Installing the Realeyes IDS
from Source Code

II. Building and installing the packages

1. All packages:

   Login as the system superuser and extract each package with the command:

   tar xzf package_name

   NOTE: The RealeyesAE and RealeyesIDS packages must be extracted in the same directory.

   Each package comes with the initialization file, Realeyes.ini, where directories and other information is defined for the installation. This file should be edited to conform to the distribution's and site's standards.

   All initialization files all the same, so a master copy can be created and copied as needed. In fact, if multiple packages are installed on the same host, a single copy of the Realeyes.ini is saved to be used with the deinstallation script

   The initialization file is divided into sections to make it easier to identify the changes that are necessary for a particular installation. The sections and their uses are:

   • SYSTEM DIRECTORIES: These define the standard directory structure of the distribution. The Realeyes application has been successfully installed on Debian (and *buntu) and Fedora without modification to these settings.
   • SYSTEM COMMANDS and CONFIGURATION FILES: These define specific configuration and command locations. Each value should be checked for its correctness. Of special interest:
     KEYTOOL: This is a Java command used to create a list of valid SSL keys and certificates and is only used by the RealeyesDBD package installation.

   • POSTGRES DIRECTORIES and INFORMATION: These define the information for the PostgreSQL installation and is the least likely to be valid for any distribution not based on Debian.
   • REALEYES DIRECTORIES and INFORMATION: These define the directories and user information to be used by the Realeyes applications. Changes are determined by site standards.

2. Realeyes DB:
   • Start the PostgreSQL database: It is expected that PostgreSQL is installed with an init script in the system init script directory, and starting the database is performed by running this script with the 'start' parameter.
   • Change to the RealeyesDB directory created by extracting the package and run the install script:
     ./db_install.sh

     This will install scripts and documentation in the directories defined in the Realeyes.ini file, and the automatically start the configuration scripts, which are described below.

3. Realeyes GUI:

   There are three installation methods which all install the same Realeyes directories and files. However, the two GUI installers will also download required files, if desired.

   • Shell script installation for Linux:
     • Change to the RealeyesGUI directory created by extracting the package and run the install script:
       ./gui_install.sh

       This will install programs and documentation in the directories defined in the Realeyes.ini file.

     • The installation script will prompt for the location of the JDBC and SWT archives files listed in the pre-installation section. If all files are in the same directory, then that directory may be entered and all files will be copied to the appropriate location. Otherwise, the path and filename must be supplied for each file.
     • When the installation is complete, a script to start the user interface, realeyesgui, is in the system bin directory defined in the Realeyes.ini file. The configuration procedure is described below.

   • Graphical installer for Windows XP:
     • Install the program using the installation wizard:
       RealeyesGUI-0.9.2-Setup.exe

     • The installer will accept the pre-downloaded PostgreSQL JDBC and/or SWT archive files or download them during the installation. Because the SWT archive file is approximately 40 Megabytes, this makes the installation much quicker if it is to be performed on multiple systems, and if the target hosts have access to a file server, they can be kept there.
     • When the installation is complete, the user interface can be started from the programs menu. If a desktop icon is desired, create it from the menu.

4. Realeyes DBD:
   • Change to the RealeyesDBD directory created by extracting the package and run the install script:
     ./dbd_install.sh

     This will install programs and documentation in the directories defined in the Realeyes.ini file, and the automatically start the configuration scripts, which are described below.

   • The installation script will prompt for the location of the JDBC and XML files listed in the pre-installation section. If all files are in the same directory, then that directory may be entered and all files will be copied to the appropriate location. Otherwise, the path and filename must be supplied for each file.
5. Realeyes IDS:
   • Change to the RealeyesAE directory created by extracting the package and build the analysis engine libraries:
     ./configure
     make
     

   • Change to the RealeyesIDS directory created by extracting the package and build and install the IDS application:
     ./configure
     make
     ./ids_install.sh

   • The 'ids_install.sh' command installs the application files and documentation in the directories defined in the Realeyes.ini file, and automatically starts the configuration scripts, which are described below.

III. Configuring the Realeyes packages

1. Realeyes DB:
   To configure the database, the following command is executed:
   realeyes_db_config

   There are explanations of what to expect, and many prompts have a preset default, which is selected by pressing Enter.

   Several user IDs and passwords are set in this script. If each user ID is given a unique password, be sure to keep track of them.

   The Realeyes user management feature provides administrators the status of users logged into the database. Full functionality of this feature allows administrators to logout users from the user interface. This is provided by database extension functions. Otherwise, users can only be logged out by the DBA from the database host, using the process ID of sessions, which are displayed along with the user IDs.

   When the database configuration is complete, it can be tested by logging in to the DBA ID, running the psql program to interact with the database, and displaying Realeyes tables. Note that the configuration defines the alias "redb" to simplify starting the psql program using the realeyesDB database schema.

   su - redba
   redb
   (Enter DBA database password)
   select * from users;
   select * from roles;
   \q
   exit
   

2. Realeyes GUI:
   There is no configuration script for the user interface. However, some initial configuration using the user interface needs to be done before the DBD can be started. The database must be configured and running for the login to be successful.

   To start the user interface on Linux, the following command is executed:

   realeyesgui

   To start the user interface on Microsoft Windows, select the application from the Start -> Programs menu.

   The login window will be displayed and all of the fields must be filled in:

   • Username: readmin or site substitute
   • Password: created during the database configuration
   • Server: the hostname of the machine running the database
   • Database: realeyesdb

   If successfully logged in, all fields except the password can be set from the menu selection Edit -> Preferences.

   The initial information that must be defined, in the order that it must be defined is found in the following menu selections:

   • Admin -> Tables -> Points of Contact
   • Admin -> Tables -> Sites
   • Admin -> Tables -> Hosts

   When the Save button is clicked for any entry, the information is immediately saved in the database and available for use. However, windows that build popup menus of selections from database information do not have these automatically refreshed, so each of the above should be opened after the previous one has been completed.

3. Realeyes DBD:
   To configure the DBD, the following command is executed:
   realeyes_dbd_config

   There are explanations of what to expect, and many prompts have a preset default, which is selected by pressing Enter.

   Note that some selections must be coordinated with the database configuration and others with the IDS configuration.

   In particular, ports may be configured for both connections, but note that if the IDS data and control ports are changed, it affects all IDS sensors.

   Encryption between the DBD and the IDS is unnecessary if both are on the same host. Otherwise, it is strongly recommended. The private key and certificate is generated on the DBD and copied to each IDS sensor host during that configuration.

4. Realeyes IDS:
   To configure the IDS, the following command is executed:
   realeyes_ids_config

   There are explanations of what to expect, and many prompts have a preset default, which is selected by pressing Enter.

   Note that some selections must be coordinated with the DBD. Especially note that if the data and control ports are changed from the default, all IDS sensors must use the new values.

   The memory allocation value is a percentage. Therefore, if there is 1G of memory installed, the 33% default will allocate 333M of memory for the IDS. If the IDS is the only application running on the host, this value can be as high as 90%. The following general rules may be applied:

   • IDS only installed: Leave at least 64M for other processes
   • DBD and/or database installed: Use about 50% of the installed memory
   • All four Realeyes packages installed: Use about 33% of the installed memory

5. To start each component, use the following commands:
   • Database: /etc/init.d/postgresql_script start

     NOTE: This must be running for either RealeyesDBD or RealeyesGUI to start successfully

   • Realeyes IDS: /etc/init.d/realeyes_ids start

     NOTE: It has been observed that the first (and possibly second) time the IDS is started, the operating system fails to initialize shared memory. Once it starts working, the problem is not seen again, even after reboots.

   • Realeyes DBD: /etc/init.d/realeyes_dbd start

   • Realeyes GUI:
     • Linux: realeyesgui
     • Windows: Find the Realeyes application in the Start -> Programs menu and double click on it
6. Sample rules
   To test the installation, download the sample rules package. Extract it with the command:
   tar xzf package

   Follow the instructions in the README file.

IV. Deinstallation

Although it is technically allowable to run the script from a directory that it will remove, it is advisable to copy the deinstallation script and the Realeyes.ini file to a temporary location and execute them from there.

To deinstall a package, change to the directory where the script and the Realeyes.ini file are located and run the script:

pkg_deinstall.sh

If the script and Realeyes.ini file were copied to a temporary location, they may be deleted on successful completion of the deinstallation.