Cuckooで複数VMを動かす


Cuckooで複数のVMを動かしたい場合があると思います。
Cuckooはデフォルトのデータベースはsqliteなのですが、postgresqlかmysqlにしろ、と言われたのでMySQLにしました。
その時のメモです。

#環境
- ホストOS
 - Ubuntu 14.04
- cuckoo
 - 1.2-dev
- MySQL
 - 5.6.19

#参考
- [MySQLdbをインストールで mysql_config: not found](http://blog.kjirou.net/p/1949)

#設定
##Warning内容
SQLiteのままVMを複数動かそうとすると以下の様なメッセージが出ます。

```console
[lib.cuckoo.core.scheduler] WARNING: The SQLite database is not compatible with multi-threaded use-cases such as running multiple virtual machine in parallel. Please upgrade to PostgreSQL or MySQL when running multiple VMs.
```
ということでMySQLを入れます。

##MySQLのインストール
まずはMySQLをインストールします。

```console
$ sudo apt-get install mysql-server-5.6
```

この状態でcuckooを実行してみます。

```console
$ python ~/cuckoo/cukoo.py
Traceback (most recent call last):
  File "/home/cuckoo/cuckoo/cuckoo.py", line 95, in <module>
    test=args.test)
  File "/home/cuckoo/cuckoo/cuckoo.py", line 58, in cuckoo_init
    init_tasks()
  File "/home/cuckoo/cuckoo/lib/cuckoo/core/startup.py", line 165, in init_tasks
    db = Database()
  File "/home/cuckoo/cuckoo/lib/cuckoo/common/utils.py", line 183, in __call__
    cls._instances[cls] = super(Singleton, cls).__call__(*args, **kwargs)
  File "/home/cuckoo/cuckoo/lib/cuckoo/core/database.py", line 331, in __init__
    self.engine = create_engine(cfg.database.connection, poolclass=NullPool)
  File "/usr/lib/python2.7/dist-packages/sqlalchemy/engine/__init__.py", line 332, in create_engine
    return strategy.create(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/sqlalchemy/engine/strategies.py", line 64, in create
    dbapi = dialect_cls.dbapi(**dbapi_args)
  File "/usr/lib/python2.7/dist-packages/sqlalchemy/connectors/mysqldb.py", line 57, in dbapi
    return __import__('MySQLdb')
ImportError: No module named MySQLdb
Exception AttributeError: "'Database' object has no attribute 'engine'" in <bound method Database.__del__ of <lib.cuckoo.core.database.Database object at 0x7f95d7a34990>> ignored
```
MySQLdbがないと怒られます。

##MySQL-pythonのインストール
pipでMySQL-pythonを入れれば良いようです。

```console
$ sudo pip install MySQL-python
Downloading/unpacking MySQL-python
  Downloading MySQL-python-1.2.5.zip (108kB): 108kB downloaded
  Running setup.py (path:/tmp/pip_build_root/MySQL-python/setup.py) egg_info for package MySQL-python
    sh: 1: mysql_config: not found
    Traceback (most recent call last):
      File "<string>", line 17, in <module>
      File "/tmp/pip_build_root/MySQL-python/setup.py", line 17, in <module>
        metadata, options = get_config()
      File "setup_posix.py", line 43, in get_config
        libs = mysql_config("libs_r")
      File "setup_posix.py", line 25, in mysql_config
        raise EnvironmentError("%s not found" % (mysql_config.path,))
    EnvironmentError: mysql_config not found
    Complete output from command python setup.py egg_info:
    sh: 1: mysql_config: not found

Traceback (most recent call last):

  File "<string>", line 17, in <module>

  File "/tmp/pip_build_root/MySQL-python/setup.py", line 17, in <module>

    metadata, options = get_config()

  File "setup_posix.py", line 43, in get_config

    libs = mysql_config("libs_r")

  File "setup_posix.py", line 25, in mysql_config

    raise EnvironmentError("%s not found" % (mysql_config.path,))

EnvironmentError: mysql_config not found

----------------------------------------
Cleaning up...
Command python setup.py egg_info failed with error code 1 in /tmp/pip_build_root/MySQL-python
Storing debug log for failure in /home/cuckoo/.pip/pip.log
```
ということで何か怒られるので参考サイトに従って

```console
$ sudo apt-get install libmysqlclient-dev
```
としてから再度インストールします。

```console
$ sudo pip install mysql-python
Downloading/unpacking mysql-python
  Downloading MySQL-python-1.2.5.zip (108kB): 108kB downloaded
  Running setup.py (path:/tmp/pip_build_root/mysql-python/setup.py) egg_info for package mysql-python

Installing collected packages: mysql-python
  Running setup.py install for mysql-python
    building '_mysql' extension
    x86_64-linux-gnu-gcc -pthread -fno-strict-aliasing -DNDEBUG -g -fwrapv -O2 -Wall -Wstrict-prototypes -fPIC -Dversion_info=(1,2,5,'final',1) -D__version__=1.2.5 -I/usr/include/mysql -I/usr/include/python2.7 -c _mysql.c -o build/temp.linux-x86_64-2.7/_mysql.o -DBIG_JOINS=1 -fno-strict-aliasing -g -DNDEBUG
    In file included from _mysql.c:44:0:
    /usr/include/mysql/my_config.h:422:0: warning: "HAVE_WCSCOLL" redefined [enabled by default]
     #define HAVE_WCSCOLL
     ^
    In file included from /usr/include/python2.7/pyconfig.h:3:0,
                     from /usr/include/python2.7/Python.h:8,
                     from _mysql.c:29:
    /usr/include/x86_64-linux-gnu/python2.7/pyconfig.h:911:0: note: this is the location of the previous definition
     #define HAVE_WCSCOLL 1
     ^
    x86_64-linux-gnu-gcc -pthread -shared -Wl,-O1 -Wl,-Bsymbolic-functions -Wl,-Bsymbolic-functions -Wl,-z,relro -fno-strict-aliasing -DNDEBUG -g -fwrapv -O2 -Wall -Wstrict-prototypes -D_FORTIFY_SOURCE=2 -g -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security build/temp.linux-x86_64-2.7/_mysql.o -L/usr/lib/x86_64-linux-gnu -lmysqlclient_r
 -lpthread -lz -lm -ldl -o build/lib.linux-x86_64-2.7/_mysql.so

Successfully installed mysql-python
Cleaning up...
cuckoo@dhcp-135-86:~$ mysql -v
ERROR 1045 (28000): Access denied for user 'cuckoo'@'localhost' (using password: NO)
cuckoo@dhcp-135-86:~$ mysql --version
mysql  Ver 14.14 Distrib 5.6.19, for debian-linux-gnu (x86_64) using  EditLine wrapper
```
いけたっぽいです。

##設定ファイルの修正
最後に`cuckoo.conf`を修正すれば完了ですが、設定ファイルを修正する前にMySQLでcuckooという名前のデータベースを作っておきます。
インストールの時に決めたrootのパスワードは`password`とします。

```console
$ mysql -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 166
Server version: 5.6.19-0ubuntu0.14.04.1 (Ubuntu)

Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> create database cuckoo;
```

最後に設定ファイルを修正します。

```config:~/cuckoo/conf/cuckoo.conf
[database]
connection = mysql://root:password@localhost/cuckoo
```

この状態でcuckoo.pyを実行すれば複数VM起動できます。
念のため`kvm.conf`も書いておきますと、

```config:~/cuckoo/conf/kvm.conf
[kvm]
machines = Windows7_1,Windows7_2

[Windows7_1]
label = Windows7_1
platform = windows
ip = 192.168.124.2

[Windows7_2]
label = Windows7_2
platform = windows
ip = 192.168.124.3
```
こうしておくとWindows7二台で解析できます。