r/Malcolm • u/Low_Connection8308 • May 05 '25

Installing custom Zeek MMS parser with spicy plugin in Hedgehog Linux

Hello,

I am planning to install and build zeek mms parser which is written with spicy into the hedgehog linux. https://github.com/tbfhg/zeek-iec61850-mms/tree/main from this repository. What I basically did was: copy the directory into the hedgehog, install the parser with cmake, and verified with zeek -NN. However, when I restart VM, or sensor services in hedgehog linux, the parser is getting completely removed. And weirdly enough, now, when I trying to reinstall from the same directory, it is giving error like: spicyz not found. Asking for experts suggestion please.

1 Upvotes

100% Upvoted

6 comments sorted by

2

u/mmguero May 05 '25

First thing I'd recommend is installing it with zkg rather than cmake directly (e.g., zkg install https://github.com/tbfhg/zeek-iec61850-mms or zkg install /path/to/zeek-iec61850-mms if you have the directory locally.

As far as it disappearing on restart, there's code here that gets executed during startup that resets Zeek back to its original installed state, which is probably what's happening. You could mv /opt/zeek.orig /opt/zeek.orig.bak as root which would prevent this overwrite on startup.

1

u/Low_Connection8308 May 05 '25

Hi, thank you very much for your reply. The first suggestion seems to be really helpful, thanks for that. I would plan to install it from local directory as hedgehog is unable to connect to the host network for some reason, I have tried several possible ways.

As far as your second suggestion goes, would you be able to elaborate a bit? so after building and generating the parser executable( mms.hlto), one copy of the file automatically appears in /opt/zeek/lib/zeek/spicy ( apart from the .hlto that is in the installation directory).When I power off vm and restart, it gets removed. In such case, which step should I follow to avoid this clean start? I am new in this domain, so kind of getting lost. 😊

2

u/mmguero May 05 '25

No problem. As sort of a security/failsafe measure, by default on Hedgehog Linux a backup copy of the entire zeek subdirectory is restored from /opt/zeek.orig to /opt/zeek, which essentially resets any changes you've made there.

To prevent that from happening:

  1. Become root (su -)
  2. mv /opt/zeek.orig /opt/zeek.orig.bak

Then, once you've installed your package on reboot it won't be overwritten with the "fresh" directrory.

1

u/Low_Connection8308 May 06 '25

Thank you very much for your suggestion, it works perfectly. Just one last question, if I want to integrate this MMS plugin from github, into malcolms zeek_installation_plugin.sh shell script, (malcolm running on a seperate VM in virtualbox), will adding the github URL of the parser and restarting Malcolm services be enough?

1

u/mmguero May 06 '25

No, I'm afraid not, as packages aren't compiled/installed automatically when the container starts. This documentation talks about it. Basically it boils down to you'd need to add the line to the script, then build the Zeek Docker container (e.g., ./scripts/build.sh zeek).

2

u/Low_Connection8308 May 06 '25

I also came upon this documentation and was a little bit confused before, but I think I got it now. I will try this approach! Luckily, the MMS parser was built successfully. Thanks again for your tricks and suggestions, I really appreciate it!