SIEMs in Bits and Pieces

Splunk offer installation instructions for Debian, Red Hat and generic tar file installation. There are no specific instructions for Ubuntu. Here is a quick way to install Splunk on Ubuntu 14: 1. Download the Debian (.deb) corresponding version of Splunk (32bit or 64 bit). If you cannot tell exactly what version of Ubuntu you have, use the following command to get the information: uname -a The output should be something similar to: Linux UBUNTU02 4.4.0-78-generic #99-Ubuntu SMP Thu Apr 27 15:29:09 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux x86_64 indicates a 64bit version If the upgrade is done from a terminal, you can get the right "wget" download link from Splunk (follow the instructions for downloading a Linux version). It should look something like this: wget -O splunk-7.2.5.1-962d9a8e1586-linux-2.6-amd64.deb 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=7.2.5.1&product=splunk&filename=...

Telnet and SSH would give most users just enough access to manage an Ubuntu server remotely, from a Windows computer. If you wish however to access its graphical interface, you can install xRDP and its dependencies and login remotely using an RDP client. The install xRDP follow these steps (from a terminal window on the Ubuntu machine): Install xRDP sudo apt-get update sudo apt-get install xrdp Install XFCE4: sudo apt-get install xfce4 Configure the .xsession configuration file in the user home folder: echo xfce4-session >~/.xsession Modify the xRDP startup file to include XFCE4: sudo nano /etc/xrdp/startwm.sh Add the following command to the end of the startup file: startxfce4 Save and restart the xRDP service: sudo service xrdp restart If needed, add the corresponding firewall rules: sudo ufw allow 3389 Connect to the remote Ubuntu machine using any RDP client (using the standard RDP port TCP/3389)