OK, so when the last lecture we set up our corporate email and now we're going to dig into the routing
infrastructure, right?
So we're going to build out our intrusion detection system.
We're going to set up our circle of rules.
We're going to set up our Layer seven Next-Generation Firewall capabilities, all using open sets.
It's going to be amazing.
So before we do that, I just need to make sure that you are tracking the need to take snapshots.
Right.
So what you should do before we proceed is right.
Click on the tab and then go to snapshot and take a snapshot.
The last thing we want to happen is your VM crashes or something catastrophic happens with your host
machine and you don't have a recent snapshot, right?
Rebuilding everything from scratch is going to be laborious, not to mention vexing.
So I'm trying to save you that frustration by recommending you take regular snapshots.
OK, so make sure all your Vimes a snapshot it and make sure all VMS are in only mode to the adapter
at the bottom.
So you just click through each of the voice tabs and the mouse over the adapter to make sure it's the
host only.
Right.
So we're good here.
Now let's get into open sense.
This is amazing.
This is my opinion, one of the worst.
I think it is the best opensource intrusion detection system and firewall combination right now that
exists.
Puissance is another excellent firewall, but open sense of the evolution of it.
And if you want to look at piaffe sense and how you can set that up in a cyber range, you should look
at my other course.
That is basically kind of the ultimate cyber rage.
And that's another course that's also here.
And you have access to it if you if you want to view that course.
But here we're going to do is we're going to set this up and it's going to be a lot of fun.
So what can you do with this?
Well, you know, you can look at your firewall rules.
You can set all that up.
You can set up Surakarta and it gets even better.
So let's go down.
Right.
Stateful firewall.
So by stateful, it means that the firewall can monitor the full state of active network sessions.
Right.
It is not such an agnostic.
It understands the context of the traffic and can give you a big picture overview of what's happening.
Right.
So this is what modern firewalls use.
And we have a bunch of other things here, right?
Intrusion detection systems.
Right.
So you can detect Trojans and command and control bots using Surakarta, which is industry standard
open source intrusion detection system.
Now, you could use the emerging threats ruleset, which is free, but by signing up for it pro telemetry,
you can actually you can actually get the paid version.
I'm going to show you how to do that a little bit later, which is even better.
It's a premium product for free.
Well, it's not really for free.
You're going to provide some telemetry about your system to open sets, but it's not that bad.
You'll see what it is in a moment.
It supports routing protocols.
It supports web filtering.
So, you know, DNS blacklists, things like that.
And a whole bunch of other things, right, especially Sensa, which is absolutely amazing, this is
what takes your open sense firewall into the next gen category, because with Sensa, it's a plug in.
What we can do is we can set up, you know, application visibility.
Right.
So we can actually block.
By the application layer, right, the layer seven, which is port agnostic, right, this is independent
of the port.
It actually analyzes the Layer seven app level traffic and can make intelligent blocking decisions based
on that.
You can see some examples here.
We're going to set this up a little later.
It's pretty cool.
So you can, you know, drill down into your network visibility.
Is active directory integration.
And a bunch of other really, really cool stuff that you're not seeing here now, the only catch that
in order to do this sense that you need to have eight gigabytes assigned to your virtual machine.
So I don't know how many gigabytes you have in your host box.
I have 32.
If you have 16 is going to be a little tough.
We'll make do with what we can.
I'll even give you an option to install open sense without Sensa if you want.
But let's close this out, let's just get open sense, so I'm going to click down that open sense and
it will download.
What we do is we select the architecture and we select the image, which should be a DVD.
You select a mirror location and then you can download.
So we'll come back after this finishes and then we'll jump into it.
OK, so I'll download it pretty fast and all you need to do is extract the Beezy to file if you.
Right.
Click on it and you have seven zip installed, you can go to seven zip extract here or extract to a
folder and then you'll get this beautiful ISIL in.
When you get that ISO, we can create our appliance.
So I'm going to shift right click copy his path, minimize, minimize and let's go to file new virtual
machine.
Typical and let's go ahead and paste in the path removing the quotes.
Very cool, so FreeBSD was detected, so, you know, you've got the right path here.
Click next, and I'm just going to name it Open Sense next.
We'll set it to a single file.
And then we'll change this to 40 gigabytes.
All right, that looks pretty good, quick next.
Now, we need to customize a few things here, so if we go to customize hardware, we need to bump the
memory up to eight gigs.
If we want to use Sensa, if you're not going to use and say you can leave it too technically, although
four is better, but if you have the memory on your host box, go for it.
OK, CPU's two and the adapters.
So what we're going to do is add a new adapter.
And there's a couple of things here, right?
If you were building a DMZ, you would add an additional dafter, but we're going to have one adapter
for our win.
So this is going to be our Internet connection.
We'll make it bridgid to our physical network when our horsebox and then the other network adapter will
be hosted only.
So this will be the internal private network of our carbon like that local.
And I was just saying, if you wanted to add additional adapter for like a DMZ for our own mass-produced
shop application, you could do that here.
But I don't want to complicate this too much because I, I get the sense that there's going to be a
lot of problems as you guys are going through this.
And I don't want to frustrate you with all the setting and configuration.
So this is an infrastructure course, right?
This is really a modern ethical hacking course.
So I want to keep the focus on that.
Right.
I want to frustrate you guys too much.
So we'll keep it here.
Bridge and host only click OK, Reclose even when look over and then click.
Finish.
All right, so the box is booted, let's log in with user name installer open since is the password.
And we're basically just going to next next finish through this installer, so let's go, we'll accept
the settings, run the guided installation, keep the default disk, which is on our VM will use yafai
mode and then we will set the recommended Soire partition size.
And after this finishes, it's going to prompt us for a password and we'll put that in reboot and then
we'll continue with the appliance configuration.
All right.
So that took about roughly four to five minutes.
We're going to create a root password, going to hit tab and then click accept and set password and
then we'll reboot control alt to escape the N.
Then I'm going to drag this VM into the private group.
Now it's starting to look pretty good, so we'll wait for this to boot and then we'll log in with our
credentials.
All right.
Now we're booted blogging with route, the password we just created.
And you can see we've got the land and the wind, but the interface types aren't what we want.
It's just a little bit of interface configuration we need to do.
And we'll kick that off in the next lecture.
So we'll see you guys in the next lecture.
All right.
Bye.