From 9a9fe7a37bb2d28113c0a2491eefad681e36842a Mon Sep 17 00:00:00 2001 From: Malware Devil <34285973+malwaredevil@users.noreply.github.com> Date: Tue, 5 May 2020 17:52:21 -0500 Subject: [PATCH 1/4] Update Ubuntu 18.04 from 7.2 to PHP 7.4 Added instructions on how to upgrade the standard Ubuntu 18.04 install of php 7.2 to the latest version of php (7.4.5 at time of writing) --- faq/README.md | 100 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 100 insertions(+) diff --git a/faq/README.md b/faq/README.md index f841f31..a02acfe 100644 --- a/faq/README.md +++ b/faq/README.md @@ -902,6 +902,106 @@ Created symlink from /etc/systemd/system/multi-user.target.wants/php73-php-fpm.s A galaxy can be assigned like a tag. You can use the add tag function and copy the full conntector-tag. Example `misp-galaxy:ransomware=“Locky”`, which can be found in `/galaxy_clusters/view/` +## Updating PHP from 7.2 to 7.4.5 on Ubuntu 18.04 + +### Installation + +1. Disable and Uninstall Currently Installed SSDEEP +```bash +sudo phpdismod ssdeep +sudo pecl uninstall ssdeep +sudo apt purge ssdeep +sudo rm -rf /etc/php/7.2/mods-available/ssdeep.ini +``` + +2. Install PHP 7.4.5 +```bash +sudo apt install software-properties-common -qy +sudo add-apt-repository ppa:ondrej/php -y +sudo apt update +sudo apt install -qy \ + libapache2-mod-php7.4 \ + php7.4 \ + php7.4-cli \ + php7.4-dev \ + php7.4-json \ + php7.4-xml \ + php7.4-mysql \ + php7.4-opcache \ + php7.4-readline \ + php7.4-mbstring \ + php-redis \ + php-gnupg \ + php-gd +sudo apt update +sudo apt upgrade -y +``` + +3. Install SSDEEP +```bash +cd /usr/local/src +sudo rm -rf ssdeep-2.14.1.tar.gz ssdeep-2.14.1 +sudo wget https://github.com/ssdeep-project/ssdeep/releases/download/release-2.14.1/ssdeep-2.14.1.tar.gz +sudo tar zxvf ssdeep-2.14.1.tar.gz +cd ssdeep-2.14.1 +sudo ./configure --datadir=/usr --prefix=/usr --localstatedir=/var --sysconfdir=/etc +sudo make +sudo make install +``` + +4. Test SSDEEP +```bash +ssdeep -h +``` + +5. Install ssdeep_php +```bash + sudo pecl channel-update pecl.php.net + sudo pecl install ssdeep +``` + +6. Enable SSDEEP in both 7.2 and 7.4 (** as root** `sudo su`) +```bash +echo 'extension=ssdeep.so' > /etc/php/7.2/mods-available/ssdeep.ini +echo 'extension=ssdeep.so' > /etc/php/7.4/mods-available/ssdeep.ini +``` + +7. Enable SSDEEP PHP Mod +```bash +sudo phpenmod ssdeep +``` + +8. Set PHP 7.4.5 to default PHP +```bash +sudo a2dismod php7.2 +sudo a2enmod php7.4 +sudo update-alternatives --set php /usr/bin/php7.4 +``` + +9. [Optional] Set better values for defaults +```bash +sudo sed -i "s/max_execution_time = 30/max_execution_time = 300/" /etc/php/7.4/apache2/php.ini ; \ +sudo sed -i "s/memory_limit = 128M/memory_limit = 2048M/" /etc/php/7.4/apache2/php.ini ; \ +sudo sed -i "s/upload_max_filesize = 2M/upload_max_filesize = 500M/" /etc/php/7.4/apache2/php.ini ; \ +sudo sed -i "s/post_max_size = 8M/post_max_size = 500M/" /etc/php/7.4/apache2/php.ini ; \ +sudo sed -i "s/max_execution_time = 30/max_execution_time = 300/" /etc/php/7.4/cli/php.ini ; \ +sudo sed -i "s/upload_max_filesize = 2M/upload_max_filesize = 500M/" /etc/php/7.4/cli/php.ini ; \ +sudo sed -i "s/post_max_size = 8M/post_max_size = 5000M/" /etc/php/7.4/cli/php.ini ; +``` + +10. Restart Apache to implement changes +```bash +sudo sudo systemctl restart apache2 +``` + +### Verification of php 7.2 to 7.4 + +1. **Administration** > **Server Settings & Maintenance** + +2. **Diagnostics** + +3. Scroll down to the **PHP Settings** section and verify + From f72f3ebd3ed3292ee4260125dbc75ed890755fc7 Mon Sep 17 00:00:00 2001 From: Natsec Date: Wed, 1 Jul 2020 18:23:30 +0200 Subject: [PATCH 4/4] fixed two typo --- general-concepts/README.md | 3 +-- using-the-system/README.md | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/general-concepts/README.md b/general-concepts/README.md index 5d68f49..4c98545 100644 --- a/general-concepts/README.md +++ b/general-concepts/README.md @@ -30,7 +30,6 @@ A user of a role that grants sync permissions, these users (and their authentica ### Synchronisation What we call synchronisation is an exchange of data between two (or more) MISP instances through our pull and push mechanisms. ### Tagging -Users with tagging rights can assigned various dynamically created tags to events, allowing an arbitrary link between events to be created. It is possible to filter events based on these tags and they can also be used to filter events for the automation. +Users with tagging rights can assign various dynamically created tags to events, allowing an arbitrary link between events to be created. It is possible to filter events based on these tags and they can also be used to filter events for the automation. ### Templating Users with templating rights can create easy to fill forms that help with the event creation process. - diff --git a/using-the-system/README.md b/using-the-system/README.md index 9c42a4a..894e52a 100644 --- a/using-the-system/README.md +++ b/using-the-system/README.md @@ -7,7 +7,7 @@ The process of entering an event can be split into 3 phases, the creation of the event itself, populating it with attributes and attachments and finally publishing it. -During this first step, you will be create a basic event without any actual attributes, but storing general information such as a description, time and risk level of the incident. To start creating the event, click on the New Event button on the left and fill out the form you are presented with. The following fields need to be filled out: +During this first step, you will create a basic event without any actual attributes, but storing general information such as a description, time and risk level of the incident. To start creating the event, click on the New Event button on the left and fill out the form you are presented with. The following fields need to be filled out: ![Fill this form out to create a skeleton event, before proceeding to populate it with attributes and attachments.](figures/add_event.png) @@ -328,7 +328,7 @@ The last option is a checkbox that restricts all of the results to attributes th ## Updating and modifying events and attributes Every event and attribute can easily be edited. First of all it is important to find the event or attribute that is to be edited, using any of the methods mentioned in the section on [browsing past events](#browsing_events). -Once it is found, the edit button (whether it be under actions when events/attributes get listed or simply on the event view) will bring up the same screen as what is used to create the entry of the same type (for an event it would be the event screen as [seen here](#Creating an event), for an attribute the attribute screen as [described here](#add-attributes-to-the-event)). You can also simply double-click on the event you wish to edit and enter the edit mode. +Once it is found, the edit button (whether it be under actions when events/attributes get listed or simply on the event view) will bring up the same screen as what is used to create the entry of the same type (for an event it would be the event screen as [seen here](#Creating an event), for an attribute the attribute screen as [described here](#add-attributes-to-the-event)). You can also simply double-click on the event you wish to edit and enter the edit mode. Keep in mind that editing any event (either directly or indirectly through an attribute) will unpublish it, meaning that you'll have to publish it (through the event view) again once you are done. ## Tagging