Install Zeek packages on FreeBSD
The following technical prerequisites have to be in place to be able to implement what is described in this post:
Install the Zeek Package Manager
$ sudo pkg install python37
And we make a link:
$ sudo ln -s /usr/local/bin/python3.7 /usr/local/bin/python
- make a link for
$ sudo pkg install git $ sudo pkg install py37-pip $ sudo ln -s /usr/local/bin/pip-3.7 /usr/local/bin/pip
Now we are ready to install the Zeek Package Manager and we install this using the
root user (!):
$ sudo -i # cd /root # pip install zkg --user # .local/bin/zkg autoconfig # ln -s /root/.local/bin/zkg /usr/local/bin/zkg
Install Zeek Packages
For this post we install two Zeek Packages:
Both packages create fingerprints of encrypted traffic which I find very usefull. More details on both can be found in the links provided above.
The following commands are used to install these packages:
$ sudo -i # zkg install zeek/salesforce/ja3 # zkg install zeek/salesforce/hassh
Enable the packages in Zeek
So we’ve installed the Zeek Packages we want. Now we have to enable them. We do this by adding one line of text to
/usr/local/share/zeek/site/local.zeek configuration file:
$ sudo tee -a /usr/local/share/zeek/site/local.zeek > /dev/null <<EOT ? @load packages ? EOT
This one line enables all the packages we install, now or later. So we have to do this only once. Because we have changed the Zeek configuration we have to deploy it:
$ sudo service zeek stop $ sudo service zeek deploy
Check if all ok
The ja3 package add 2 fields to the
ssl.log log file called ja3 and ja3s. And the hassh adds the following fields to the
ssh.log log file: hasshVersion, hassh, hasshServer and hasshAlgorithms.
If you see these fields in both log files the installation of both Zeek Packages succeeded!
The functionality which these packages add to Zeek is simply amazing! But that is left to the reader or maybe I’ll write more about these in the future. This post was meant to just explain how to install and enable Zeek Packages and that has been shown!
This is the fourth blog post in a series of posts about Zeek on FreeBSD. At the moment Zeek monitors only 1 network interface. In the next blog post of this series we increase the number of network interfaces for Zeek to monitor.
Some (other) resources about this subject: