Issues with installation of OpenUBA

[ThomasGLAllen]

I've been examining OpenUBA to see its potential use in the future for our SOC. I have a few questions and issues:

1. Is this project a dissertation topic (M.S. or PhD)
2. Which flavor or version of Linux has OpenUBA been implemented on? I tested the installation instructions on SUSE and UBUNTU, both had the same issues.
3. What version of Python were you using to compile your code? Updated Python versions are notorious for redacting stuff from previous versions.
4. The "pip3 install requirements.txt" had issues with the versions listed in the file, so I manually installed them.
5. The make file crashed with the error that model.py was found twice under different modules (tried to attach an image, but got an error when trying to attach it).
6. Instead of using the make file, I manually tried to compile the modules under the core directory, and received syntax errors and dependency issues. This is why I was asking for the specific version of python you used.
7. Even though the make did not work correctly, I went ahead and tried to install Hadoop and it did not install on SUSE. I have yet to try it on UBUNTU.
   Any help would be appreciated. Thanks.
   Tom Allen

[ThomasGLAllen]

OK, update: I created a Python virtual environment and installed Python 3.7. Had to make changes to versions in requirements.txt. The make file appears to compile - waIting for it to finish. Negate my previous message.

[FatnLazy]

@ThomasGLAllen could you please share you requirements file i am running into the same issue you had

[ThomasGLAllen]

Sorry, just saw this. Yes, I can. Let me upload a copy of the make file. I'm in the process of troubleshooting it. I think I know what is going on. As I see it, there is a lack of documentation. OpenUBA lacks a lot of detailed documentation. What I have found out is that you need to run the make under python 3.7. I used the Python Virtual Environment to install python 3.7 and compiled under that virtual environment.I have to manually install the tools in the requirements.txt file before I ran the make. I've enclosed the results of the make file. As I said, there are a few errors - they don't look major. I'm in the process of looking at them.
OpenUBAoutputFromMake.odt

[ThomasGLAllen]

Forgot to say that I'm using OpenSUSE.
Also, is this project still alive. The last update I see is a TensorFlow update, but no updates to the OpenUBA code, or have I missed something here. Thanks.

[FatnLazy]

@ThomasGLAllen can you please share your make file i did everything till the make command and it seems like its working but when i try to do the test it tells me API error and for some reason i cannot run the web UI

[ThomasGLAllen]

Sorry for the delay in responding. I've been really busy at work and had no time to check my messages on OpenUBA. I'll respond tomorrow and give you details of what I did.

[ThomasGLAllen]

OK, what you need to do is be sure you are using python 3.7 and use UBUNTU (latest version is fine). The makefile will not run correctly if it's another version of python. The best way to do that is to set up a python virtual environment by installing virtualenv: pip install virtualenv. Once that is done, run pyenv install 3.7.0 and you will see that 3.7 is installed in /home/username/.pyenv/versions/3.7.0/bin. Next you need to create your virtual directory as follows: /home/username/.pyenv/versions/3.7.0/bin/python3.7 -m venv OpenUBA_ENV3.7. This creates the virtual directory OpenUBA_ENV3.7. Now, cd to bin and run "source activate" and then you have your python 3.7 environment separate from your python version you installed originally on your machine if you installed one. From the virtual directory, just follow the instructions given on the OpenUBA github page and run make. It runs with no API error, but the only error (and this is minor) is that it's looking for a connection to port 62000, but apparently runs the model to completion. I'm presently going through the code to see where that is coming from. The documentation for OpenUBA is really bad, so I would never recommend this on a production server. It's got a long way to go before anyone excepts it. Also in requirements.txt, be sure to install the exact versions that are specified in requirements.txt (except for flask and colorlogs - it won't be able to find those versions, so any version I found will work). In running make, you may get no module found for flack_cors and coloredlogs; just do pip install flack-cors and coloredlogs, and run make again, and it should go straight through without error (except for the port error I mentioned above). Let me know if you have any questions.