- Apr 25, 2015
- 1,844
- 2
- 2,197
- 327
Looking to setup your first AlienVault server? Look no further.
Sometimes people prefer hosting on their own prem (premise or plural premises).. if you want to do that then go ahead and just mount the ISO and install as normal.
If you are simply looking for a hosting provider to install your AlienVault OSSIM (or other appliance) to a remote server hosting provider I have some solid recommendations for you!
You can use Kimsufi for cheap servers that just work: https://www.kimsufi.com/us/en/servers.xml
So you Start has affordable deals and sometimes sales on their servers: https://www.soyoustart.com/us/essential-servers/
When selecting between hard and solid-state drives, you have to consider whether you want longer term storage of logs or the ability to quickly search logs. If you want longer term storage and overall more storage space, of course select the SATA storage plan. If you just want to get logs going and to be able to search through them quickly, I would opt for SSD. You can always consider adding more storage later.
Lastly, if you want to get a beefier server then I would strongly urge you to consider OVH as a hosting provider, their server pricing may be found here: https://www.ovh.com/world/dedicated-servers/prices/
If you are considering running inside Proxmox, consider reading up here https://success.alienvault.com/s/question/0D50Z00008oGt5E/not-finish-installation-ossim-543
Otherwise, on the above hosting providers you may be able to mount your AlienVault ISO and install: https://docs.ovh.com/gb/en/dedicated/use-ipmi-dedicated-servers/
Now that we have kvm installed, we can get for example an Ubuntu 14.04 Image and do the installation from there.
Now we start kvm with vnc support and do the installation from there:
The VNC Server will listen on localhost only, so that no one else can access it. You need to tunnel yourself with SSH through.
This is also helpful to start your server under KVM, to fix any boot issues you might have.
Some folks claim TigerVNC works, while RealVNC may not..
If anyone needs help getting any of this to work, let me know
Sometimes people prefer hosting on their own prem (premise or plural premises).. if you want to do that then go ahead and just mount the ISO and install as normal.
If you are simply looking for a hosting provider to install your AlienVault OSSIM (or other appliance) to a remote server hosting provider I have some solid recommendations for you!
You can use Kimsufi for cheap servers that just work: https://www.kimsufi.com/us/en/servers.xml
So you Start has affordable deals and sometimes sales on their servers: https://www.soyoustart.com/us/essential-servers/
When selecting between hard and solid-state drives, you have to consider whether you want longer term storage of logs or the ability to quickly search logs. If you want longer term storage and overall more storage space, of course select the SATA storage plan. If you just want to get logs going and to be able to search through them quickly, I would opt for SSD. You can always consider adding more storage later.
Lastly, if you want to get a beefier server then I would strongly urge you to consider OVH as a hosting provider, their server pricing may be found here: https://www.ovh.com/world/dedicated-servers/prices/
If you are considering running inside Proxmox, consider reading up here https://success.alienvault.com/s/question/0D50Z00008oGt5E/not-finish-installation-ossim-543
Otherwise, on the above hosting providers you may be able to mount your AlienVault ISO and install: https://docs.ovh.com/gb/en/dedicated/use-ipmi-dedicated-servers/
Code:
#to see if Raid devices are present and stop them
cat /proc/mdstat
mdadm --stop /dev/md0
mdadm --stop /dev/md1
#Second step is to get rid of the network drives, because they are read-only
mount -t tmpfs -o size=6000m tmpfs /mnt # use 6GB of memory as temp - adjust as needed
mkdir /mnt/var
mkdir /mnt/var/cache
mkdir /mnt/var/lib
mkdir /mnt/var/run
mkdir /mnt/usr
mkdir /mnt/lib
rsync -a /var/cache/ /mnt/var/cache/
rsync -a /var/lib/ /mnt/var/lib/
rsync -a /var/run/ /mnt/var/run/
rsync -a /usr/ /mnt/usr/
rsync -a /lib/ /mnt/lib/
mount -B /mnt/var/cache /var/cache
mount -B /mnt/var/lib /var/lib
mount -B /mnt/var/run /var/run
mount -B /mnt/usr /usr
#Update your system
apt-get -y update
apt-get -y --force-yes upgrade
#Install qemu + kvm
apt-get -y install qemu kvmNow that we have kvm installed, we can get for example an Ubuntu 14.04 Image and do the installation from there.
Code:
wget http://releases.ubuntu.com/14.04.1/ubuntu-14.04.1-desktop-amd64.isoNow we start kvm with vnc support and do the installation from there:
Code:
qemu-system-x86_64 -net nic -net user,hostfwd=tcp::80-:80 -m 2047M -alt-grab -localtime -enable-kvm -cpu kvm64,+nx -smp 2 -usbdevice tablet -k en-us -cdrom ubuntu-14.04.1-desktop-amd64.iso -hda /dev/sda -hdb /dev/sdb -vnc 127.0.0.1:0The VNC Server will listen on localhost only, so that no one else can access it. You need to tunnel yourself with SSH through.
This is also helpful to start your server under KVM, to fix any boot issues you might have.
Code:
vncviewer -geometry 1024×768 -via root@myIPaddress localhost:0Some folks claim TigerVNC works, while RealVNC may not..
If anyone needs help getting any of this to work, let me know
