Arkime3安装

我尝试一天安装，找了各个文章教程都没安装上，最后进行所有文章整合，和我的发现安装成功。

一、安装环境

安装服务器环境是CentOS 7
最小化安装后还是需要安装一些软件

yum install wget #安装wget
yum install net-tools #安装netstat查看网络
yum install vim #安装vim修改文件

关闭防火墙
systemctl stop firewalld.service
关闭防火墙自启动
systemctl disable firewalld.service

二、安装

1. 下载rpm包

wget https://s3.amazonaws.com/files.molo.ch/builds/centos-7/arkime-3.4.2-1.x86_64.rpm

因为是外网请求如果拉取不了也可以想办法直接访问在本机下载拉取到虚拟机

rpm -ivh arkime-3.4.2-1.x86_64.rpm

2. 安装依赖

yum -y install perl-libwww-perl perl-JSON libyaml-devel perl-LWP-Protocol-https

3. 安装rpm包

rpm -ivh arkime-3.1.1-1.x86_64.rpm

安装结束后会有安装的readme.txt 和 contigure的路径
可以查看readme，做下一步安装动作。

4.运行配置脚本

4.1 安装jdk环境

yum install java-11-openjdk -y 

4.2 运行配置脚本

1. 确定抓包接口（有显示当前网络中的网卡可以依据需要选择）
2. 下载并安装默认的es版本
   注：最小内存为3G
3. 输入一个验证的密码
4. 检查jdk环境，如果没有会提示，安装后再次运行脚本
5. 下载MaxMind的GEO地理位置数据，这个需要去注册一个账号，这样数据显示可以带上地址位置

# cd /opt/arkime/bin/

#./Configure 
Found interfaces: ens33;lo
Semicolon ';' seperated list of interfaces to monitor [eth1] ens33 
Install Elasticsearch server locally for demo, must have at least 3G of memory, NOT recommended for production use (yes or no) [no] yes 
/usr/bin/java 
Password to encrypt S2S and other things [no-default] admin
Arkime - Creating configuration files
Not overwriting /opt/arkime/etc/config.ini, delete and run again if update required (usually not), or edit by hand
Installing systemd start files, use systemctl
Arkime - Downloading and installing demo OSS version of Elasticsearch
Loaded plugins: fastestmirror
elasticsearch-oss-7.10.2-x86_64.rpm                                                                                                         | 220 MB  00:00:33     
Examining /var/tmp/yum-root-Wzs9zH/elasticsearch-oss-7.10.2-x86_64.rpm: elasticsearch-oss-7.10.2-1.x86_64
/var/tmp/yum-root-Wzs9zH/elasticsearch-oss-7.10.2-x86_64.rpm: does not update installed package.
Error: Nothing to do
Download GEO files? (yes or no) [yes] yes
Moloch - Downloading GEO files
2018-12-04 09:14:46 URL:https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.csv [23031] -> "ipv4-address-space.csv" [1]
WARNING: timestamping does nothing in combination with -O. See the manual for details.
2018-12-04 09:14:52 URL:https://updates.maxmind.com/app/update_secure?edition_id=GeoLite2-Country [1792881/1792881] -> "GeoLite2-Country.mmdb.gz" [1]
WARNING: timestamping does nothing in combination with -O. See the manual for details.
2018-12-04 09:15:17 URL:https://updates.maxmind.com/app/update_secure?edition_id=GeoLite2-ASN [3483756/3483756] -> "GeoLite2-ASN.mmdb.gz" [1]
2018-12-04 09:15:29 URL:https://raw.githubusercontent.com/wireshark/wireshark/master/manuf [1523729/1523729] -> "oui.txt" [1]
Moloch - Configured - Now continue with step 4 in /data/moloch/README.txt
      /sbin/start elasticsearch # for upstart/Centos 6/Ubuntu 14.04
      systemctl start elasticsearch.service # for systemd/Centos 7/Ubuntu 16.04
     systemctl start elasticsearch.service
 5) Initialize/Upgrade Elasticsearch Arkime configuration
  a) If this is the first install, or want to delete all data
      /opt/arkime/db/db.pl http://ESHOST:9200 init
  b) If this is an update to a moloch/arkime package
      /opt/arkime/db/db.pl http://ESHOST:9200 upgrade
 6) Add an admin user if a new install or after an init
      /opt/arkime/bin/arkime_add_user.sh admin "Admin User" THEPASSWORD --admin
 7) Start everything
      systemctl start arkimecapture.service
      systemctl start arkimeviewer.service
 8) Look at log files for errors
      /opt/arkime/logs/viewer.log
      /opt/arkime/logs/capture.log
 9) Visit http://arkimeHOST:8005 with your favorite browser.
      user: admin
      password: THEPASSWORD from step #6

If you want IP -> Geo/ASN to work, you need to setup a maxmind account and the geoipupdate program.
See https://arkime.com/faq#maxmind

Any configuration changes can be made to /opt/arkime/etc/config.ini
See https://arkime.com/faq#moloch-is-not-working for issues

Additional information can be found at:
  * https://arkime.com/faq
  * https://arkime.com/settings

4.3 如果elasticsearch安装失败

因为elasticsearch是外网安装如果安装不了也可以想办法直接访问在本机下载拉取到虚拟机，会有提示下载什么版本，比如我这个就安装失败后提示在这里下载https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss-7.10.2-x86_64.rpm 可以下载后拉进虚拟机中

4.3.1 安装elasticsearch

rpm -ivh elasticsearch-oss-7.10.2-x86_64.rpm

4.3.2 elasticsearch设置远程访问

elasticsearch出于安全策略考虑，默认仅开启了本地访问。需要额外配置远程访问。
修改/etc/elasticsearch/elasticsearch.yml文件加入

network.host: 0.0.0.0
network.bind_host: 0.0.0.0
network.publish_host: 0.0.0.0
discovery.seed_hosts: ["0.0.0.0", "[::0]"]

配置后启动 systemctl start elasticsearch.service
启动开机自启 systemctl enable elasticsearch.service

5.创建Web访问账号

# /opt/arkime/bin/arkime_add_user.sh admin "Admin User" admin --admin
Added

6.初始化elasticsearch

# /opt/arkime/db/db.pl http://localhost:9200 init

It is STRONGLY recommended that you stop ALL Arkime captures and viewers before proceeding.  Use 'db.pl http://localhost:9200 backup' to backup db first.

There is 1 elastic search data node, if you expect more please fix first before proceeding.

This is a fresh Arkime install
Erasing
Creating
Finished

7.启动web服务

# systemctl start arkimeviewer.service
# systemctl enable arkimeviewer.service

8.启动arkimecapture服务

# systemctl start arkimecapture.service
# systemctl enable arkimecapture.service

9.访问界面

http://ipaddress:8005