desaster/kippo — pull request #135 by ikoniaris (2014-07-26 23:07:02+00:00)
Title: Add ElasticSearch support to Kippo

Hi desaster.

This pull request adds ElasticSearch support to Kippo.

Configuration:
I have added a new section to the config file where the ES instance/cluster's values should be set.

Logging module:
I have added a new file named "elasticsearch.py" into kippo/dblog/elasticsearch.py in the same fashion as the other logging modules and followed the same function overwriting style.

Testing:
I have tested it myself and it works correctly. The login attempts can be visualized with Kibana, like in Kippo2ElasticSearch's case: http://bruteforce.gr/kippo2elasticsearch (see the screenshots). If you don't want to mess with installing ELK, you can use the latest version of HoneyDrive (released today!) to test it yourself: http://bruteforce.gr/honeydrive

Additional requirements:
1. pyes: https://pypi.python.org/pypi/pyes
2. GeoIP: https://pypi.python.org/pypi/GeoIP
3. A GeoIP.dat database from MaxMind: http://dev.maxmind.com/geoip/legacy/geolite/

Regarding number 3 above, I have included a database in the pull request that I use to initialize the geoip object I use for geolocating the remote IP. You can skip it if you like though and add an extra configuration option to kippo.cfg for the user to select whether to enable geolocation or not. If yes, he will have to manually download the GeoIP.dat file and unzip it in the root folder for example.

Extras:
I've also included a more proper .gitignore file. I should have opened another pull request for this perhaps but I was coding the ElasticSearch part at the same time.

Let me know what you think.