C2 Server Installation for RedELK and Filebeat

Deploying a Command and Control (C2) server is an important part of preparing a red team infrastructure. When integrated with Filebeat and RedELK, a teamserver can forward operational logs to a central monitoring environment, helping security teams review activity and investigate events throughout an authorized engagement.

This guide explains how to install the C2 server logging components, configure Filebeat to send logs to RedELK, and troubleshoot common connectivity and configuration issues. Use these steps within an approved red team environment.

C2 Server Installation Requirements

Before starting, make sure you have the c2servers.tgz archive available on your C2 server and the connection details for your RedELK instance. You will also need the appropriate permissions to run the installer and configure the required services.

The installation process uses three parameters:

• Filebeat ID: A unique identifier for the teamserver within Filebeat and the RedELK logging setup.
• Scenario name: The name assigned to the red team engagement or attack scenario associated with the teamserver.
• RedELK endpoint: The IP address or DNS name and port used to forward logs to the RedELK server.

Review the official RedELK naming requirements before choosing identifiers. Consistent naming helps associate incoming logs with the correct teamserver and scenario.

How to Install the C2 Server Components

Copy the c2servers.tgz archive to the C2 server as part of your infrastructure deployment. Extract the archive using:

tar -xzf c2servers.tgz

Navigate to the extracted directory containing the installation script. Run the installer with the required parameters, replacing the example values with your environment’s actual configuration:

./install-c2server.sh <FilebeatID> <ScenarioName> <RedELK-IP-or-DNS:PORT>

For example, an authorized lab deployment might use a command structured like this:

./install-c2server.sh teamserver01 lab-assessment redelk.example.internal:5044

The hostname and port above are illustrative. Supply the endpoint configured for your own RedELK deployment. Even if you use the default Filebeat input port of TCP/5044, the installer expects the endpoint to be provided as a parameter.

What the Installer Configures

The installer prepares the C2 server’s log-forwarding components. Its documented tasks include:

• Checking whether Filebeat is already installed.
• Installing the certificates required for the configured logging connection.
• Updating the Filebeat configuration to match the supplied parameters.
• Starting the Filebeat service.
• Creating a local scponly user for restricted file-transfer operations.
• Restricting that user’s access to SSH key-based authentication for SCP, SFTP, and rsync.

The existing Filebeat installation deserves particular attention. Filebeat and the Elasticsearch and Logstash components in an ELK-based stack can have version compatibility requirements. Check the installed versions before proceeding, especially if the server already collects logs for another purpose.

For broader security monitoring, you can also explore Gitleaks for detecting exposed secrets as part of your wider security testing and development workflow.

Troubleshooting C2 Server Installation

If logs do not reach RedELK or the installation fails, start by reviewing the installer and Filebeat logs.

Review the Installer Output

Inspect redelk-install.log for errors reported during installation. Look for failed certificate operations, configuration changes, permission issues, or service startup failures.

Check Filebeat Logs

Depending on the Linux distribution and logging configuration, Filebeat messages may appear in its own log directory or in the system log:

/var/log/filebeat
/var/log/syslog

Confirm that Filebeat is monitoring the intended log files and can establish a connection to the RedELK endpoint. If no connection is established, check firewall rules, network reachability, the destination port, and the SSL settings in certs/config.cfg. Verify certificate paths and trust settings against your deployment configuration rather than disabling TLS verification.

Inspect RedELK Background Scripts

Review the files under /var/log/redelk/ for errors reported by background scripts. Compare their timestamps with the installation attempt and any failed log-forwarding events to narrow down the problem.

After troubleshooting, confirm that Filebeat is running, the configured log sources are being monitored, and the RedELK server is receiving events. Validate the setup with test activity in your authorized environment before relying on it during an engagement.

For the latest configuration guidance, consult the official RedELK project repository.