C2 server installation

In short

1. extract c2servers.tgz on your C2 server.
2. Run the installer for your C2 servers with parameters, i.e. install-c2server.sh $FilebeatID $ScenarioName $IP/DNS:PORT

In detail

Copy and extract c2servers.tgz on your C2 server as part of your red team infra deployment procedures. Run the installer for your C2 server, i.e.: install-c2server.sh $FilebeatID $ScenarioName $IP/DNS:PORT

• $FilebeatID is the identifier of this teamserver within filebeat.
• $ScenarioName is the name of the attack scenario this teamserver is used for.
• $IP/DNS:PORT is the IP or DNS name and port where filebeat logs are shipped to, this would be the IP/DNS of your RedELK server. Even if you use the default port (TCP/5044) you need to provide this as a parameter.

See Naming requirements for detailed info on naming requirements.

This script will warn if filebeat is already installed (important as ELK and filebeat sometimes are very picky about having equal versions), install required certificates, adjust the filebeat configuration, start filebeat, create a local user 'scponly' and limit that user to SSH key-based auth via scp/sftp/rsync.

Debugging

Having issues? Check the following:

• The installer output in redelk-install.log.
• Filebeat errors in its log file (/var/log/filebeat or filebeat mentioned in /var/log/syslog depending on your Linux flavour used). You want to make sure it is tracking the right log files. And you want to make sure it can connect to the RedELK server. If no connection is established, this is often due to firewall issues or due to incorrect SSL parameters given in the certs/config.cfg file.
• Check for issues in the background scripts in /var/log/redelk/*.