Install ElastiFlow on Ubuntu 18.04 – Part 1: Installing Ubuntu

ElastiFlow is a great open source NetFlow analyzer that works with Elastic Stack (formerly ELK Stack). Of all the netflow tools I’ve tested it has, by far, the best visualizations. However, if like me you aren’t familiar with Elastic Stack the setup can be rather intimidating. In this tutorial, I hope to make it easier for you and everyone who wants to use this awesome tool.

This tutorial is broken up into 4 parts. One for installing the Ubuntu server. One for installing and configuring Elastic Stack. One on how to implement ElastiFlow on top of it all. And finally one on how to properly maintain the solution.

Part 1: Installing Ubuntu
Part 2: Installing Elastic Stack
Part 3: Install ElastiFlow
Part 4: Solution Maintenance (coming soon)

Install and Setup of Ubuntu Server 18.04

I performed my installation of Ubuntu Sever using the latest version of 18.04 on a Hyper-V virtual machine (VM), but the instructions will be the same regardless of what hypervisor you are using. The VM had 40GB hard drive and 4GB of RAM.

Install Ubuntu 18.04

  1. Download Ubuntu server https://www.ubuntu.com/download/server
    Note: I found downloading the BitTorrent was actually much faster than downloading directly from the Ubuntu servers. https://www.ubuntu.com/download/alternative-downloads
  2. Create a new VM with a 40GB hard disk and at least 4GB of RAM.
  3. Insert the install media and start the VM.
  4. Select your preferred language
  5. Select your keyboard layout
  6. Choose Install Ubuntu
  7. At this set you have the choose to stick with DHCP or use a static address. If you choose to use a static address it is best to set it up now, as it provides a nice easy interface to set it here.
  8. Configure a proxy address if required
  9. On the Filesystem setup screen select Use An Entire Disk
  10. Press Enter to accept the default disk
  11. Select Done
  12. Select Continue
  13. Create a name for your server and setup the username and password for the root user
  14. Wait for the installation to complete
  15. When prompted select Reboot Now
  16. If prompted eject the installation media from the VM and press Enter to continue booting

Setup Ubuntu for ElastiFlow

If you set your IP address during the installation process the only remaining setup action is to install and configure SSH. This will allow you to use a tool like Putty to connect to the server and more easily configure the items in part 2 and 3. (copy and paste FTW!)

  1. Log into the VM using the username and password you created during the setup process
  2. Install SSH using the command below:
  3. Start the SSH service so you can connect to the server
  4. On another computer open your preferred SSH client. I recommend PuTTY if you don’t have one. (https://www.putty.org/)
  5. Enter the IP address of your server, set the port to 22, select SSH connection type, and click OK
  6. If you receive a Security Warning click Yes

You are now all set to start the installation process.

Part 2: Installing Elastic Stack

Leave a Reply

x

We use cookies to ensure the best possible experience on our website. Detailed information on the use of cookies on this site is provided in our Privacy and Cookie Policy. Further instruction on how to disable our cookies can be found there.