MISP项目在FreeBSD 12.0-amd64系统上的安装指南

2025-07-07 08:30:36作者：冯梦姬Eddie

前言

MISP（Malware Information Sharing Platform）是一个开源的威胁情报平台，用于收集、存储、分发和共享网络安全威胁指标。本文将详细介绍如何在FreeBSD 12.0-amd64系统上安装和配置MISP平台。

系统准备

1. 最小化安装FreeBSD

首先需要安装一个最小化的FreeBSD 12.0-amd64系统，安装时选择以下组件：

sshd服务
ntpdate和ntpd时间服务
ports系统

2. 系统加固

安装完成后，建议进行以下安全加固：

清理/tmp目录
禁用Syslogd网络套接字
禁用Sendmail服务

3. 安装基础工具

# 更新pkg包管理器
su -
pkg

安装必要的基础工具：

pkg install -y sudo bash

注意：确保wheel组的用户可以使用sudo，取消/usr/local/etc/sudoers文件中以下行的注释：

%wheel ALL=(ALL) ALL

4. 创建MISP专用用户（可选但推荐）

pw user add misp -s /usr/local/bin/bash -G wheel,www,staff
mkdir /home/misp
chown misp:misp /home/misp
passwd misp

系统更新与配置

1. 更新系统

freebsd-update fetch install

2. 更新ports树

portsnap fetch extract
# 或者更新现有ports树
portsnap fetch update

3. 设置Python3为默认版本（可选）

echo "DEFAULT_VERSIONS= python=3.6 python2=2.7 python3=3.6" >> /etc/make.conf
ln -s /usr/local/bin/python3 /usr/local/bin/python

安装FAMP栈

1. 安装依赖包

pkg install -y curl git python3 vim m4 help2man gmake automake libtool expect gsed

2. 安装Apache、MariaDB和PHP

pkg install -y apache24 \
    logrotate \
    gnupg \
    mariadb102-server mariadb102-client \
    php72 \
    php72-mysqli \
    php72-xml \
    php72-openssl \
    php72-pcntl \
    php72-mbstring \
    php72-pdo_mysql \
    php72-phar \
    php72-json \
    php72-filter \
    php72-fileinfo \
    php72-dom \
    php72-opcache \
    php72-session \
    mod_php72

3. 配置PHP

cp -p /usr/local/etc/php.ini-development /usr/local/etc/php.ini

4. 启动服务

sysrc apache24_enable="yes"
sysrc mysql_enable="yes"
sysrc mysql_args="--bind-address=127.0.0.1"
service apache24 start
service mysql-server start

5. 安全配置MariaDB

# 使用expect自动完成MySQL安全配置
expect -f - <<-EOF
  set timeout 10
  spawn mysql_secure_installation
  expect "*?assword*"
  send -- "\r"
  expect "Enter current password for root (enter for none):"
  send -- "\r"
  expect "Set root password?"
  send -- "y\r"
  expect "New password:"
  send -- "${DBPASSWORD_ADMIN}\r"
  expect "Re-enter new password:"
  send -- "${DBPASSWORD_ADMIN}\r"
  expect "Remove anonymous users?"
  send -- "y\r"
  expect "Disallow root login remotely?"
  send -- "y\r"
  expect "Remove test database and access to it?"
  send -- "y\r"
  expect "Reload privilege tables now?"
  send -- "y\r"
  expect eof
EOF

安装Redis

Redis需要通过ports系统安装：

cd /usr/ports/databases/redis
make install clean
sysrc redis_enable="yes"

安装PHP Redis扩展：

cd /usr/ports/databases/pecl-redis
make install clean

安装MISP核心

1. 下载MISP代码

mkdir /usr/local/www/MISP
chown www:www /usr/local/www/MISP
cd /usr/local/www/MISP
sudo -u www git clone https://github.com/MISP/MISP.git .

2. 配置Git

sudo -u www git config core.filemode false
sudo -u www git submodule update --init --recursive
sudo -u www git submodule foreach --recursive git config core.filemode false

3. 安装Python依赖

pkg install -y py36-pip libxml2 libxslt
pip-3.6 install virtualenv
sudo -u www virtualenv -p python3 /usr/local/www/MISP/venv

4. 安装STIX相关库

cd /usr/local/www/MISP/app/files/scripts
sudo -u www git clone https://github.com/CybOXProject/python-cybox.git
sudo -u www git clone https://github.com/STIXProject/python-stix.git
sudo -u www git clone https://github.com/MAECProject/python-maec.git
sudo -u www git clone https://github.com/CybOXProject/mixbox.git

5. 安装PyMISP

cd /usr/local/www/MISP/PyMISP
sudo -H -u www /usr/local/www/MISP/venv/bin/pip install .

配置CakePHP

cd /usr/local/www/MISP/app
sudo -u www php composer.phar install --no-dev
sudo -u www cp -fa /usr/local/www/MISP/INSTALL/setup/config.php /usr/local/www/MISP/app/Plugin/CakeResque/Config/config.php

设置文件权限

chown -R www:www /usr/local/www/MISP
chmod -R 750 /usr/local/www/MISP
chmod -R g+ws /usr/local/www/MISP/app/tmp
chmod -R g+ws /usr/local/www/MISP/app/files
chmod -R g+ws /usr/local/www/MISP/app/files/scripts/tmp

数据库配置

1. 创建MISP数据库

mysql -u root -p

在MySQL提示符下执行：

create database misp;
grant usage on *.* to misp@localhost identified by 'yourpassword';
grant all privileges on misp.* to misp@localhost;
flush privileges;
exit

2. 导入MISP数据库结构

sudo -u www cat /usr/local/www/MISP/INSTALL/MYSQL.sql | mysql -u misp -p misp

Apache配置

1. 创建SSL证书

mkdir /etc/ssl/private/
openssl req -newkey rsa:4096 -days 365 -nodes -x509 \
-subj "/C=XX/ST=State/L=City/O=Org/OU=Unit/CN=misp.local/emailAddress=admin@misp.local" \
-keyout /etc/ssl/private/misp.local.key -out /etc/ssl/private/misp.local.crt

2. 配置Apache虚拟主机

mkdir /usr/local/etc/apache24/sites-available/
cp /usr/local/www/MISP/INSTALL/apache.24.misp.ssl /usr/local/etc/apache24/sites-available/misp-ssl.conf

修改配置文件中的路径和域名，然后启用站点：

cd /usr/local/etc/apache24/sites-enabled/
ln -s ../sites-available/misp-ssl.conf
echo "Include etc/apache24/sites-enabled/*.conf" >> /usr/local/etc/apache24/httpd.conf

3. 重启Apache

service apache24 restart

日志轮转配置

cp /usr/local/www/MISP/INSTALL/misp.logrotate /usr/local/etc/logrotate.d/misp
chmod 0640 /usr/local/etc/logrotate.d/misp

MISP配置

1. 复制配置文件

sudo -u www cp -a /usr/local/www/MISP/app/Config/bootstrap.default.php /usr/local/www/MISP/app/Config/bootstrap.php
sudo -u www cp -a /usr/local/www/MISP/app/Config/database.default.php /usr/local/www/MISP/app/Config/database.php
sudo -u www cp -a /usr/local/www/MISP/app/Config/core.default.php /usr/local/www/MISP/app/Config/core.php
sudo -u www cp -a /usr/local/www/MISP/app/Config/config.default.php /usr/local/www/MISP/app/Config/config.php

2. 配置数据库连接

编辑/usr/local/www/MISP/app/Config/database.php，确保数据库连接信息正确。

3. 生成GPG密钥

cat >/tmp/gen-key-script <<EOF
    %echo Generating a default key
    Key-Type: default
    Key-Length: 2048
    Subkey-Type: default
    Name-Real: MISP Admin
    Name-Comment: MISP
    Name-Email: admin@misp.local
    Expire-Date: 0
    Passphrase: yourpassphrase
    %commit
    %echo done
EOF

sudo -u www gpg --homedir /usr/local/www/MISP/.gnupg --batch --gen-key /tmp/gen-key-script

启动服务

chmod +x /usr/local/www/MISP/app/Console/worker/start.sh
echo '#!/bin/sh -e' > /etc/rc.local
echo 'exit 0' >> /etc/rc.local
chmod u+x /etc/rc.local

添加启动项到rc.local：

sed -i -e '$i \sudo -u www bash /usr/local/www/MISP/app/Console/worker/start.sh > /tmp/worker_start_rc.local.log\n' /etc/rc.local

安装MISP模块

pkg install -y yara
mkdir /usr/local/src
chmod 2775 /usr/local/src
chown root:staff /usr/local/src
cd /usr/local/src/
git clone https://github.com/MISP/misp-modules.git
cd misp-modules
sudo -H -u www /usr/local/www/MISP/venv/bin/pip install maec python-magic
sudo -H -u www /usr/local/www/MISP/venv/bin/pip install -I -r REQUIREMENTS
sudo -H -u www /usr/local/www/MISP/venv/bin/pip install .
sudo -H -u www /usr/local/www/MISP/venv/bin/pip install stix2

可选功能

启用ZeroMQ

pkg install -y libzmq4
sudo -H -u www /usr/local/www/MISP/venv/bin/pip install pyzmq

总结

至此，MISP平台在FreeBSD 12.0-amd64系统上的基本安装已经完成。安装过程中可能会遇到一些依赖问题，需要根据实际情况进行调整。建议在安装完成后，通过Web界面访问MISP，完成最后的初始化配置。

注意：本文档中提到的某些功能（如misp-dashboard）在FreeBSD上可能无法正常工作，需要额外的调试和配置。