FortiGate-100D # execute shutdown
This operation will shutdown the system !
Do you want to continue? (y/n)y
System is shutting down...
The system is going down NOW !!
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
FortiGate-100D #
The system is halted.
가져오자마자 패스워드 설정이 되어 있어 초기화 한답시고 매뉴를 잘못 눌러 부팅 디스크를 포멧 했네요.
덕분에 사용해보지도 않던 기능을 사용해 보았습니다.
Windows 10에서 tftp 서버 만들기
tftpd64.exe 검색하셔서 다운로드 받고, 바로 실행하시면 됩니다.
실행 자체가 tftp 서버의 설정이 되는 것이며, firmware 파일이 있는 폴더를 소스 폴더로 설정해 주세요.
IP 설정은 TFTP 서버 설정에 맞는 인터페이스를 선택해 주시면 됩니다.
업로드 할 펌웨어 파일명도 폴더에 있는 이름과 동일하게 설정이 필요합니다.
fortigate disk 날려먹기
FortiGate-100D (17:36-08.07.2014)
Ver:05000006
Serial number:FG100D3G000000000
RAM activation
CPU(00:000106ca bfebfbff): MP initialization
CPU(01:000106ca bfebfbff): MP initialization
CPU(02:000106ca bfebfbff): MP initialization
CPU(03:000106ca bfebfbff): MP initialization
Total RAM: 4096MB
Enabling cache...Done.
Scanning PCI bus...Done.
Allocating PCI resources...Done.
Enabling PCI resources...Done.
Zeroing IRQ settings...Done.
Verifying PIRQ tables...Done.
Boot up, boot device capacity: 15272MB.
Press any key to display configuration menu...
...
[C]: Configure TFTP parameters.
[R]: Review TFTP parameters.
[T]: Initiate TFTP firmware transfer.
[F]: Format boot device.
[B]: Boot with backup firmware and set as default.
[I]: System information.
[Q]: Quit menu and continue to boot.
[H]: Display this list of options.
Enter C,R,T,F,B,I,Q,or H: F
All data will be erased,continue:[Y/N]? Y
FortiGate-100D (17:36-08.07.2014)
Ver:05000006
Serial number:FG100D3G00000000
RAM activation
CPU(00:000106ca bfebfbff): MP initialization
CPU(01:000106ca bfebfbff): MP initialization
CPU(02:000106ca bfebfbff): MP initialization
CPU(03:000106ca bfebfbff): MP initialization
Total RAM: 4096MB
Enabling cache...Done.
Scanning PCI bus...Done.
Allocating PCI resources...Done.
Enabling PCI resources...Done.
Zeroing IRQ settings...Done.
Verifying PIRQ tables...Done.
Boot up, Initialize boot device failed.
TFTP 서버를 이용하여 펌웨어 복구(재설치) 하기
FortiGate-100D (17:36-08.07.2014)
Ver:05000006
Serial number:FG100D3G00000000
RAM activation
CPU(00:000106ca bfebfbff): MP initialization
CPU(01:000106ca bfebfbff): MP initialization
CPU(02:000106ca bfebfbff): MP initialization
CPU(03:000106ca bfebfbff): MP initialization
Total RAM: 4096MB
Enabling cache...Done.
Scanning PCI bus...Done.
Allocating PCI resources...Done.
Enabling PCI resources...Done.
Zeroing IRQ settings...Done.
Verifying PIRQ tables...Done.
Boot up, boot device capacity: 15272MB.
Press any key to display configuration menu...
.....
[C]: Configure TFTP parameters.
[R]: Review TFTP parameters.
[T]: Initiate TFTP firmware transfer.
[F]: Format boot device.
[B]: Boot with backup firmware and set as default.
[I]: System information.
[Q]: Quit menu and continue to boot.
[H]: Display this list of options.
Enter C,R,T,F,B,I,Q,or H: C
[P]: Set image download port.
[D]: Set DHCP mode.
[I]: Set local IP address.
[S]: Set local subnet mask.
[G]: Set local gateway.
[V]: Set local VLAN ID.
[T]: Set remote TFTP server IP address.
[F]: Set firmware image file name.
[E]: Reset TFTP parameters to factory defaults.
[R]: Review TFTP parameters.
[N]: Diagnose networking (ping).
[Q]: Quit this menu.
[H]: Display this list of options.
Enter P,D,I,S,G,V,T,F,E,R,N,Q or H: I
Enter local IP address [192.168.1.66]:192.168.0.18
Enter P,D,I,S,G,V,T,F,E,R,N,Q or H: S
Input local subnet mask [255.255.255.0]:
Enter P,D,I,S,G,V,T,F,E,R,N,Q or H: G
Enter local gateway IP address [192.168.1.254]:192.168.0.1
Enter P,D,I,S,G,V,T,F,E,R,N,Q or H: T
Enter remote TFTP server IP address [192.168.1.168]:192.168.0.54
Enter P,D,I,S,G,V,T,F,E,R,N,Q or H: F
Enter firmware file name [image.out]: 6.2.12-FGT_100D-v6-build1319-FORTINET.out
Enter P,D,I,S,G,V,T,F,E,R,N,Q or H: R
Image download port: MGMT
DHCP status: disabled
Local VLAN ID: none
Local IP address: 192.168.0.18
Local subnet mask: 255.255.255.0
Local gateway: 192.168.0.1
TFTP server IP address: 192.168.0.54
Firmware file name: 6.2.12-FGT_100D-v6-build1319-FORTINET.out
Enter P,D,I,S,G,V,T,F,E,R,N,Q or H: N
[1]: Ping remote TFTP server.
[2]: Ping gateway.
[3]: Ping specified IP address.
[Q]: Quite the menu.
[H]: Display the list of opinion.
Enter 1,2,3,Q or H: 1
Begin to send ICMP packets:
Press ESC to abort ping action.
Reply from 192.168.0.54: time=67ms ttl=128
Reply from 192.168.0.54: time=50ms ttl=128
Reply from 192.168.0.54: time=107ms ttl=128
Reply from 192.168.0.54: time=73ms ttl=128
Reply from 192.168.0.54: time=50ms ttl=128
Successfully receive 5 of out 5 packets from 192.168.0.54.
Enter 1,2,3,Q or H: Q
Enter P,D,I,S,G,V,T,F,E,R,N,Q or H: Q
[C]: Configure TFTP parameters.
[R]: Review TFTP parameters.
[T]: Initiate TFTP firmware transfer.
[F]: Format boot device.
[B]: Boot with backup firmware and set as default.
[I]: System information.
[Q]: Quit menu and continue to boot.
[H]: Display this list of options.
Enter C,R,T,F,B,I,Q,or H: T
Please connect TFTP server to Ethernet port "MGMT".
Initiating firmware TFTP Transfer...
MAC: 90:6C:AC:00:00:00
.#########################################################
Total 60581933 bytes data downloaded.
Verifying the integrity of the firmware image.
Total 262144kB unzipped.
Save as Default firmware/Backup firmware/Run image without saving:[D/B/R]? D
Programming the boot device now.
................................................................................................................................................................................................................................................................
Reading boot image 2721475 bytes.
Initializing firewall...
System is starting...
Resizing shared data partition...done
Formatting shared data partition ... done!
Starting system maintenance...
Scanning /dev/sdb1... (100%)
Scanning /dev/sdb3... (100%)
System storage='Internal' disk-usage changed, please 'execute disk format 255'.
Disk usage changed, please wait for reboot...
Formatting the disk...
- unmounting /data2 : ok
- unmounting /var/log : ok
Partitioning and formatting /dev/sda label LOGUSEDX2C5B29F6 ... done
The system is going down NOW !!
Please stand by while rebooting the system.
Restarting system.
FortiGate-100D (17:36-08.07.2014)
Ver:05000006
Serial number:FG100D3G00000000
RAM activation
CPU(00:000106ca bfebfbff): MP initialization
CPU(01:000106ca bfebfbff): MP initialization
CPU(02:000106ca bfebfbff): MP initialization
CPU(03:000106ca bfebfbff): MP initialization
Total RAM: 4096MB
Enabling cache...Done.
Scanning PCI bus...Done.
Allocating PCI resources...Done.
Enabling PCI resources...Done.
Zeroing IRQ settings...Done.
Verifying PIRQ tables...Done.
Boot up, boot device capacity: 15272MB.
Press any key to display configuration menu...
......
Reading boot image 2721475 bytes.
Initializing firewall...
System is starting...
FortiGate-100D login:
fortigate 초기 패스워드 재설정하기
기본 설정: admin
패스워드: 없음
FortiGate-100D login: admin
Password:
You are forced to change your password, please input a new password.
New Password:*****
Confirm Password:*****
Welcome!
FortiGate-100D #
#name
name: ap_login_success
# 로그는 탐지하는 타입
type: any
# logstash에서 설정한 log의 index 값
index: "logstash-ap*"
# 필터 grok 패턴 지정한 필드의 값에 같은 값이 들어올 경우
filter:
- query_string:
query: access_result:"successfully"
# document type
doc_type: _doc
# 알람 전송 매체 지정
alert:
- "slack"
# 알람 전송 옵션
slack:
# 슬랙 웹훅 주소
slack_webhook_url: "https://hooks.slack.com/services/---------------------------------------"
# 슬랙 채널에 메시지 전달할 이름
slack_username_override: "ElastAlert-Bot"
# 슬랙 메시지를 보낼 채널
slack_channel_override: "#security_alert"
# 슬랙 메시지에 타이틀 지정
# 지정하지 않을 경우 rule의 절대 경로 명이 찍힘: /opt/elastalert/ruls/ap_login_fail.yaml
slack_title: AP_LOGIN_SUCCESS
# 슬랙 메시지 색
slack_msg_color: "good"
# 슬랙에 전송할 메시지
# 슬랙에 전송할 메시지 중 배열 입력시 맨 아랫줄의 순서에 따라 숫자 입력
# 숫자 위치는 바뀌어도 됨
alert_text: "AP_LOGIN_SUCESS: {0} / 접속자:{1} / 접속자IP: {2}"
# 슬랙에 전송할 메시지 타입
alert_text_type: "alert_text_only"
# 슬랙에 전송할 메시지 중 탐지된 메시지에 대한 배열 입력
alert_text_args: ["ip_or_host", "user", "source_ip"]
룰 입력 후 저장을 누르면 아래와 같은 화면을 볼 수 있습니다.
웹페이지 상에서 룰을 생성할 경우, 서버에서도 마찬가지로 자동으로 생성됩니다.
[root@tmplogsvr rules]# pwd
/opt/elastalert/rules
[root@tmplogsvr rules]# ls -al
합계 16
drwxr-xr-x. 2 root root 4096 3월 16 18:08 .
drwxr-xr-x. 13 root root 4096 3월 16 18:09 ..
-rw-r--r--. 1 root root 574 3월 16 18:17 ap_login_fail.yaml
-rw-r--r--. 1 root root 1383 3월 16 18:17 ap_login_success.yaml
[root@tmplogsvr rules]#
[root@tmplogsvr rules]# cat ./ap_login_success.yaml
#name
name: ap_login_success
# 로그는 탐지하는 타입
type: any
# logstash에서 설정한 log의 index 값
index: "logstash-ap*"
# 필터 grok 패턴 지정한 필드의 값에 같은 값이 들어올 경우
filter:
- query_string:
query: access_result:"successfully"
doc_type: _doc
# 알람 전송 매체 지정
alert:
- "slack"
# 알람 전송 옵션
slack:
# 슬랙 웹훅 주소
slack_webhook_url: "https://hooks.slack.com/services/---------------------------------"
# 슬랙 채널에 메시지 전달할 이름
slack_username_override: "ElastAlert-Bot"
# 슬랙 메시지를 보낼 채널
slack_channel_override: "#security_alert"
# 슬랙 메시지에 타이틀 지정
# 지정하지 않을 경우 rule의 절대 경로 명이 찍힘: /opt/elastalert/ruls/ap_login_fail.yaml
slack_title: AP_LOGIN_SUCCESS
# 슬랙 메시지 색
slack_msg_color: "good"
# 슬랙에 전송할 메시지
# 슬랙에 전송할 메시지 중 배열 입력시 맨 아랫줄의 순서에 따라 숫자 입력
# 숫자 위치는 바뀌어도 됨
alert_text: "AP_LOGIN_SUCESS: {0} / 접속자:{1} / 접속자IP: {2}"
# 슬랙에 전송할 메시지 타입
alert_text_type: "alert_text_only"
# 슬랙에 전송할 메시지 중 탐지된 메시지에 대한 배열 입력
alert_text_args: ["ip_or_host", "user", "source_ip"]
[root@tmplogsvr rules]#
kibana 웹페이지에서 elastalert을 사용하기 위해서는 실행방법이 기존과는 다릅니다.
bitsensor 버전의 elastalert은 기본 경로가 /opt/elastalert 입니다.
해당 위치에서 npm의 설정들을 진행하였기에 아래 화면을 따르면 됩니다.
[root@tmplogsvr elastalert]# pwd
/opt/elastalert
방법 1. 프로세스가 끊기지 않고 지속적으로 로그를 확인하고 싶을 때
[root@tmplogsvr elastalert]# npm start <- 이렇게 실행할 경우 프로세스가 끊기지 않고 계속적으로 로그가 보일 것입니다.
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
02:12:53.493Z INFO elastalert-server: Config: No config.dev.json file was found in /opt/elastalert/config/config.dev.json.
02:12:53.494Z INFO elastalert-server: Config: Proceeding to look for normal config file.
02:12:53.494Z INFO elastalert-server: Config: A config file was found in /opt/elastalert/config/config.json. Using that config.
02:12:53.500Z INFO elastalert-server: Router: Listening for GET request on /.
02:12:53.500Z INFO elastalert-server: Router: Listening for GET request on /status.
02:12:53.500Z INFO elastalert-server: Router: Listening for GET request on /status/control/:action.
02:12:53.500Z INFO elastalert-server: Router: Listening for GET request on /status/errors.
02:12:53.500Z INFO elastalert-server: Router: Listening for GET request on /rules.
02:12:53.501Z INFO elastalert-server: Router: Listening for GET request on /rules/:id.
02:12:53.501Z INFO elastalert-server: Router: Listening for POST request on /rules/:id.
02:12:53.501Z INFO elastalert-server: Router: Listening for DELETE request on /rules/:id.
02:12:53.501Z INFO elastalert-server: Router: Listening for GET request on /templates.
02:12:53.501Z INFO elastalert-server: Router: Listening for GET request on /templates/:id.
02:12:53.501Z INFO elastalert-server: Router: Listening for POST request on /templates/:id.
02:12:53.501Z INFO elastalert-server: Router: Listening for DELETE request on /templates/:id.
02:12:53.501Z INFO elastalert-server: Router: Listening for POST request on /test.
02:12:53.501Z INFO elastalert-server: Router: Listening for GET request on /config.
02:12:53.501Z INFO elastalert-server: Router: Listening for POST request on /config.
02:12:53.501Z INFO elastalert-server: Router: Listening for POST request on /download.
02:12:53.502Z INFO elastalert-server: Router: Listening for GET request on /metadata/:type.
02:12:53.502Z INFO elastalert-server: Router: Listening for GET request on /mapping/:index.
02:12:53.502Z INFO elastalert-server: Router: Listening for POST request on /search/:index.
02:12:53.504Z INFO elastalert-server: ProcessController: Starting ElastAlert
02:12:53.504Z INFO elastalert-server: ProcessController: Creating index
02:12:53.697Z INFO elastalert-server:
ProcessController: Elastic Version: 8.6.2
Reading Elastic 6 index mappings:
Reading index mapping 'es_mappings/6/silence.json'
Reading index mapping 'es_mappings/6/elastalert_status.json'
Reading index mapping 'es_mappings/6/elastalert.json'
Reading index mapping 'es_mappings/6/past_elastalert.json'
Reading index mapping 'es_mappings/6/elastalert_error.json'
Index elastalert_status already exists. Skipping index creation.
02:12:53.697Z INFO elastalert-server: ProcessController: Index create exited with code 0
02:12:53.698Z INFO elastalert-server: ProcessController: Starting elastalert with arguments [none]
02:12:53.701Z INFO elastalert-server: ProcessController: Started Elastalert (PID: 107223)
02:12:53.702Z INFO elastalert-server: Server: Server listening on port 3030
02:12:53.702Z INFO elastalert-server: Server: Websocket listening on port 3333
02:12:53.703Z INFO elastalert-server: Server: Server started
방법2: 실행 후 백그라운드로 실행하기 (터미널을 끊어도 프로세스가 살아 있습니다.)
[root@tmplogsvr elastalert]# npm start &
[1] 107293
[root@tmplogsvr elastalert]#
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
02:17:42.163Z INFO elastalert-server: Config: No config.dev.json file was found in /opt/elastalert/config/config.dev.json.
02:17:42.164Z INFO elastalert-server: Config: Proceeding to look for normal config file.
02:17:42.164Z INFO elastalert-server: Config: A config file was found in /opt/elastalert/config/config.json. Using that config.
02:17:42.170Z INFO elastalert-server: Router: Listening for GET request on /.
02:17:42.170Z INFO elastalert-server: Router: Listening for GET request on /status.
02:17:42.170Z INFO elastalert-server: Router: Listening for GET request on /status/control/:action.
02:17:42.170Z INFO elastalert-server: Router: Listening for GET request on /status/errors.
02:17:42.170Z INFO elastalert-server: Router: Listening for GET request on /rules.
02:17:42.171Z INFO elastalert-server: Router: Listening for GET request on /rules/:id.
02:17:42.171Z INFO elastalert-server: Router: Listening for POST request on /rules/:id.
02:17:42.172Z INFO elastalert-server: Router: Listening for DELETE request on /rules/:id.
02:17:42.172Z INFO elastalert-server: Router: Listening for GET request on /templates.
02:17:42.172Z INFO elastalert-server: Router: Listening for GET request on /templates/:id.
02:17:42.172Z INFO elastalert-server: Router: Listening for POST request on /templates/:id.
02:17:42.172Z INFO elastalert-server: Router: Listening for DELETE request on /templates/:id.
02:17:42.172Z INFO elastalert-server: Router: Listening for POST request on /test.
02:17:42.172Z INFO elastalert-server: Router: Listening for GET request on /config.
02:17:42.172Z INFO elastalert-server: Router: Listening for POST request on /config.
02:17:42.172Z INFO elastalert-server: Router: Listening for POST request on /download.
02:17:42.172Z INFO elastalert-server: Router: Listening for GET request on /metadata/:type.
02:17:42.172Z INFO elastalert-server: Router: Listening for GET request on /mapping/:index.
02:17:42.172Z INFO elastalert-server: Router: Listening for POST request on /search/:index.
02:17:42.174Z INFO elastalert-server: ProcessController: Starting ElastAlert
02:17:42.174Z INFO elastalert-server: ProcessController: Creating index
02:17:42.366Z INFO elastalert-server:
ProcessController: Elastic Version: 8.6.2
Reading Elastic 6 index mappings:
Reading index mapping 'es_mappings/6/silence.json'
Reading index mapping 'es_mappings/6/elastalert_status.json'
Reading index mapping 'es_mappings/6/elastalert.json'
Reading index mapping 'es_mappings/6/past_elastalert.json'
Reading index mapping 'es_mappings/6/elastalert_error.json'
Index elastalert_status already exists. Skipping index creation.
02:17:42.366Z INFO elastalert-server: ProcessController: Index create exited with code 0
02:17:42.367Z INFO elastalert-server: ProcessController: Starting elastalert with arguments [none]
02:17:42.370Z INFO elastalert-server: ProcessController: Started Elastalert (PID: 107325)
02:17:42.371Z INFO elastalert-server: Server: Server listening on port 3030
02:17:42.371Z INFO elastalert-server: Server: Websocket listening on port 3333
02:17:42.371Z INFO elastalert-server: Server: Server started
[root@tmplogsvr elastalert]#
실행 시킨 터미널 창을 닫은 후 아래와 같이 프로세스를 검색하시면 작동 여부를 알 수 있습니다.
