mirror of
https://github.com/dbarzin/pandora-box.git
synced 2025-07-18 21:09:41 +02:00
198 lines
4.1 KiB
Markdown
198 lines
4.1 KiB
Markdown
Pandora-BOX
|
|
============
|
|
|
|
Host
|
|
----
|
|
|
|
CORE i5 - **16G** RAM - 30G disk
|
|
|
|
Installation
|
|
------------
|
|
|
|
Install **[Ubuntu 24.04.1 server LTS](https://ubuntu.com/download/server)**
|
|
|
|
during the installation, select (x) Ubuntu Server (minimized)
|
|
|
|
Choose to "install OpenSSH server"
|
|
|
|
That's all, no other packages needed
|
|
|
|
After reboot, login and type :
|
|
|
|
sudo apt install -y git
|
|
git clone https://github.com/dbarzin/pandora-box
|
|
cd pandora-box
|
|
sudo ./install.sh
|
|
|
|
## Firewall
|
|
|
|
Pandora-box needs web access to these websites :
|
|
|
|
- Ubuntu repositories
|
|
- github.com
|
|
- pypi.org
|
|
- install.python-poetry.org
|
|
- clamav.net
|
|
- database.clamav.net
|
|
- download.comodo.com
|
|
- hashlookup.circl.lu
|
|
|
|
## Configuration
|
|
|
|
Copy the sample configuration file to _pandora-box.ini_
|
|
|
|
cp pandora-box.ini.ubuntu pandora-box.ini
|
|
|
|
You can configure Pandora-box in the _pandora-box.ini_ file :
|
|
|
|
[DEFAULT]
|
|
; Curses mode (full text)
|
|
CURSES = False
|
|
|
|
; Set USB_AUTO_MOUNT to true is if the OS automaticaly mount USB keys
|
|
USB_AUTO_MOUNT = False
|
|
|
|
; Set PANDORA_ROOT_URL to the URL of the Pandora server
|
|
; the default value is "http://127.0.0.1:6100"
|
|
PANDORA_ROOT_URL = http://127.0.0.1:6100
|
|
|
|
; Set FAKE_SCAN to true to fake the scan process (used during developement only)
|
|
FAKE_SCAN = False
|
|
|
|
; Set to true to copy infected files to the quarantine folder
|
|
; in the USB scanning station
|
|
QUARANTINE = True
|
|
|
|
; Set quarantine folder
|
|
QUARANTINE_FOLDER = /var/quarantine
|
|
|
|
; Number of threads
|
|
THREADS = 24
|
|
|
|
## Logging
|
|
|
|
Copy the rsyslog config file :
|
|
|
|
sudo cp rsyslog.conf/pandora-box.conf to /etc/rsyslog.d
|
|
|
|
Add the following line if you are using UDP, where 192.168.12.123 is the IP address of the remote server, you will be writing your logs to:
|
|
|
|
$ModLoad imfile
|
|
$InputFileName /var/log/pandora-box.log
|
|
$InputFileTag pandora-box:
|
|
$InputFileStateFile stat-pandora-box-info
|
|
$InputFileFacility local7
|
|
$InputFileSeverity info
|
|
$InputRunFileMonitor
|
|
local7.info @@192.168.12.123:514
|
|
|
|
Save your changes and restart the rsyslog service with the command:
|
|
|
|
sudo systemctl restart rsyslog
|
|
|
|
Ref: https://www.rsyslog.com/doc/v5-stable/configuration/modules/imfile.html
|
|
|
|
|
|
## Timezone
|
|
|
|
Set the correct Timezone
|
|
|
|
sudo timedatectl set-timezone Europe/Paris
|
|
|
|
|
|
## NTP
|
|
|
|
To configure NTP, edit this file :
|
|
|
|
sudo vi /etc/systemd/timesyncd.conf
|
|
|
|
Add this line
|
|
|
|
NTP=<<NTP_SERVER_IP>>
|
|
|
|
## Send log to rsyslog
|
|
|
|
Copy the rsyslogd configuration file
|
|
|
|
sudo cp ./pandora-box/rsyslog.d/pandora-box.conf /etc/rsyslog.d/
|
|
|
|
Edit the rsyslogd file
|
|
|
|
sudo vi /etc/rsyslog.d/pandora-box.conf
|
|
|
|
Change the IP Address :
|
|
|
|
local7.info @@<<SYSLOG_SERVER_IP>>:514
|
|
|
|
## Automatic shutdown
|
|
|
|
Edit crontab file
|
|
|
|
sudo crontab -e
|
|
|
|
Add an automatic shutdown command at 8:00 p.m.
|
|
|
|
0 20 * * * shutdown -h
|
|
|
|
# Update
|
|
|
|
Update the operating system
|
|
|
|
sudo apt update && sudo apt upgrade
|
|
|
|
Update Pandora
|
|
|
|
cd pandora && poetry run update --yes
|
|
|
|
Update Pandra-box
|
|
|
|
cd pandora-box && git pull
|
|
|
|
# Troubleshooting
|
|
|
|
Check Pandora listening on port 6100
|
|
|
|
sudo lsof -i -P -n | grep LISTEN
|
|
|
|
Result should contains
|
|
|
|
...
|
|
gunicorn: 1034 pandora 5u IPv4 27043 0t0 TCP *:6100 (LISTEN)
|
|
...
|
|
|
|
Access the Pandora Web interface in HTTP port 6100 and submit some test files.
|
|
|
|
poetry: command not found
|
|
|
|
export PATH="$HOME/.local/bin:{$PATH}"
|
|
|
|
Submit a file to Pandora with the command line
|
|
|
|
cd pandora
|
|
poetry run pandora --url http://127.0.0.1:6100 -f <<file_name>>
|
|
...
|
|
poetry run pandora --url http://127.0.0.1:6100 --task_id ... --seed ...
|
|
|
|
Submit anti malware testfile to Pandora
|
|
|
|
cd pandora
|
|
wget https://secure.eicar.org/eicar.com.txt
|
|
poetry run pandora --url http://127.0.0.1:6100 -f eicar.com.txt
|
|
...
|
|
poetry run pandora --url http://127.0.0.1:6100 --task_id ... --seed ...
|
|
|
|
Look a the Pandora logs files
|
|
|
|
tail -500f /var/log/pandora_message.log
|
|
tail -500f /var/log/pandora_error.log
|
|
|
|
Look a the Pandora-box logs files
|
|
|
|
tail -500f /var/log/pandora-box.log
|
|
|
|
Clean pending jobs
|
|
|
|
cd ~/pandora
|
|
poetry run stop
|
|
rm cache/dump.rdb
|
|
poetry run start
|