### Install and Configure Podman on Ubuntu 24.04 LTS Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-linux.md Example process for installing Podman from the alvistack repository on Ubuntu 24.04 LTS. Podman v5.6.0 or higher is recommended. This example focuses on initial installation and system tweaks. ```bash # Initial Podman installation and system tweaks ``` -------------------------------- ### Start Malcolm with Kubeconfig File Source: https://github.com/cisagov/malcolm/blob/main/docs/kubernetes.md Example of providing a kubeconfig file to the start script for Kubernetes deployment. ```bash ./scripts/start -f kubeconfig.yaml ``` -------------------------------- ### Linux Fluent Bit Setup Script Execution Source: https://github.com/cisagov/malcolm/blob/main/docs/third-party-logs.md Demonstrates the interactive setup process for Fluent Bit on Linux using the `fluent-bit-setup.sh` script. This includes installation, configuration of input plugins (e.g., 'cpu'), and setting up a systemd service. ```bash $ ~/Malcolm/scripts/third-party-logs/fluent-bit-setup.sh 0 ALL 1 InstallFluentBit 2 GetMalcolmConnInfo 3 GetFluentBitFormatInfo 4 CreateFluentbitService Operation: 0 Install fluent-bit via GitHub/fluent install script [Y/n]? y ================================ Fluent Bit Installation Script ================================ This script requires superuser access to install packages. You will be prompted for your password by sudo. … Installation completed. Happy Logging! Choose input plugin and enter parameters. Leave parameters blank for defaults. see https://docs.fluentbit.io/manual/pipeline/inputs 1 collectd 2 cpu 3 disk 4 docker 5 docker_events 6 dummy 7 dummy_thread 8 exec 9 fluentbit_metrics 10 forward 11 head 12 health 13 http 14 kmsg 15 mem 16 mqtt 17 netif 18 nginx_metrics 19 node_exporter_metrics 20 opentelemetry 21 proc 22 prometheus_scrape 23 random 24 serial 25 statsd 26 stdin 27 syslog 28 systemd 29 tail 30 tcp 31 thermal Input plugin: 2 cpu Interval_Sec: 10 cpu Interval_NSec: cpu PID: Enter Malcolm host or IP address (172.16.0.20): 172.16.0.20 Enter Malcolm Filebeat TCP port (5045): 5045 Enter agent hostname (hostname): hostname Enter fluent-bit output format (json_lines): json_lines Nest values under field: cpu Add "module" value: cpu /usr/local/bin/fluent-bit -R /etc/fluent-bit/parsers.conf -i cpu -p Interval_Sec=10 -o tcp://172.16.0.20:5045 -p tls=on -p tls.verify=off -p tls.ca_file=/home/user/Malcolm/filebeat/certs/ca.crt -p tls.crt_file=/home/user/Malcolm/filebeat/certs/client.crt -p tls.key_file=/home/user/Malcolm/filebeat/certs/client.key -p format=json_lines -F nest -p Operation=nest -p Nested_under=cpu -p WildCard='*' -m '*' -F record_modifier -p 'Record=module cpu' -m '*' -f 1 Configure service to run fluent-bit [y/N]? y Enter .service file prefix: fluentbit_cpu Configure systemd service as user "user" [Y/n]? y [sudo] password for user: Created symlink /home/user/.config/systemd/user/default.target.wants/fluentbit_cpu.service → /home/user/.config/systemd/user/fluentbit_cpu.service. ● fluentbit_cpu.service Loaded: loaded (/home/user/.config/systemd/user/fluentbit_cpu.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2022-08-09 09:19:43 MDT; 5s ago Main PID: 105521 (fluent-bit) Tasks: 5 (limit: 76711) Memory: 24.7M CPU: 8ms CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/fluentbit_cpu.service └─105521 /usr/local/bin/fluent-bit -R /etc/fluent-bit/parsers.conf -i cpu -p Interval_Sec=10 -o tcp://172.16.0.20:5045 -p tls=on -p tls.verify=off -p tls.ca_fil… Aug 09 09:19:43 localhost fluent-bit[105521]: Fluent Bit v1.9.6 … Aug 09 09:19:43 localhost fluent-bit[105521]: [2022/08/09 09:19:43] [ info] [output:tcp:tcp.0] worker #0 started Aug 09 09:19:43 localhost fluent-bit[105521]: [2022/08/09 09:19:43] [ info] [output:tcp:tcp.0] worker #1 started ``` -------------------------------- ### Start Malcolm Services Source: https://github.com/cisagov/malcolm/blob/main/docs/aws.md Execute this script in the Malcolm installation directory to start all Malcolm services. Expect a 'Started Malcolm' message upon successful completion. Log messages during startup are normal as services synchronize. ```bash $ cd ~\Malcolm $ ./scripts/start logstash | [2026-01-16T17:58:33,274][INFO ][logstash.agent ] Pipelines running {:count=>7, :running_pipelines=>[:"malcolm-output", :"malcolm-input", :"malcolm-filescan", :"malcolm-suricata", :"malcolm-enrichment", :"malcolm-beats", :"malcolm-zeek"], :non_running_pipelines=>[]} Started Malcolm Malcolm services can be accessed at https:/// ------------------------------------------------------------------------------ ``` -------------------------------- ### Set up Malcolm Authentication Source: https://github.com/cisagov/malcolm/blob/main/docs/aws.md Navigate to the Malcolm installation directory and execute the authentication setup script. This script configures authentication-related settings for Malcolm. ```bash $ cd ~/Malcolm $ ./scripts/auth_setup all Configure all authentication-related settings ``` -------------------------------- ### Install Podman and Dependencies on Ubuntu Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-linux.md Installs Podman and related packages from a custom OpenSUSE repository. Ensures system settings are adjusted for unprivileged user namespaces and low port binding. Configures user accounts and enables linger for a specific user. Finally, it enables and starts the user's Podman service. ```bash $ sudo apt-get update … Fetched 38.6 MB in 8s (4901 kB/s) $ apt-cache policy podman podman: Installed: (none) Candidate: 4.9.3+ds1-1ubuntu0.2 … $ echo 'deb [signed-by=/etc/apt/trusted.gpg.d/home_alvistack.gpg] http://download.opensuse.org/repositories/home:/alvistack/xUbuntu_24.04/ /' \ | sudo tee /etc/apt/sources.list.d/home:alvistack.list >/dev/null $ curl -fsSL https://download.opensuse.org/repositories/home:alvistack/xUbuntu_24.04/Release.key \ | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/home_alvistack.gpg >/dev/null $ sudo tee /etc/apt/preferences.d/99-home_alvistack >/dev/null <<'EOT' Package: * Pin: origin download.opensuse.org Pin-Priority: 1 Package: buildah catatonit conmon containernetworking containernetworking-plugins containers-common cri-o-runc crun libcharon-standard-plugins libslirp0 passt podman podman-aardvark-dns podman-netavark python3-podman-compose slirp4netns Pin: origin download.opensuse.org Pin-Priority: 1001 EOT $ sudo apt-get update … Get:5 http://download.opensuse.org/repositories/home:/alvistack/xUbuntu_24.04 InRelease [1551 B] Get:6 http://downloadcontentcdn.opensuse.org/repositories/home:/alvistack/xUbuntu_24.04 Packages [170 kB] Fetched 172 kB in 3s (61.8 kB/s) Reading package lists... Done $ apt-cache policy podman podman: Installed: (none) Candidate: 100:5.6.2-1 … $ sudo apt-get install -y \ buildah \ catatonit \ crun \ fuse-overlayfs \ passt \ podman \ podman-aardvark-dns \ podman-netavark \ slirp4netns \ uidmap … Setting up podman (100:5.6.2-1) ... … $ grep -q unprivileged_userns_clone /etc/sysctl.d/* || \ sudo tee -a /etc/sysctl.d/99-userns.conf >/dev/null <<'EOT' # allow unprivileged user namespaces kernel.unprivileged_userns_clone=1 EOT $ grep -q ip_unprivileged_port_start /etc/sysctl.d/* || \ sudo tee -a /etc/sysctl.d/99-lowport.conf >/dev/null <<'EOT' # allow lower unprivileged port bind net.ipv4.ip_unprivileged_port_start=443 EOT $ sudo mkdir -p /etc/modprobe.d && \ echo "options overlay metacopy=off redirect_dir=off" \ | sudo tee /etc/modprobe.d/podman.conf >/dev/null $ [[ -d /etc/systemd/system ]] && \ sudo mkdir -p /etc/systemd/system/user@.service.d && \ echo -e "[Service]\nDelegate=cpu cpuset io memory pids" \ | sudo tee /etc/systemd/system/user@.service.d/delegate.conf >/dev/null $ sudo touch /etc/subuid && sudo touch /etc/subgid $ grep --quiet johndoe /etc/subuid || sudo usermod --add-subuids 200000-265535 johndoe $ grep --quiet johndoe /etc/subgid || sudo usermod --add-subgids 200000-265535 johndoe $ sudo loginctl enable-linger johndoe $ sudo usermod -a -G systemd-journal johndoe $ mkdir -p /run/user/1000/podman $ systemctl --user enable --now podman.service ``` -------------------------------- ### Malcolm Installation Menu Options Source: https://github.com/cisagov/malcolm/blob/main/docs/ubuntu-install-example.md This menu displays the available configuration options for Malcolm installation, including system tweaks, Docker setup, and user settings. Use item numbers or actions to navigate and configure. ```bash --- Malcolm Installation Options --- Select an item number to configure, or an action: ├── 1. Automatically Apply System Tweaks (current: Yes) ├── 2. Docker Compose Installation Method (current: github) ├── 3. Docker Installation Method (current: repository) ├── 4. Docker Users (current: ['ubuntu']) ├── 5. Install Docker if Missing (current: Yes) ├── 6. Pull Malcolm Images (current: No) ├── 7. Try Docker Convenience Script (current: No) └── 8. Try Docker Repository Installation (current: Yes) --- Actions --- s. Save and Continue x. Exit Installer Enter item number or action: ``` -------------------------------- ### Test Docker Installation Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-linux.md Verify your Docker installation by running 'docker info' or 'docker run --rm hello-world'. ```bash docker info ``` ```bash docker run --rm hello-world ``` -------------------------------- ### Start Malcolm Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-upgrade.md Start the Malcolm services. The startup process may take several minutes to complete. ```bash ./scripts/start ``` -------------------------------- ### Run Authentication Setup Script Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-upgrade.md Execute the authentication setup script to verify the authentication method. Avoid regenerating self-signed certificates or overwriting existing passwords unless intended. ```bash ./scripts/auth_setup ``` -------------------------------- ### Install and Configure Fluent Bit on Windows Source: https://github.com/cisagov/malcolm/blob/main/docs/third-party-logs.md This PowerShell script assists in installing and configuring Fluent Bit on Windows. It guides through downloading Fluent Bit, selecting an input plugin (e.g., winevtlog), configuring connection details to Malcolm, and setting up Fluent Bit as a Windows service. ```powershell PS C:\work> .\fluent-bit-setup.ps1 Download fluent-bit Would you like to download fluent-bit (zip) to C:\work? [Y] Yes [N] No [?] Help (default is "Y"): y Select input plugin (https://docs.fluentbit.io/manual/pipeline/inputs): 1. dummy 2. dummy_thread 3. fluentbit_metrics 4. forward 5. nginx_metrics 6. opentelemetry 7. prometheus_scrape 8. random 9. statsd 10. tail 11. tcp 12. windows_exporter_metrics 13. winevtlog 14. winlog 15. winstat Make a selection: 13 Enter parameters for winevtlog. Leave parameters blank for defaults. see https://docs.fluentbit.io/manual/pipeline/inputs winevtlog Channels: Application,Security,Setup,Windows PowerShell winevtlog Interval_Sec: winevtlog Interval_NSec: winevtlog Read_Existing_Events: winevtlog DB: winevtlog String_Inserts: winevtlog Render_Event_As_XML: winevtlog Use_ANSI: Enter Malcolm host or IP address: 172.16.0.20 Enter Malcolm Filebeat TCP port (5045): 5045 Enter agent hostname (hostname): hostname Enter fluent-bit output format (json_lines): json_lines Nest values under field (winevtlog): winevtlog Add "module" value (winevtlog): winevtlog C:\work\bin\fluent-bit.exe -c "C:\work\winevtlog_172.16.0.20_1660062217.cfg" Install fluent-bit Service Install Windows service for winevtlog to 172.16.0.20:5045? [Y] Yes [N] No [?] Help (default is "N"): Y Enter name for service: fluentbit_winevtlog Enter account name to run service (DOMAIN\user): DOMAIN\user Status Name DisplayName ------ ---- ----------- Stopped fluentbit_winev... fluentbit_winevtlog Start fluent-bit Service Start Windows service for winevtlog to 172.16.0.20:5045? [Y] Yes [N] No [?] Help (default is "Y"): y Status Name DisplayName ------ ---- ----------- Running fluentbit_winev... fluentbit_winevtlog ``` -------------------------------- ### Malcolm Installer Prompts Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-linux.md These are interactive prompts during the Malcolm installation process. They guide the user through system tweaks and configuration choices. ```text --- Malcolm Installation Options --- Select an item number to configure, or an action: └── 1. Automatically Apply System Tweaks (current: Yes) --- Actions --- s. Save and Continue x. Exit Installer Enter item number or action: s ``` ```text ============================================================ FINAL CONFIGURATION SUMMARY ============================================================ Configuration Only : No Auto Apply System Tweaks : Yes Configuration Directory : /home/johndoe/Malcolm/config Container Runtime : podman Run Profile : malcolm Process UID/GID : 1000/1000 Container Restart Policy : No Container Network : default Default Storage Locations : Yes HTTPS/SSL : Yes Node Name : ubuntu-noble-191 ============================================================ Proceed with Malcolm installation using the above configuration? (y / N): y … [2025-11-05 18:17:34] (SUCCESS) [INSTALLER]: Installation completed successfully ``` -------------------------------- ### Install usrmerge Package Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-upgrade.md Install the 'usrmerge' package to convert the system to the merged /usr layout if it has not already been converted. ```bash apt -y install --no-install-recommends usrmerge ``` -------------------------------- ### Start Malcolm Instance Source: https://github.com/cisagov/malcolm/blob/main/docs/running.md Use this script to create and start Malcolm containers in the background. The containers may take several minutes to fully initialize. ```bash $ ./scripts/start ``` -------------------------------- ### Install eksctl CLI Source: https://github.com/cisagov/malcolm/blob/main/docs/aws.md Installs eksctl, the official CLI for Amazon EKS, on Linux. Requires curl. ```bash $ curl -fsSL \ -o /tmp/eksctl.tar.gz \ "https://github.com/eksctl-io/eksctl/releases/latest/download/eksctl_Linux_$(uname -m | sed 's/^x86_64$/amd64/').tar.gz" $ tar -xzf /tmp/eksctl.tar.gz -C /tmp && rm /tmp/eksctl.tar.gz $ sudo mv /tmp/eksctl /usr/local/bin/ $ eksctl version 0.207.0 ``` -------------------------------- ### Install Malcolm using install.py Source: https://github.com/cisagov/malcolm/blob/main/docs/development.md Run the `install.py` script with the configuration tarball as an argument to install Malcolm. This script can also assist with installing Docker and Docker Compose if they are not already present. ```bash install.py malcolm_XXXXXXXX_XXXXXX_XXXXXXX.tar.gz ``` -------------------------------- ### Run Malcolm Install Script (TUI) Source: https://github.com/cisagov/malcolm/blob/main/docs/ubuntu-install-example.md Execute the install.py script with sudo to begin the Malcolm installation. This command initiates the terminal-based user interface for configuration. ```bash user@host:~/Malcolm$ sudo ./scripts/install.py ``` -------------------------------- ### Install Docker Desktop on macOS Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-macos.md Installs Docker Desktop, which includes the Docker Compose plugin, using Homebrew Cask. ```bash $ brew install --cask docker-desktop ``` -------------------------------- ### Start Malcolm with Kubeconfig Source: https://github.com/cisagov/malcolm/blob/main/docs/kubernetes.md Use this script to start Malcolm, specifying a kubeconfig file for Kubernetes communication. The script detects the configuration type. ```bash ./scripts/start -f /path/to/kubeconfig.yml ``` -------------------------------- ### Install kubectl CLI Source: https://github.com/cisagov/malcolm/blob/main/docs/aws.md Installs the Kubernetes command line tool, kubectl, on Linux. Requires curl and a Linux environment. ```bash $ curl -fsSL \ -o /tmp/kubectl \ "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/$(uname -m | sed 's/^x86_64$/amd64/' | sed 's/^aarch64$/arm64/')/kubectl" $ chmod 755 /tmp/kubectl $ sudo mv /tmp/kubectl /usr/local/bin/ $ kubectl version Client Version: v1.32.3 ``` -------------------------------- ### Install Docker on WSL Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-windows.md Run these commands in an administrator PowerShell or Command Prompt to install Docker within your WSL distribution. ```bash curl -fsSL https://get.docker.com -o get-docker.sh sudo sh get-docker.sh ``` -------------------------------- ### Build Malcolm Installer ISO with Vagrant Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-iso.md Use this command to initiate a clean build of the Malcolm installer ISO. The `-f` flag forces a rebuild, and `-i malcolm` specifies the Malcolm flavor. ```bash $ ./malcolm-iso/build_via_vagrant.sh -f -i malcolm … Starting build machine... Bringing machine 'default' up with 'virtualbox' provider... … ``` -------------------------------- ### Start Malcolm on EKS Source: https://github.com/cisagov/malcolm/blob/main/docs/aws.md Starts Malcolm on EKS, creating resources and pods in the 'malcolm' namespace. Use '--inject-resources' if kubernetes-container-resources.yml was modified. '--skip-persistent-volume-checks' can be used to bypass PV checks. ```bash $ ./Malcolm/scripts/start -f "${KUBECONFIG:-$HOME/.kube/config}" \ --inject-resources \ --skip-persistent-volume-checks ``` -------------------------------- ### Display auth_setup script help Source: https://github.com/cisagov/malcolm/blob/main/docs/authsetup.md Use the `--help` option to list all available arguments for the `auth_setup` script. This is useful for understanding the non-interactive configuration options. ```bash $ ./scripts/auth_setup --help ``` -------------------------------- ### Create Downloads Directory and Navigate Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-upgrade.md Create a 'Downloads' directory in the home directory if it doesn't exist and then change the current directory to 'Downloads'. ```bash mkdir -p ~/Downloads cd ~/Downloads ``` -------------------------------- ### Run Malcolm Installation Script Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-linux.md Executes the Malcolm installation script, skipping the splash screen. This script will guide through system configuration, including container runtime selection. ```bash $ sudo ./scripts/install.py --skip-splash ``` -------------------------------- ### Setup Custom YARA Rules Source: https://github.com/cisagov/malcolm/blob/main/docs/custom-rules.md Execute this command to manually set up custom YARA rules. Ensure you are in the Malcolm installation directory. ```bash docker compose exec -u $(id -u) strelka-backend /usr/local/bin/yara_rules_setup.sh ``` -------------------------------- ### Run Malcolm Auth Setup Script Source: https://github.com/cisagov/malcolm/blob/main/docs/ubuntu-install-example.md Execute the auth_setup script to configure authentication settings, including method selection, administrator credentials, and certificate generation. Follow the prompts to customize the setup. ```bash user@host:~/Malcolm$ ./scripts/auth_setup 1: all - Configure all authentication-related settings 2: method - Select authentication method (currently "basic") 3: admin - Store administrator username/password for basic HTTP authentication 4: webcerts - (Re)generate self-signed certificates for HTTPS access 5: fwcerts - (Re)generate self-signed certificates for a remote log forwarder 6: keycloak - Configure Keycloak 7: remoteos - Configure remote primary or secondary OpenSearch/Elasticsearch instance 8: email - Store username/password for OpenSearch Alerting email sender account 9: netbox - (Re)generate internal passwords for NetBox 10: keycloakdb - (Re)generate internal passwords for Keycloak's PostgreSQL database 11: postgres - (Re)generate internal superuser passwords for PostgreSQL 12: valkey - (Re)generate internal passwords for Valkey 13: arkime - Store password hash secret for Arkime viewer cluster 14: txfwcerts - Transfer self-signed client certificates to a remote log forwarder Configure Authentication (all): 1 Select authentication method (currently "basic")? (Y / n): y 1: basic - Use basic HTTP authentication 2: ldap - Use Lightweight Directory Access Protocol (LDAP) for authentication 3: keycloak - Use embedded Keycloak for authentication 4: keycloak_remote - Use remote Keycloak for authentication 5: no_authentication - Disable authentication Select authentication method (basic): 1 Store administrator username/password for basic HTTP authentication? (Y / n): y Administrator username (between 4 and 32 characters; alphanumeric, _, -, and . allowed) (): analyst analyst password (between 8 and 128 characters): : analyst password (again): : Additional local accounts can be created at https://localhost/auth/ when Malcolm is running (Re)generate self-signed certificates for HTTPS access? (Y / n): y (Re)generate self-signed certificates for a remote log forwarder? (Y / n): y Configure Keycloak? (Y / n): n Configure remote primary or secondary OpenSearch/Elasticsearch instance? (y / N): n Store username/password for OpenSearch Alerting email sender account? (y / N): n (Re)generate internal passwords for NetBox? (Y / n): y (Re)generate internal passwords for Keycloak's PostgreSQL database? (Y / n): y (Re)generate internal superuser passwords for PostgreSQL? (Y / n): y (Re)generate internal passwords for Valkey? (Y / n): y Store password hash secret for Arkime viewer cluster? (y / N): n Transfer self-signed client certificates to a remote log forwarder? (y / N): n ``` -------------------------------- ### Run Malcolm Configuration Script Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-hedgehog-e2e-iso-install.md Execute the Malcolm configuration script to launch the setup wizard. This can be done on the first boot or manually. ```bash user@host:~/Malcolm$ ./scripts/configure ``` -------------------------------- ### Install Dialog Interface Dependencies Source: https://github.com/cisagov/malcolm/blob/main/docs/ubuntu-install-example.md Installs the 'dialog' utility and the 'python3-dialog' library for a text-based user interface during installation. ```bash $ sudo apt-get -y install python3-dialog dialog Reading package lists... Done … Setting up dialog (1.3-20240101-1) ... Setting up python3-dialog (3.5.1-4) ... … ``` -------------------------------- ### Install Homebrew on macOS Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-macos.md Installs Homebrew, a package manager for macOS, which is recommended for installing Docker and Docker Compose. ```bash $ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" $ brew install cask ``` -------------------------------- ### Initial Password Change and Root Password Setup Source: https://github.com/cisagov/malcolm/blob/main/docs/hedgehog-raspi.md Demonstrates the process of logging in as the 'sensor' user, changing the default password, and then setting a root password using sudo. This is performed on the first boot after flashing the image. ```bash Hedgehog-rpi-4 login: sensor Password: You are required to change your password immediately (administrator enforced). Changing password for sensor. Current password: ************** New password: **************** Retype new password: **************** sensor@Hedgehog-rpi-4:~$ sudo passwd root [sudo] password for sensor: **************** New password: **************** Retype new password: **************** passwd: password updated successfully ``` -------------------------------- ### Install AWS CLI Source: https://github.com/cisagov/malcolm/blob/main/docs/aws.md Installs the AWS Command Line Interface on Linux systems. Ensure you have curl and unzip installed. ```bash $ curl -fsSL \ -o /tmp/awscli.zip \ "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" $ unzip -d /tmp /tmp/awscli.zip $ sudo /tmp/aws/install You can now run: /usr/local/bin/aws --version $ aws --version aws-cli/2.26.2 Python/3.13.2 Linux/6.1.0-32-amd64 exe/x86_64.ubuntu.24 ``` -------------------------------- ### Malcolm Installation Prompts Source: https://github.com/cisagov/malcolm/blob/main/docs/ubuntu-install-example.md When installing from a downloaded release artifact, the script will prompt for confirmation to extract the tarball and to specify the installation directory. ```bash Found Malcolm tarball: malcolm_20251029_140727_d22a504f.tar.gz. Use this file? (Y / n): Enter installation path for Malcolm [/home/user/malcolm] (/home/user/Malcolm): ``` -------------------------------- ### Reboot and Verify System Settings Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-linux.md After installation, reboot the system to apply changes. Verify kernel command line parameters and resource limits. ```bash $ sudo reboot ``` ```bash $ cat /proc/cmdline BOOT_IMAGE=/vmlinuz-6.8.0-85-generic root=UUID=52645fa4-47a3-4335-8817-2637487e1980 ro systemd.unified_cgroup_hierarchy=1 cgroup_enable=memory swapaccount=1 cgroup.memory=nokmem console=tty1 console=ttyS0 ``` ```bash $ ulimit -a real-time non-blocking time (microseconds, -R) unlimited core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 128240 max locked memory (kbytes, -l) unlimited max memory size (kbytes, -m) unlimited open files (-n) 65535 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 262144 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited ``` ```bash $ cat /etc/sysctl.d/99* | grep -v '^#' | cut -d= -f1 | xargs -r -l sysctl net.ipv6.conf.all.use_tempaddr = 0 net.ipv6.conf.default.use_tempaddr = 0 fs.file-max = 2097152 fs.inotify.max_user_watches = 131072 fs.inotify.max_queued_events = 131072 fs.inotify.max_user_instances = 512 vm.max_map_count = 524288 vm.swappiness = 1 vm.dirty_background_ratio = 5 vm.dirty_ratio = 10 vm.overcommit_memory = 1 net.core.somaxconn = 65535 net.ipv4.tcp_retries2 = 5 net.ipv4.ip_unprivileged_port_start = 443 kernel.unprivileged_userns_clone = 1 ``` -------------------------------- ### Malcolm Configuration Script Help Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-config.md Displays all available command-line arguments for the Malcolm configuration script. Use this to understand the various options for installation and configuration. ```bash usage: configure [-h] [--debug [true|false]] [--quiet] [--configure [true|false]] [--dry-run] [--log-to-file [filename]] [--skip-splash] [--tui | --dui | --gui | --non-interactive] [--compose-file ] [--environment-dir-input ] [--environment-dir-output ] [--export-malcolm-config-file []] [--import-malcolm-config-file | --load-existing-env [true|false] | --defaults] [--malcolm-file ] [--image-file ] [--extra [EXTRASETTINGS ...]] Malcolm Installer options: -h, --help show this help message and exit Installer Options: --debug, --verbose [true|false] Enable debug output including tracebacks and debug utilities --quiet, --silent Suppress console logging output during installation --configure, -c [true|false] Only write configuration and ancillary files; skip installation steps --dry-run Log planned actions without writing files or making system changes --log-to-file [filename] Log output to file. If no filename provided, creates timestamped log file. --skip-splash Skip the splash screen prompt on startup Interface Mode (mutually exclusive): --tui Run in command-line text-based interface mode (default) --dui Run in python dialogs text-based user interface mode (if available - requires python dialogs) --gui Run in graphical user interface mode (if available - requires customtkinter) --non-interactive Run in non-interactive mode for unattended installations (suppresses all user prompts) Configuration File Options: --compose-file, --configure-file, --kube-file, -f Path to docker-compose.yml (for compose) or kubeconfig (for Kubernetes) Environment Config Options: --environment-dir-input Input directory containing Malcolm's .env and .env.example files --environment-dir-output, -e Target directory for writing Malcolm's .env files --export-malcolm-config-file, --export-mc-file [] Export configuration to JSON/YAML settings file (auto-generates filename if not specified) --import-malcolm-config-file, --import-mc-file Import configuration from JSON/YAML settings file --load-existing-env, -l [true|false] Automatically load provided config/ .env files from the input directory when present. Can be used in conjunction with --environment-dir-input --defaults, -d Use built-in default configuration values and skip loading from the config directory Installation Files: --malcolm-file, -m Malcolm .tar.gz file for installation --image-file, -i Malcolm container images .tar.xz file for installation Additional Configuration Options: --extra [EXTRASETTINGS ...] Extra environment variables to set (e.g., foobar.env:VARIABLE_NAME=value) ``` -------------------------------- ### Save Malcolm Installation Configuration Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-linux.md Saves the current configuration in the Malcolm installer and proceeds with the installation. This is done by entering 's' at the main menu. ```bash -- Malcolm Configuration Menu -- Select an item number to configure, or an action: ├── 1. Container Runtime (current: podman) … --- Actions --- s. Save and Continue Installation w. Where Is...? (search for settings) x. Exit Installer --------------------------------- Enter item number or action: s ``` -------------------------------- ### Malcolm Installer Actions Source: https://github.com/cisagov/malcolm/blob/main/docs/ubuntu-install-example.md This section shows the available actions within the Malcolm installer, such as saving progress, searching for settings, or exiting the installer. ```bash --- Actions --- s. Save and Continue w. Where Is...? (search for settings) x. Exit Installer --------------------------------- Enter item number or action: s ``` -------------------------------- ### Install Python Dependencies for Malcolm Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-linux.md Installs Python package manager and other required Python libraries for the Malcolm project. These are necessary for running the installation script. ```bash $ sudo apt-get install -y \ python3-pip \ python3-ruamel.yaml \ python3-dotenv \ python3-dialog \ dialog … ``` -------------------------------- ### Malcolm Configuration Menu - Save and Continue Source: https://github.com/cisagov/malcolm/blob/main/docs/ubuntu-install-example.md After selecting desired configuration options in the Malcolm Configuration Menu, enter 's' to save the settings and proceed to the next step of the installation. ```bash … --- Actions --- s. Save and Continue w. Where Is...? (search for settings) x. Exit Installer --------------------------------- Enter item number or action: s ``` -------------------------------- ### Install New Malcolm Packages Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-upgrade.md After the Debian upgrade, install new packages required by the Malcolm ISO configuration. This command fetches package lists from GitHub, filters, combines, and installs them. ```bash curl -s "https://api.github.com/repos/idaholab/Malcolm/contents/malcolm-iso/config/package-lists?ref=v{{ site.malcolm.version }}" \ | grep "download_url" \ | cut -d '"' -f 4 \ | grep -Ev "\.binary$|live\.|virtualguest\." \ | while read -r url; do curl -sSL "$url"; echo; done \ | sort -u \ | grep -Ev "^\s*#|^\s*$" \ | xargs -r apt install -y ``` -------------------------------- ### Become Root and Set Umask Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-upgrade.md Become root and set the umask to 0022 before removing unused packages. ```bash su - ``` ```bash umask 0022 ``` -------------------------------- ### Confirm Malcolm Installation Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-hedgehog-e2e-iso-install.md Confirms the Malcolm installation with the specified configuration. Use 'y' to proceed. ```bash Proceed with Malcolm installation using the above configuration? (y / N): y ``` -------------------------------- ### Enable cgroup Memory and Swap Accounting Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-linux.md Add kernel boot parameters to `/etc/default/grub` to enable cgroup accounting for memory and swap space, then update grub. ```bash systemd.unified_cgroup_hierarchy=1 cgroup_enable=memory swapaccount=1 cgroup.memory=nokmem ``` -------------------------------- ### Verify Docker Installation Source: https://github.com/cisagov/malcolm/blob/main/docs/host-config-windows.md Check if Docker and Docker Compose are installed correctly by verifying their versions. ```bash docker --version docker compose version ``` -------------------------------- ### Mount and Chroot into Image Source: https://github.com/cisagov/malcolm/blob/main/hedgehog-raspi/README.md Mount the built image to a local directory and chroot into it for local testing. This requires root privileges. ```shell mount -o loop,offset=$((1048576*512)) raspi_4_trixie.img /mnt && chroot /mnt ``` -------------------------------- ### Handle Configuration File Prompts Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-upgrade.md During the upgrade, you may be prompted to replace locally modified configuration files. Choose to keep the local version to preserve system-specific customizations. ```bash No ``` ```bash Keep the local version currently installed ``` -------------------------------- ### Malcolm Configuration Menu - Run Profile Options Source: https://github.com/cisagov/malcolm/blob/main/docs/malcolm-hedgehog-e2e-iso-install.md Illustrates configuration options related to the Run Profile in the Malcolm Configuration Menu, specifically focusing on which system resource metrics to forward to the Malcolm aggregator. ```text --- Malcolm Configuration Menu --- … ├── 6. Run Profile (current: hedgehog) … │ ├── 8. Forward AIDE Results (current: Yes) │ ├── 9. Forward Audit Log (current: Yes) │ ├── 10. Forward CPU Utilization (current: Yes) │ ├── 11. Forward Disk Operation Statistics (current: Yes) │ ├── 12. Forward Disk Utilization (current: Yes) │ ├── 13. Forward Kernel Messages (current: Yes) │ ├── 14. Forward Memory Utilization (current: Yes) │ ├── 15. Forward Network Activity (current: Yes) │ ├── 16. Forward Systemd Journal Logs (current: Yes) │ ├── 17. Forward Thermal Readings (current: Yes) … ``` -------------------------------- ### Install Packer Source: https://github.com/cisagov/malcolm/blob/main/docs/aws.md Installs Packer, a tool for building automated machine images, on Linux. Requires curl and unzip. ```bash $ PACKER_VERSION="$(curl -fsSL 'https://releases.hashicorp.com/packer/' | grep -Po 'href="/packer/[^"]+"' | sort --version-sort | cut -d'/' -f3 | tail -n 1)" $ curl -fsSL \ -o /tmp/packer.zip \ "https://releases.hashicorp.com/packer/${PACKER_VERSION}/packer_${PACKER_VERSION}_linux_$(uname -m | sed 's/^x86_64$/amd64/' | sed 's/^aarch64$/arm64/').zip" $ unzip -d /tmp /tmp/packer.zip $ chmod 755 /tmp/packer $ sudo mv /tmp/packer /usr/local/bin/ $ packer --version Packer v1.12.0 ``` -------------------------------- ### Query Software Fields Source: https://github.com/cisagov/malcolm/blob/main/docs/api-examples.md This example shows how to query for software name and unparsed version using the /mapi/agg/zeek.software endpoint. It specifies the fields to retrieve. ```text /mapi/agg/zeek.software.name,zeek.software.unparsed_version ``` -------------------------------- ### Malcolm Final Configuration Summary Source: https://github.com/cisagov/malcolm/blob/main/docs/ubuntu-install-example.md This summary displays the selected configuration settings before proceeding with the Malcolm installation. Confirm with 'y' to proceed or 'N' to cancel. ```bash ============================================================ FINAL CONFIGURATION SUMMARY ============================================================ Configuration Only : No Auto Apply System Tweaks : Yes Configuration Directory : /home/user/Malcolm/config Container Runtime : docker Run Profile : malcolm Process UID/GID : 1000/1000 Container Restart Policy : unless-stopped Container Network : default Default Storage Locations : Yes HTTPS/SSL : Yes Node Name : host ============================================================ Proceed with Malcolm installation using the above configuration? (y / N): y ```