|
Technical documentation
Installing TITAN
First you must install the external components that our firewall uses. There are three such components: MySQL, ulog, and IPTables. These installers are all linked from the downloads page.
Next, download our tar file and untar it. This will extract the titan directory into the location you untarred it from, this can be done anywhere on your machine. Then, from within the titan directory you should type "make all". This should compile all of the files and make the executables for you.
Now, the last thing that you need to do before running TITAN is create and configure the MySQL database. The default credentials and database names are listed in the DB_Query/DB_Query.h header file, these should be changed to reflect your system. You then need to move the setup/ulog.conf file to /usr/local/etc/ and edit the credentials at the beginning of the file. Finally, you should run the command "mysql -u _user_ -p _yourDbNameHere_ < titan_tables.sql" from the setup directory with _user_ and _yourDbNameHere_ replaced appropriately. More detailed instructions can be found in the README.
Using TITAN
To run Titan, simply run the startTitan script from inside the titan directory. This does five different things. It configures IPTables for our firewall, deleting any preexisting rules or chains. It also starts four processes: ulogd, Sorter, flushrules, and Titan. These are explained in detail in the overview. To stop Titan, simply run the stopTitan script which also resides in the titan directory. This kills the four processes Titan starts, it leaves the IPTables rules as they were when the firewall was stopped. This means that whatever was being blocked will continue being blocked until you either restart the firewall or manually change your IPTables rules.
The procedure to load a specific list of connections is outlined in the training/README file.
If you wish to allow a specific kind of traffic that you have not previously seen, or you wish to change a connection's score you must manually edit the connections table in the ulogd database. The firewall must then be restarted, since the connection record in memory will not have updated. The easiest way to allow a new service is to generate traffic using the service and then manually rescore all of the connections so that they have a score of one. After this the firewall must be restarted, but it should then allow the service.
|