[DPI][suricata] suricata-4.0.3 安装部署

时间：2024-01-03 09:48:02

suricata 很值得借鉴。但是首先还是要安装使用，作为第一步的熟悉。

安装文档：https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_Installation

1. 先做个虚拟机：

┬─[tong@T7:~/VM/suricata-centos7]─[:: AM]

╰─>$ cat start.sh

#! /usr/bin/bash

sudo qemu-system-x86_64 -enable-kvm -nographic -vnc 127.0.0.1: \

        -m 2G -drive file=disk.img,if=virtio \

        -name suricata \

        -device virtio-net-pci,netdev=dev0,mac='00:00:00:09:00:00' \

        -netdev tap,ifname=tap-suricata-ctrl,vhost=on,queues=,id=dev0 \

        -cdrom /home/tong/Data/ISO/CentOS--x86_64-DVD-.iso \

        &

2. 安装操作系统CentOS7

使用的版本：CentOS-7-x86_64-DVD-1708.iso  安装 infrastructure server

3. 安装必要的依赖

yum install gcc

yum install pcre-devel

yum install libyaml-devel

yum install libpcap-devel

yum install lua-devel

yum search zlib-devel

4. 从源码编译安装

版本：suricata-4.0.3.tar.gz

编译安装：

[root@suricata suricata-4.0.]# ./configure --prefix=/suricata/usr --sysconfdir=/suricata/etc --localstatedir=/suricata/var --enable-nfqueue --enable-lua

[root@suricata suricata-4.0.]# mak

[root@suricata suricata-4.0.]# make install

都安装了哪些东西？

[root@suricata suricata]# tree

.

└── usr

    ├── bin

    │   ├── suricata

    │   └── suricatasc

    ├── include

    │   └── htp

    │       ├── bstr_builder.h

    │       ├── bstr.h

    │       ├── htp_base64.h

    │       ├── htp_config.h

    │       ├── htp_connection_parser.h

    │       ├── htp_core.h

    │       ├── htp_decompressors.h

    │       ├── htp.h

    │       ├── htp_hooks.h

    │       ├── htp_list.h

    │       ├── htp_multipart.h

    │       ├── htp_table.h

    │       ├── htp_transaction.h

    │       ├── htp_urlencoded.h

    │       ├── htp_utf8_decoder.h

    │       └── htp_version.h

    ├── lib

    │   ├── libhtp.a

    │   ├── libhtp.la

    │   ├── libhtp.so -> libhtp.so.2.0.

    │   ├── libhtp.so. -> libhtp.so.2.0.

    │   ├── libhtp.so.2.0.

    │   ├── pkgconfig

    │   │   └── htp.pc

    │   └── python2.

    │       └── site-packages

    │           ├── suricatasc

    │           │   ├── __init__.py

    │           │   ├── __init__.pyc

    │           │   ├── suricatasc.py

    │           │   └── suricatasc.pyc

    │           └── suricatasc-0.9-py2..egg-info

    └── share

        ├── doc

        │   └── suricata

        │       ├── AUTHORS

        │       ├── Basic_Setup.txt

        │       ├── CentOS_56_Installation.txt

        │       ├── CentOS5.txt

        │       ├── Debian_Installation.txt

        │       ├── Fedora_Core.txt

        │       ├── FreeBSD_8.txt

        │       ├── GITGUIDE

        │       ├── HTP_library_installation.txt

        │       ├── INSTALL

        │       ├── Installation_from_GIT_with_PCRE-JIT.txt

        │       ├── Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1104.txt

        │       ├── Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6.txt

        │       ├── Installation_with_CUDA_and_PF_RING_on_Ubuntu_server_1104.txt

        │       ├── Installation_with_CUDA_on_Scientific_Linux_6.txt

        │       ├── Installation_with_CUDA_on_Ubuntu_server_1104.txt

        │       ├── Installation_with_PF_RING.txt

        │       ├── INSTALL.PF_RING

        │       ├── INSTALL.WINDOWS

        │       ├── Mac_OS_X_106x.txt

        │       ├── NEWS

        │       ├── OpenBSD_Installation_from_GIT.txt

        │       ├── README

        │       ├── Setting_up_IPSinline_for_Linux.txt

        │       ├── Third_Party_Installation_Guides.txt

        │       ├── TODO

        │       ├── Ubuntu_Installation_from_GIT.txt

        │       ├── Ubuntu_Installation.txt

        │       └── Windows.txt

        └── man

            └── man1

                └── suricata.

 directories,  files

[root@suricata suricata]#

有个man手册，因为我没有直接安装在根目录，所以可以这样打开：

[root@suricata suricata]# man -M /suricata/usr/share/man/ suricata

装完了是没法运行的，还需要配置。自动化配置：

[root@suricata suricata-4.0.3]# make install-conf 
install -d "/suricata/etc/suricata/"
install -d "/suricata/var/log/suricata/files"
install -d "/suricata/var/log/suricata/certs"
install -d "/suricata/var/run/"
install -m 770 -d "/suricata/var/run/suricata"

那么，部署了哪些东西呢？

[root@suricata suricata-4.0.]# diff org install-conf

74a75,

> /suricata/etc

> /suricata/etc/suricata

> /suricata/etc/suricata/suricata.yaml

> /suricata/etc/suricata/classification.config

> /suricata/etc/suricata/reference.config

> /suricata/etc/suricata/threshold.config

> /suricata/var

> /suricata/var/log

> /suricata/var/log/suricata

> /suricata/var/log/suricata/files

> /suricata/var/log/suricata/certs

> /suricata/var/run

> /suricata/var/run/suricata

[root@suricata suricata-4.0.]#

启动：

[root@suricata ~]# /suricata/usr/bin/suricata -c /suricata/etc/suricata/suricata.yaml -i eth0

// -- :: - <Notice> - This is Suricata version 4.0. RELEASE

// -- :: - <Warning> - [ERRCODE: SC_ERR_NO_RULES()] - No rule files match the pattern /suricata/etc/suricata/rules/botcc.rules

// -- :: - <Warning> - [ERRCODE: SC_ERR_NO_RULES()] - No rule files match the pattern /suricata/etc/suricata/rules/ciarmy.rules

// -- :: - <Warning> - [ERRCODE: SC_ERR_NO_RULES()] - No rule files match the pattern /suricata/etc/suricata/rules/compromised.rules

... ...

安装规则：

在安装的过程中，程序会从网络上，下载最新的规则进行安装。

[root@suricata suricata-4.0.]# make install-rules

install -d "/suricata/etc/suricata/rules"

/usr/bin/wget -qO - https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz | tar -x -z -C "/suricata/etc/suricata/" -f -

You can now start suricata by running as root something like '/suricata/usr/bin/suricata -c /suricata/etc/suricata//suricata.yaml -i eth0'.

If a library like libhtp.so is not found, you can run suricata with:

'LD_LIBRARY_PATH=/suricata/usr/lib /suricata/usr/bin/suricata -c /suricata/etc/suricata//suricata.yaml -i eth0'.

While rules are installed now, it's highly recommended to use a rule manager for maintaining rules.

The two most common are Oinkmaster and Pulledpork. For a guide see:

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster

引申一下: 这里提到了rule manager, 基本上来说,就是用来更新规则的, 可以参考阅读:

http://suricata.readthedocs.io/en/latest/rule-management/index.html

安装规则的时候, 都安装了些什么东西呢?

[root@suricata ~]# diff old new

80a81,

> /suricata/etc/suricata/rules

> /suricata/etc/suricata/rules/emerging-ftp.rules

> /suricata/etc/suricata/rules/emerging-activex.rules

> /suricata/etc/suricata/rules/dshield.rules

> /suricata/etc/suricata/rules/emerging-pop3.rules

> /suricata/etc/suricata/rules/emerging-web_specific_apps.rules

> /suricata/etc/suricata/rules/emerging-icmp.rules

> /suricata/etc/suricata/rules/suricata-1.3-etpro-etnamed.yaml

> /suricata/etc/suricata/rules/emerging-scan.rules

> /suricata/etc/suricata/rules/emerging-current_events.rules

> /suricata/etc/suricata/rules/emerging-imap.rules

> /suricata/etc/suricata/rules/emerging-sql.rules

> /suricata/etc/suricata/rules/emerging-p2p.rules

> /suricata/etc/suricata/rules/drop.rules

> /suricata/etc/suricata/rules/emerging-worm.rules

> /suricata/etc/suricata/rules/suricata-1.3-open.yaml

> /suricata/etc/suricata/rules/emerging-snmp.rules

> /suricata/etc/suricata/rules/emerging-scada.rules

> /suricata/etc/suricata/rules/emerging-malware.rules

> /suricata/etc/suricata/rules/emerging-*.rules

> /suricata/etc/suricata/rules/emerging-inappropriate.rules

> /suricata/etc/suricata/rules/emerging-shellcode.rules

> /suricata/etc/suricata/rules/BSD-License.txt

> /suricata/etc/suricata/rules/botcc.portgrouped.rules

> /suricata/etc/suricata/rules/emerging-smtp.rules

> /suricata/etc/suricata/rules/emerging-web_server.rules

> /suricata/etc/suricata/rules/emerging-web_client.rules

> /suricata/etc/suricata/rules/compromised.rules

> /suricata/etc/suricata/rules/emerging-netbios.rules

> /suricata/etc/suricata/rules/botcc.rules

> /suricata/etc/suricata/rules/ciarmy.rules

> /suricata/etc/suricata/rules/emerging-tftp.rules

> /suricata/etc/suricata/rules/classification.config

> /suricata/etc/suricata/rules/rbn.rules

> /suricata/etc/suricata/rules/emerging.conf

> /suricata/etc/suricata/rules/emerging-attack_response.rules

> /suricata/etc/suricata/rules/emerging-deleted.rules

> /suricata/etc/suricata/rules/emerging-mobile_malware.rules

> /suricata/etc/suricata/rules/emerging-rpc.rules

> /suricata/etc/suricata/rules/tor.rules

> /suricata/etc/suricata/rules/rbn-malvertisers.rules

> /suricata/etc/suricata/rules/emerging-icmp_info.rules

> /suricata/etc/suricata/rules/emerging-exploit.rules

> /suricata/etc/suricata/rules/emerging-telnet.rules

> /suricata/etc/suricata/rules/emerging-user_agents.rules

> /suricata/etc/suricata/rules/gpl-2.0.txt

> /suricata/etc/suricata/rules/decoder-events.rules

> /suricata/etc/suricata/rules/stream-events.rules

> /suricata/etc/suricata/rules/smtp-events.rules

> /suricata/etc/suricata/rules/http-events.rules

> /suricata/etc/suricata/rules/dns-events.rules

> /suricata/etc/suricata/rules/tls-events.rules

> /suricata/etc/suricata/rules/modbus-events.rules

> /suricata/etc/suricata/rules/app-layer-events.rules

> /suricata/etc/suricata/rules/dnp3-events.rules

> /suricata/etc/suricata/rules/emerging-info.rules

> /suricata/etc/suricata/rules/emerging-chat.rules

> /suricata/etc/suricata/rules/LICENSE

> /suricata/etc/suricata/rules/emerging-misc.rules

> /suricata/etc/suricata/rules/suricata-4.0-enhanced-open.txt

> /suricata/etc/suricata/rules/reference.config

> /suricata/etc/suricata/rules/gen-msg.map

> /suricata/etc/suricata/rules/emerging-policy.rules

> /suricata/etc/suricata/rules/emerging-dns.rules

> /suricata/etc/suricata/rules/unicode.map

> /suricata/etc/suricata/rules/compromised-ips.txt

> /suricata/etc/suricata/rules/emerging-voip.rules

> /suricata/etc/suricata/rules/suricata-1.2-prior-open.yaml

> /suricata/etc/suricata/rules/emerging-games.rules

> /suricata/etc/suricata/rules/emerging-dos.rules

> /suricata/etc/suricata/rules/sid-msg.map

[root@suricata ~]#

再次启动:

[root@suricata ~]# /suricata/usr/bin/suricata -c /suricata/etc/suricata/suricata.yaml -i eth0

// -- :: - <Notice> - This is Suricata version 4.0. RELEASE

// -- :: - <Notice> - all  packet processing threads,  management threads initialized, engine started.

至此, 安装部署启动已完成.

下一篇:

[DPI][suricata] suricata 配置使用

一篇参考文章,还不错 :  构建基于Suricata+Splunk的IDS入侵检测系统

http://www.cnblogs.com/ssooking/p/IDS.html

相关文章