Inter-Bro Communications
Using built in functionality, it is possible to have multiple bro
instances exchange event information with one another and to allow for
non-bro clients to interact with the system as well. Some of this
is described elsewhere. Here we will describe how to configure
cross bro communication both in terms of clear text and ssl
communication.
The basic functionality is controlled by the policy files remote.bro,
listen-clear.bro and listen-ssl.bro. It is possible (and
recommended) not to change these files, but to use created policy files
to maintain a local configuration. It is important to realize that the
design of the protocol is not strictly assumed to be in the traditional
client-server model. While this is the most familiar design
pattern typically used, it is not necessary in that each side can act
as both server and client.
The role of each of the before mentioned files is as follows:
remote.bro:
This file is the primary configuration mechanism and is used to define
which bros the current instance should connect to and which events
should be asked for or allowed to be shared. It also holds the
definition of which ports should be used for ssl and clear text
communications. These are defined in:
redef
Remote::destinations += {
["host_10"] = [$host = 10.10.10.10, $events = /.*/, $connect=T, $retry
= 10 secs, $ssl=T],
};
const default_port_ssl =
47756/tcp &redef;
const default_port_clear =
47757/tcp &redef;
The fields described in the destinations section are as follows:
host: the host that will be
connected to, or will be connecting from depending on the 'connect'
flag.
events: a regular expression
defining the types of events that will be exchanged.
connect: a directional flag,
indicating if you will be connecting to an external host and requesting
events ("T"), or that you expect to recieve requests ("F").
retry: the delay between
reconnection attempts if the connection is broken.
ssl: flag for decifding if ssl
should be used or not. See below for setting up ssl options.
In general the side connecting to and asking for events will be
configured with this, while the listening side of the conversation not
filter outgoing events. If the environmental requirements support
the need to filter on the receving end, that it can be done but
determining configuration errors is made more complicated.
listen-ssl.bro:
This file contains information used for authentication and encryption
for an ssl enabled connection. It is highly suggested that this
mechanism be used in any non-test system since the placement of
non-authenticated nodes within the fabric could cause significant
problems both in terms of stability and intergity of the overall
mechanism. The location of the bro instance and CA public
certificates is defined in bro.init via empty placeholders, but needs
to be set up in the local policy before it can be used. If the
host that is runing the bro instance already has a properly installed
and configured Broccoli library, you may just want to use those
cretificates unless local policy. The most significant things
that need configuring are:
redef
ssl_ca_certificate = "/bro/etc/ca_cert.pem";
redef ssl_private_key = "/bro/etc/bro.pem";
redef ssl_passphrase = "my d0g has Fl33z";
The ssl passphrase need not be entered here, but you will have to be
around to type it in on bro restart if you do not.
listen-clear.bro:
There is not much to configure from here, except the IP address that
the listening socket is bound to, which is defined in:
const
listen_if_clear = 0.0.0.0 &redef;
Sample Configuration 1:
Here is an example used for connecting Broccoli instrumented sshd
servers to a centeral collector. The Broccoli needs to be
appropriatly configured - see Christian's page for details on the sshd
side, and the bro ought to be configured like:
#
To prevent requesting sshd events from any peering Bro that connects,
# here is a list of our sshds.
List the IP addresses of the hosts your
# sshds are running on here:
#
redef Remote::destinations += {
["sshd1"] = [$host = 10.11.12.13, $events = /sensor_sshd.*/,
$connect=F, $ssl=T],
};
If the ssl/clear text port is on a non-standard number, it can be
changed via default_port_ssl or default_port_clear .
Inter-Bro Communication 0.1