Install Zeek¶

Build an offline package bundle on an internet-connected Ubuntu host, transfer it to the isolated sensor, and install Zeek.

Before you begin

Use an authorised lab host and record the Zeek version, operating-system version, interface name, and command output used for validation.

Install Zeek offline¶

On an Ubuntu machine with internet connection:

Make a folder called zeek-offline and change permission of the directory.

mkdir zeek-offline
cd zeek-offline
sudo chmod 755 ~/zeek-offline/

Add the Zeek repository and download the Zeek package and its dependencies:

echo 'deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/ /' | sudo tee /etc/apt/sources.list.d/security:zeek.list
curl -fsSL https://download.opensuse.org/repositories/security:zeek/xUbuntu_22.04/Release.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null
sudo apt update
sudo apt-get install --download-only zeek 
sudo apt-get download zeek-core zeekctl zeek-core-dev zeek-spicy-dev zeek-zkg zeek-client \
libbroker-dev libpcap-dev libssl-dev zlib1g-dev libmaxminddb-dev python3-semantic-version python3-git zeek-btest zeek-btest-data \
libpcap0.8-dev libssl3=3.0.2-0ubuntu1.18 git python3-gitdb libc6-dev \
liberror-perl git-man libdbus-1-dev python3-smmap rpcsvc-proto libtirpc-dev \
libc-dev-bin linux-libc-dev libcrypt-dev libnsl-dev pkg-config libdpkg-perl \
zeek-aux

Note: if you get a permission denied error, run the command again.

Make a directory called curl and change permission of the directory.

mkdir curl
cd curl
sudo chmod 755 ~/curl/

Download curl and its dependencies.

sudo apt-get download curl libc6 libcurl4 zlib1g

Transfer zeek-offline and curl to an Ubuntu host without internet access.

Install curl:

cd curl
sudo dpkg -i *

Install Zeek:

cd zeek-offline
sudo dpkg -i *

Installation checkpoint

Confirm that /opt/zeek/bin/zeek --version and /opt/zeek/bin/zeekctl --help run successfully on the offline host.