Installing YETI with Portainer on Ubuntu 22.04

 Another day, another project.  I have been playing with some open-source Intelligence Platforms (I installed OpenCTI, and MISP recently with Portainer).  I recently found another project called YETI 'Your Everyday Threat Intelligence'

 For background, I already have a VM setup running Portainer (It is probably overworked, but it's only for testing, so not too concerned about overloading).    One change on the VM was to create a folder: 

/tmp/docker-yeti-exports 

In hindsight I would have changed the location in the docker-compose but missed it (needs to be rebuit upon reboot).

The setup of Yeti inside of Portainer took a little more than the previous builds as it could not build the image from the docker-compose.  I am new to this, so not entirely sure, but I think they don't host the image on GitHub or docker for it to build from.  

I had to download a few files from the Yeti GitHub

•     requirements.txt
•     dockerfile
•     docker-entrypoint.sh

Because I will be updating the requirements.txt and I had issues with the original docker-entrypoint I had added updated the Dockerfile with the following: 

RUN git clone https://github.com/yeti-platform/yeti.git /opt/yeti;
COPY requirements.txt /opt/yeti
COPY docker-entrypoint.sh /docker-entrypoint.sh

In the requirements.txt, I added a new application and added forced version.  This is due to an issue with flask and werkzeug

flask=2.1.2
werkzeug=2.12

Next, I created a .tar file with those three files.  Those files were included in the tar because Portainer will consider the files part of the default path (not needing to include local paths in your script).  I found that information somewhere else (I think it was on Reddit). The tar file was used to create an image called yeti:latest as shown below: 

The image took a few minutes to create, after that it was time to add a new stack to Portainer.

First things first, I had to update the docker-compose for the new image. I changed out yeti1:master to yeti:latest as below

version: '3.3'
services:

  yeti:
    image: yeti:latest
    ports:
      - "5000:5000"
    command: ['webserver']
    depends_on:
      - redis
      - mongodb
    volumes:
      - /tmp/docker-yeti-exports:/opt/yeti/exports

  feeds:
    image: yeti:latest
    command: ['feeds']
    depends_on:
      - redis
      - mongodb
      - yeti
    environment:
      - TLDEXTRACT_CACHE=/tmp/tldextract.cache

  analytics:
    image: yeti:latest
    command: ['analytics']
    depends_on:
      - redis
      - mongodb
      - yeti
    environment:
      - TLDEXTRACT_CACHE=/tmp/tldextract.cache

  beat:
    image: yeti:latest
    command: ['beat']
    depends_on:
      - redis
      - mongodb
      - yeti
      - feeds
      - analytics
      - exports

  exports:
    image: yeti:latest
    command: ['exports']
    depends_on:
      - redis
      - mongodb
      - yeti
    volumes:
      - /tmp/docker-yeti-exports:/opt/yeti/exports

  oneshot:
    image: yeti:latest
    command: ['oneshot']
    depends_on:
      - redis
      - mongodb
      - yeti

  redis:
    image: redis:latest

  mongodb:
    image: mongo:4.0.12
    environment:
      - MONGO_LOG_DIR=/dev/null
    command: mongod

I created a new stack (called yeti) and deployed it. 

And the screen for YETI (Which I noticed did not have a login screen).  Not sure if that is normal btw as it's my first time using it.

Building Vulnerability Scanners with Portainer

  Currently, I am in school for my Master, and we had an assignment to conduct vulnerability scanning on our home network.  It has been a while since I installed Nessus or OpenVAS, and technology has certainly changed. 

I have been using Portainer recently for most of my Docker containers and wanted to see if it was that easy for Nessus or OpenVAS.   

For Nessus, I did a search for 'Nessus docker-compose' 

version: '3.1'

services:

  nessus:
    image: tenableofficial/nessus
    restart: always
    container_name: nessus
    environment:
      USERNAME: <user>
      PASSWORD: <password>
      ACTIVATION_CODE: <code>
    ports:
      - 8834:8834

I changed the username/password and activation code.  Then I went into Portainer, created a new stack, and placed the above in the web editor.  

From there, I clicked deploy stack.  About 20 minutes later (plugin updates on Nessus), I was up and operational on Nessus Essentials.  One side note to this is that Essentials will only scan 16 IPs, but it's free.

For OpenVAS I searched on Google for 'OpenVAS docker-compose' and found https://github.com/immauss/openvas.  From there, I used the below:

version: "3"
	services:
	openvas:
	ports:
	- "8080:9392"
	environment:
	- "PASSWORD=admin"
	- "USERNAME=admin"
	- "RELAYHOST=172.17.0.1"
	- "SMTPPORT=25"
	- "REDISDBS=512" # number of Redis DBs to use
	- "QUIET=false" # dump feed sync noise to /dev/null
	- "NEWDB=false" # only use this for creating a blank DB
	- "SKIPSYNC=true" # Skips the feed sync on startup.
	- "RESTORE=false" # This probably not be used from compose... see docs.
	- "DEBUG=false" # This will cause the container to stop and not actually start gvmd
	- "HTTPS=false" # wether to use HTTPS or not
	volumes:
	- "openvas:/data"
	container_name: openvas
	image: immauss/openvas:$TAG
	volumes:
	openvas:

Footer

© 2022 GitHub, Inc.

Footer navigation

• Terms
• Privacy

Same procedures as Nessus.  Opened Portainer, and added new stack.  The web editor copied the above information and deployed stack.   On this one, I forgot to update the username/password for my instance.  So that shows as a vulnerability as you conduct a scan. 

Overall, both of these installs were very easy, and I was up and running in about 30 minutes and running scans against my home network. 

Installing MISP with Portainer on Unbuntu 22.04 VM

 I am installing MISP on the same VM that I have running OpenCTI.   As Portainer is already installed on there.   

I chose Coolacid's docker buildout

First things first you have to build out a directory structure on the host VM.  

sudo mkdir /data/compose/#/   

Additional folder under the number (mine was 2) are:

• files
• ssl
• server-configs
• logs

Back at Portainers web ui.  Select Stack from the Left menu, and click +Add Stack

Next name the stack (lower case) and use the web editor upload the docker-compose
 

Click Deploy Stack at the bottom of the page and you are ready to access the MISP login screen. 

• Default email: admin@admin.test
• password: admin 

Password will be required to be changed on first login

Installing OpenCTI with Portainer on Ubuntu 22.04

 Having played around with SecurityOnion I was starting to look into Threat/Intel feeds, which lead me to a few applications:   OpenCTI, and MISP to name a few.  Today I am going to look at setting up a Docker instance of OpenCTI on Ubuntu 22.04 VM. 

While researching  OpenCTI I found documentation of setting up OpenCTI with Portainer.  Having never heard of Portainer, I first wanted to see what that was all about.

From the website for Portainer:  Container Management made easy.   Sold!  I have used Docker a few times, but mostly basic stuff like setting up a container, inspecting the container, ect.  So I don't really have much experience, but from the looks of Portainer, it has a GUI front end and works with Docker and Kubernetes.  I figured I could use it as I was going to use this system later to install a Docker instance of MISP on the same machine.  

The basis of the install procedures came from here.  

I had selected "Docker" option while installing Ubuntu 20.24 server.  So I skipped the first part, and started with creating a swarm (On one computer mind)

docker swarm init --advertise-addr 192.168.1.100

This will setup a Docker swarm and my machine is the Manager node.  

Installing Portainer

Below are the commands I ran on my Ubuntu VM for initial setup of Portainer.

mkdir -p /opt/portainer
cd /opt/portainer
curl -L https://downloads.portainer.io/portainer-agent-stack.yml -o portainer-agent-stack.yml

I updated the Ports associated in the portainer-agent-stack.yml (due to a conflict with OpenCTI)

       

         ports:

            -19000:9000

            -18000:8000

Last step is deploy the Docker container

docker stack deploy --compose-file=portainer-agent-stack.yml portainer

Access Portainer from <UbuntuVM_IP>:1900 

Installing OpenCTI

OpenCTI will be installed from within Portainer.  A docker-compose file is required for the installation.

This file can be found at:  https://netmanageitbackup.com:8083/url/kcyuuqdcuyk7ufks

This version had connectors setup for OTX, greynoise, abuseip, shodan, inetzer, and a few others.  A few configuration are required with the above file, for instance, you will need to update all the UUIDs and add in your API from the above sites.  Lastly, make sure you add your email address/password into the file in the below section:

    - APP__ADMIN__EMAIL=

    - APP__ADMIN__PASSWORD=

When logged into Portainer you create a new stack as shown below:

Next you provide a name and copy the docker file into the web editor as show below: 

Lastly deploy the stack and wait about 30 minutes for it to fully build.  Once complete you will be able to access the site at https://ip:8080.