Sguil Installation Script v0.2 Available

Last week I posted news of a script called to install all Sguil components except the client on a FreeBSD 6.0 system. Today I finished a new script,, that installs all Sguil components -- including the client.

Here is an annotated diff of the changes.

First, version updates:

orr:/data/code/sh$ diff -u
--- Wed Dec 28 21:35:06 2005
+++ Fri Jan 6 10:40:38 2006
@@ -1,7 +1,7 @@
# Sguil installation script by Richard Bejtlich (
-# v0.1 28 December 2005
+# v0.2 6 January 2006
# Tested on FreeBSD 6.0 RELEASE
@@ -9,7 +9,7 @@
# This is not intended for production use where separate sensor, server,
# and client boxes are recommended

-echo "Sguil Installation Script"
+echo "Sguil Sensor, Server, Client Installation Script"
echo "By Richard Bejtlich"
@@ -33,7 +33,7 @@

# FreeBSD 6 packages


# Determine sensor name

Next, I decided to patch sguild, instead of telling users to patch The new sguild.patch file looks like this:

orr:/home/richard$ cat sguild.patch
--- sguild Thu Dec 1 11:09:22 2005
+++ sguild.diff Thu Jan 5 20:43:14 2006
@@ -15,7 +15,7 @@

########################## GLOBALS ##################################

-set VERSION "SGUIL-0.6.0"
+set VERSION "SGUIL-0.6.0p1"
# DB Version
set DB_VERSION "0.11"
# Counter for tracking xscript transactions

All the patch does is make the sguild version be what it should have been -- 0.6.0p1.

Returning to the installation script:

@@ -174,6 +174,12 @@
patch -p0 <
crontab -u root

+# Retrieve, apply sguild patch for version number problem
+cd /usr/local/src/$SGUIL/server
+patch -p0 < sguild.patch
# Install

cp /usr/local/etc/nsm/ /usr/local/bin

Next comes new sections to install an X server. This allows users to run 'startx' and find themselves inside the Fluxbox window manager.

@@ -219,20 +225,67 @@
cd /usr/local/src/$SGUIL/server
./sguild -c sguild.conf -u sguild.users -adduser sguil

+# Install X-related packages
+pkg_add -r xorg-server
+pkg_add -r xorg-clients
+pkg_add -r bitstream-vera
+pkg_add -r perl
+pkg_add -r xorg-fonts-100dpi
+pkg_add -r xorg-fonts-75dpi
+pkg_add -r xorg-fonts-miscbitmaps
+pkg_add -r fluxbox-devel
+# Configure Fluxbox
+echo "exec startfluxbox" > /home/analyst/.xinitrc
+chown analyst:analyst /home/analyst/.xinitrc

The Sguil client news a few new libraries. I had to build these myself as they are not yet updated on the FreeBSD package building cluster. When the new packages are available through FreeBSD, I will edit the script.

+# Install additional packages for Sguil client
+cd /root
+pkg_add itcl-3.2.1_1.tbz
+pkg_add itk-3.2.1_1.tbz
+pkg_add iwidgets-4.0.1.tbz
+pkg_add -r ethereal
+# Configure Wish
+mv /usr/local/bin/wish /usr/local/bin/wish.orig
+ln -s /usr/local/bin/wish8.4 /usr/local/bin/wish

I create a simple startup script to facilitate starting the Sguil client. It looks like this.

cd /usr/local/src/sguil-0.6.0p1/client

Returning to the script:

+# Fetch client startup script
+cd /home/analyst
+chown analyst:analyst /home/analyst/
+chmod +x /home/analyst/

Next I patch sguil.conf to handle locations of certain programs in FreeBSD. The patch looks like this:

orr:/data/code/sh$ cat sguil.conf.patch
--- sguil.conf Thu Oct 13 12:28:28 2005
+++ sguil.conf.diff Fri Jan 6 09:55:07 2006
@@ -35,7 +35,7 @@
# set FESTIVAL_PATH "c:\festival\bin\festival.exe"
#set WHOIS_PATH /common/bin/
# Path to ethereal
-set ETHEREAL_PATH /usr/sbin/ethereal
+set ETHEREAL_PATH /usr/X11R6/bin/ethereal
# win32 example
# set ETHEREAL_PATH "c:/progra~1/ethereal/ethereal.exe"
# Where to save the temporary raw data files on the client system

Returning to the script:

+# Patch sguil.conf
+cd /usr/local/src/$SGUIL/client
+patch -p0 < sguil.conf.patch

Finally, I changed what users see when they finish executing the script:

# Messages to users

-echo "To start Sguil, execute the following."
+echo "To start Sguil server components, do the following."
-echo "As user sguil:"
+echo "As user sguil, execute these scripts:"
echo "/home/sguil/"
echo "/home/sguil/"
echo "/home/sguil/"
-echo "Next, as user root:"
+echo "As user root, execute these scripts:"
echo "/root/"
echo "/root/"
echo "/usr/local/bin/ restart"
-echo "You will then be able to connect using the separate Sguil client."
+echo "To start the Sguil client, do the following."
+echo "Log in as user analyst. Run startx to launch Fluxbox."
+echo "Launch a xterm, then run /home/analyst/"

To run this script effectively, you should use FreeBSD 6.0/i386. The minimum partioning scheme follows. This requires a 1280 MB drive (1.25 GB). I install the "minimal" FreeBSD distribution when I use this script.

  • / 128 MB

  • Swap 256 MB

  • /usr 512 MB

  • /nsm 128 MB

  • /var 128 MB

  • /home 64 MB

  • /tmp 64 MB

You also need two users, in addition to root.

  • User analyst is a member of the wheel group and can therefore su - to root.

  • User sguil is not a member of the wheel group. However, I run as many parts of Sguil as possible using this user.

Here is how to invoke the script:

$ su -
gruden# fetch
gruden# chmod +x
gruden# ./

When the sguil client user password prompt appears, enter something like 'sguil'. This is the only pause in the script.

The end result of running this script inside a FreeBSD VM I created is a Sguil sensor, server, database, and client. I'll describe that in my next post.


Anonymous said…
I have been reading your blog for several months now and very much appreciate the work you put into it. It has been useful on several occasions.

I am trying to utilize your script which for the most part is working wonderfully for me. The only point I seem to be having issues with is the mysqltcl-3.01.tbz package that is downloaded from your site and then installed. The package downloads just fine, but then I get an error stating that pkg_add "could not fine package ldconfig_compat-1.0_6. I tried manually adding this package but am unable to find it in the bsd port tree. Granted I am not as familiar with FreeBSD as with other operating systems, but I believe I am following the correct procedure. Any thoughts on how I can work around this would be great.

Thanks again.

That error is associated with the newest build of mysqltcl-3.01, which I thought might work better than the old one. That does not seem to be the case. I have replaced that package with the old mysqltcl-3.01.tbz, which seems to be working. Try grabbing it again from and pkg_add -v.
Anonymous said…
This comment has been removed by a blog administrator.
Anonymous said…
I can't get the install scripts from your site. I can get patches ect, but not the or

I am using the wget command instead of fetch.
You are looking at an old post. Look here.

Popular posts from this blog

Five Reasons I Want China Running Its Own Software

Cybersecurity Domains Mind Map

A Brief History of the Internet in Northern Virginia