Setup MinIO (object storage)

We'll setup a server using MinIO and generate a pre-signed URL using the Python SDK so we can upload a triage collection.

I personally run MinIO in a Docker container and manage it with Portainer, however for this example we're going to use the Linux binaries for a quick proof of concept.

Download MinIO binary

Download AIStor High-Performance Object Storage | MinIOmin.io

wget https://dl.min.io/server/minio/release/linux-amd64/minio
chmod +x minio
MINIO_ROOT_USER=admin MINIO_ROOT_PASSWORD=password ./minio server /mnt/data --console-address ":9001"

The above series of commands downloads the minio executable, sets the executable flag (+x) and then executes it. The username/password are set as environment variables and passed to the executable. The executable is executed to run a server, with its data store at /mnt/data. The console address is not set (the blank part before :9001 indicates it's not set). The console port is set to 9001. Note: port 9000 is used for the API, port 9001 is used for the web interface.

To take this a step further (if you were going to run this in a production environment), you would perform the following steps on your MinIO server.

sudo apt install certbot
sudo mkdir /path/to/minio-datastore
sudo certbot certonly --manual --preferred-challenges dns --debug-challenges -d minio.yourdomain.com.au
(run through the process of setting your subdomain's TXT record for validation)

Default location for minio data is /root/.minio
Default location for minio certs is /root/.minio/certs

sudo cp /etc/letsencrypt/live/minio.yourdomain.com.au/fullchain.pem public.crt
sudo cp /etc/letsencrypt/live/minio.yourdomain.com.au/privkey.pem private.key
(minio requires your cert and private key to be named as the default values)

./minio server /path/to/minio-datastore --console-address "minio.yourdomain.com.au:9001" --address "minio.yourdomain.com.au:9000"

The above commands will generate an SSL certificate using LetsEncrypt You'll copy them to MinIO's certificates directory and rename them You'll execute MinIO as a server and specify the appropriate addresses. If you don't set the hostname, since your server's IP address is not set as a Subject Alternative Name (SAN), MinIO will throw errors. This is fine for browsing the web UI, but if you're going to run something like UAC (which we'll do shortly) you'll see that it won't verify and it'll cause issues.

You also need the MinIO client on your client workstation (where you want to administer buckets, users, permissions, and to ultimately generate a pre-signed URL).

$ wget https://dl.min.io/client/mc/release/linux-amd64/mc
$ chmod +x mc
$ mc alias set myminio/ http://MINIO-SERVER admin password

Browse to the web console (https://minio.yourdomain.com.au:9001) and select Buckets. Create a bucket and give it an appropriate name, my-bucket in this example.

We want to make sure our minio client is working via the command line first.

user@host:/home/user# mc ls minio
[2022-04-25 10:56:00 AEST]     0B my-bucket/

Replace 'minio' with the alias you set above (if you didn't use minio).

If you uploaded a test file to the bucket using the web interface, you can check whether it's visible using the mc client;

user@host:/home/user# mc ls minio/my-bucket
[2022-04-25 11:35:22 AEST] 234MiB STANDARD my-object

To summarise, we've deployed a MinIO server, encrypted communication with TLS, and we've created a test object. We've configured the MinIO client and verified we have visibility to the bucket called 'my-bucket'.