Configuration
Database Configuration

Type in the following commands:

mysqladmin -u root -p create nepenthesfe
mysql -u root -p nepenthesfe < {path of NepenthesFE}/schema.sql
						
Config.phpConfiguration

Set the following variables in config.php:-

  • Set the connection details of database namely
    • Database type
    • Database host
    • Database Name
    • Database username
    • Database password
    • NepenthesFE
  • Set the language path
  • Set the path of server URL
  • Set the path of log file
  • Set the path of afterglow script
  • Set the path of visual folder
  • Set the path of visual folder in URL form
  • Set the path of XML Dump.(used only for html based parsing of virustotal details.)
  • li>Set the path of XML dump in URL form.(used only for html based parsing of virustotal details.)
  • Set the path of tmp location (default being set to the tmp location of mysql server.)
  • Enable disable modules based on requirements. ( The certain modules like geoip, ASN and Virustotal have become the integral part of the system as are being used outside there scope hence turning them off is not recomended)
Afterglow Configuration

The following are points needed to be configured:-

  • Give read and write permision on tmpfolder where in both mysql and www-data can add files and delete files. (By default set to tmp location of mysql i.e.:- /var/lib/mysql/ )
  • There are four type of graphs that can be produced namely( user can choose any one of them to produce graph and set it in config.php $gviz variable.):-
    • neato (best one)
    • Twopi
    • Dot
    • circo
Configuring modules

The details modules have to configuring are as follows:

Bitdefender

please adapt filesystem path to the "bdscan" file
if neccessary (defaults to /opt/BitDefender-scanner/bin/bdscan)

please adapt options for execution of "bdscan" file, if neccessary (defaults to --files --arc --log=/var/log/bitdefender.log --append)
File
please adapt filesystem path to the "file" executable 
if neccessary (defaults to /usr/bin/file) 
Geoip
please adapt path to your 'GeoLiteCity.dat' file 
if neccessary (defaults to /usr/share/GeoIP/GeoLiteCity.dat) 

Objdump
please adapt filesystem path to the "objdump" executable 
if neccessary (defaults to /usr/bin/objdump),

please adapt options for execution of "objdump" file if neccessary (defaults to -a -f -p -h)
Strings
please adapt filesystem path to the "strings" executable 
if neccessary (defaults to /usr/bin/strings), 
Upx
please adapt filesystem path to the "upx" executable, 
if neccessary (defaults to /usr/bin/upx),

please adapt options for execution of "upx" file if neccessary(defaults to -t)
Virustotal
  • CASE1
  • please adapt "virustotal_sender" to contain your email address, 
    please adapt"pop3_server" to contain your pop3 server,

    please adapt the pop3 credentials, please adapt the SMTP server to be used for sending mail
  • CASE2
  • Please adapt the path of vtscan script and of the url path in cron job  
    * */2 * * * {path of nepenthesFE}/modules/virustotal/vtscan

    Grant the bash script execute permission to script {path of nepenthesFE}/modules/virustotal/vtscan

    Add wirte permision to The folder {path to nepenthesFE}/modules/virustotal/xmldump for user www-data.

    Adapt the path of xmldump, mw and ovscan.pl in script vtscan in {path to nepenthesFE}/modules/virustotal/
Packer Info.
Copy the file userdb.txt to /usr/local/etc/ folder
Adapt the path of packerid.py in {path to nepentheFE}/module/packer/packer.php 
Peinfo Info.
Copy the file userdb.txt to /usr/local/etc/ folder
Adapt the path of packerid.py in {path to nepentheFE}/module/peinfo/peinfo.php 
Section Info.
Copy the file userdb.txt to /usr/local/etc/ folder 
Adapt the path of packerid.py in {path to 
nepentheFE}/module/section/section.php 
Permission to be set

The details of the permission to be set for www-data are as follows:-

  • Write permision in following areas.
    • {path to nepenthes}/mw/
    • {path to nepenthes}/images/
    • {path to nepenthes}/rrd/
    • {path to nepenthes}/visual/
    • {path to nepenthes}/gmap/
    • {path to nepenthes}/module/virustotal/xmldump/
    • /var/lib/mysql (or path that has been set to $tmplocation in config.php)
  • Execute permision for
    • {path to nepenthes}/visual/afterglow/src/perl/graph/afteglow.pl
    • {path to nepenthes}/module/virustotal/ovscan.pl
    • {path to nepenthes}/packerid.py

The details of the permission to be set for mysql are as follows:-

  • Write permision in following areas.
    • /var/lib/mysql (or path that has been set to $tmplocation in config.php)