's learning something you didn't know.
It's writing the book you've always wanted to write.

And in the end, those things are the ones that really matter.  But they are also the things you will spend the least amount of time on.

Because they are big, and scary, and consequential.

And it's much easier to watch youtube cat videos than it is to do real work.

Or browse through Pinterest.

Or watch TV.

Or read blogs.  

Or read the 15th book on a subject.

Because what you really need to do is put in work.

And that's hard.  Especially when there are so many places to go look for the perfect way to do something.