Installing Bro, the network security monitor, on a Raspberry Pi
In the continuing quest to install security software on Raspberry Pis, testing their capacity to be used as small nodes that can be placed here and there on demand, the time has come for installing Bro.
The hardware/OS in question is a Raspberry Pi 2, with 1G RAM and 4 CPU cores. It’s running the Jessie version of Raspbian.
The Bro project kindly provides precompiled Debian packages, but only for the i386 and amd64 architectures. Luckily they also provide the source files and build instructions for Debian!
So I followed the instructions listed here but instead of adding the regular repo (starting with “deb“) to /etc/apt/sources.list.d/bro.list, I changed it to deb-src. After that I added the Bro repo key. Commands shown below:
# echo 'deb-src http://download.opensuse.org/repositories/network:/bro/Debian_8.0/ /' \>> /etc/apt/sources.list.d/bro.list# wget http://download.opensuse.org/repositories/network:bro/Debian_8.0/Release.key \-O - | apt-key add -
Time to update the repo status and then install the dependencies required for the build:
# apt-get update # apt-get build-dep bro
Depending on what you already have running on your RPi, this could be a short or long list of packages. On mine, running Raspbian Jessie, this is what had to be installed:
bison cmake cmake-data libarchive13 libbison-dev libpcap-dev libpython-dev libpython2.7-dev libssl-dev python-dev python2.7-dev swig swig2.0
When that’s done, it’s time for the real job: Build Bro from source with Debian build instructions. This will take some time, on my RPi2 it took ~100 minutes. Below is the command required:
# apt-get source --compile bro
When that job has completed, you will find some .deb packages in your current directory. You will need to install them all (except for the dev package), like this:
# dpkg -i bro_2.4.1-0_armhf.deb bro-core_2.4.1-0_armhf.deb \ broctl_2.4.1-0_armhf.deb libbroccoli_2.4.1-0_armhf.deb
The Bro software will have been installed under /opt/bro, so that’s where you need to go to start using it. Other people write better Bro documentation than I do so I will leave that to them. A quickstart probably won’t hurt, so after making your local changes to /opt/bro/etc/node.conf you can start Bro as shown below. Logs will appear in /opt/bro/logs/current/.
# /opt/bro/bin/broctl Hint: Run the broctl "deploy" command to get started.Welcome to BroControl 1.4Type "help" for help.[BroControl] > deploy checking configurations ... installing ... removing old policies in /opt/bro/spool/installed-scripts-do-not-touch/site ... removing old policies in /opt/bro/spool/installed-scripts-do-not-touch/auto ... creating policy directories ... installing site policies ... generating standalone-layout.bro ... generating local-networks.bro ... generating broctl-config.bro ... generating broctl-config.sh ... updating nodes ... stopping ... stopping bro ... starting ... starting bro ... [BroControl] > status Getting process status ... Getting peer status ... Name Type Host Status Pid Peers Started bro standalone localhost running 16514 ??? 01 Nov 22:19:57 [BroControl] >