正文

[DPI][suricata] suricata-4.0.3 安装部署

IP云
IP云V管理员/4 阅读
10/30
提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

suricata 很值得借鉴。但是首先还是要安装使用，作为第一步的熟悉。

安装文档：https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_Installation

1. 先做个虚拟机：

┬─[tong@T7:~/VM/suricata-centos7]─[:: AM]
╰─>$ cat start.sh
#! /usr/bin/bashsudo qemu-system-x86_64 -enable-kvm -nographic -vnc 127.0.0.1: \
-m 2G -drive file=disk.img,if=virtio \
-name suricata \
-device virtio-net-pci,netdev=dev0,mac='00:00:00:09:00:00' \
-netdev tap,ifname=tap-suricata-ctrl,vhost=on,queues=,id=dev0 \
-cdrom /home/tong/Data/ISO/CentOS--x86_64-DVD-.iso \
&

2. 安装操作系统CentOS7

使用的版本：CentOS-7-x86_64-DVD-1708.iso  安装 infrastructure server

3. 安装必要的依赖

yum install gcc
yum install pcre-devel
yum install libyaml-devel
yum install libpcap-devel
yum install lua-devel
yum search zlib-devel

4. 从源码编译安装

版本：suricata-4.0.3.tar.gz

编译安装：

[root@suricata suricata-4.0.]# ./configure --prefix=/suricata/usr --sysconfdir=/suricata/etc --localstatedir=/suricata/var --enable-nfqueue --enable-lua
[root@suricata suricata-4.0.]# mak
[root@suricata suricata-4.0.]# make install

都安装了哪些东西？

[root@suricata suricata]# tree
.
└── usr
├── bin
│   ├── suricata
│   └── suricatasc
├── include
│   └── htp
│   ├── bstr_builder.h
│   ├── bstr.h
│   ├── htp_base64.h
│   ├── htp_config.h
│   ├── htp_connection_parser.h
│   ├── htp_core.h
│   ├── htp_decompressors.h
│   ├── htp.h
│   ├── htp_hooks.h
│   ├── htp_list.h
│   ├── htp_multipart.h
│   ├── htp_table.h
│   ├── htp_transaction.h
│   ├── htp_urlencoded.h
│   ├── htp_utf8_decoder.h
│   └── htp_version.h
├── lib
│   ├── libhtp.a
│   ├── libhtp.la
│   ├── libhtp.so -> libhtp.so.2.0.
│   ├── libhtp.so. -> libhtp.so.2.0.
│   ├── libhtp.so.2.0.
│   ├── pkgconfig
│   │   └── htp.pc
│   └── python2.
│   └── site-packages
│   ├── suricatasc
│   │   ├── __init__.py
│   │   ├── __init__.pyc
│   │   ├── suricatasc.py
│   │   └── suricatasc.pyc
│   └── suricatasc-0.9-py2..egg-info
└── share
├── doc
│   └── suricata
│   ├── AUTHORS
│   ├── Basic_Setup.txt
│   ├── CentOS_56_Installation.txt
│   ├── CentOS5.txt
│   ├── Debian_Installation.txt
│   ├── Fedora_Core.txt
│   ├── FreeBSD_8.txt
│   ├── GITGUIDE
│   ├── HTP_library_installation.txt
│   ├── INSTALL
│   ├── Installation_from_GIT_with_PCRE-JIT.txt
│   ├── Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1104.txt
│   ├── Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6.txt
│   ├── Installation_with_CUDA_and_PF_RING_on_Ubuntu_server_1104.txt
│   ├── Installation_with_CUDA_on_Scientific_Linux_6.txt
│   ├── Installation_with_CUDA_on_Ubuntu_server_1104.txt
│   ├── Installation_with_PF_RING.txt
│   ├── INSTALL.PF_RING
│   ├── INSTALL.WINDOWS
│   ├── Mac_OS_X_106x.txt
│   ├── NEWS
│   ├── OpenBSD_Installation_from_GIT.txt
│   ├── README
│   ├── Setting_up_IPSinline_for_Linux.txt
│   ├── Third_Party_Installation_Guides.txt
│   ├── TODO
│   ├── Ubuntu_Installation_from_GIT.txt
│   ├── Ubuntu_Installation.txt
│   └── Windows.txt
└── man
└── man1
└── suricata. directories, files
[root@suricata suricata]#

有个man手册，因为我没有直接安装在根目录，所以可以这样打开：

[root@suricata suricata]# man -M /suricata/usr/share/man/ suricata

装完了是没法运行的，还需要配置。自动化配置：

[root@suricata suricata-4.0.3]# make install-conf
install -d "/suricata/etc/suricata/"
install -d "/suricata/var/log/suricata/files"
install -d "/suricata/var/log/suricata/certs"
install -d "/suricata/var/run/"
install -m 770 -d "/suricata/var/run/suricata"

那么，部署了哪些东西呢？

[root@suricata suricata-4.0.]# diff org install-conf
74a75,
> /suricata/etc
> /suricata/etc/suricata
> /suricata/etc/suricata/suricata.yaml
> /suricata/etc/suricata/classification.config
> /suricata/etc/suricata/reference.config
> /suricata/etc/suricata/threshold.config
> /suricata/var
> /suricata/var/log
> /suricata/var/log/suricata
> /suricata/var/log/suricata/files
> /suricata/var/log/suricata/certs
> /suricata/var/run
> /suricata/var/run/suricata
[root@suricata suricata-4.0.]#

启动：

[root@suricata ~]# /suricata/usr/bin/suricata -c /suricata/etc/suricata/suricata.yaml -i eth0
// -- :: - <Notice> - This is Suricata version 4.0. RELEASE
// -- :: - <Warning> - [ERRCODE: SC_ERR_NO_RULES()] - No rule files match the pattern /suricata/etc/suricata/rules/botcc.rules
// -- :: - <Warning> - [ERRCODE: SC_ERR_NO_RULES()] - No rule files match the pattern /suricata/etc/suricata/rules/ciarmy.rules
// -- :: - <Warning> - [ERRCODE: SC_ERR_NO_RULES()] - No rule files match the pattern /suricata/etc/suricata/rules/compromised.rules
... ...

安装规则：

在安装的过程中，程序会从网络上，下载最新的规则进行安装。

[root@suricata suricata-4.0.]# make install-rules
install -d "/suricata/etc/suricata/rules"
/usr/bin/wget -qO - https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz | tar -x -z -C "/suricata/etc/suricata/" -f -You can now start suricata by running as root something like '/suricata/usr/bin/suricata -c /suricata/etc/suricata//suricata.yaml -i eth0'.If a library like libhtp.so is not found, you can run suricata with:
'LD_LIBRARY_PATH=/suricata/usr/lib /suricata/usr/bin/suricata -c /suricata/etc/suricata//suricata.yaml -i eth0'.While rules are installed now, it's highly recommended to use a rule manager for maintaining rules.
The two most common are Oinkmaster and Pulledpork. For a guide see:
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster

引申一下: 这里提到了rule manager, 基本上来说,就是用来更新规则的, 可以参考阅读:

http://suricata.readthedocs.io/en/latest/rule-management/index.html

安装规则的时候, 都安装了些什么东西呢?

[root@suricata ~]# diff old new
80a81,
> /suricata/etc/suricata/rules
> /suricata/etc/suricata/rules/emerging-ftp.rules
> /suricata/etc/suricata/rules/emerging-activex.rules
> /suricata/etc/suricata/rules/dshield.rules
> /suricata/etc/suricata/rules/emerging-pop3.rules
> /suricata/etc/suricata/rules/emerging-web_specific_apps.rules
> /suricata/etc/suricata/rules/emerging-icmp.rules
> /suricata/etc/suricata/rules/suricata-1.3-etpro-etnamed.yaml
> /suricata/etc/suricata/rules/emerging-scan.rules
> /suricata/etc/suricata/rules/emerging-current_events.rules
> /suricata/etc/suricata/rules/emerging-imap.rules
> /suricata/etc/suricata/rules/emerging-sql.rules
> /suricata/etc/suricata/rules/emerging-p2p.rules
> /suricata/etc/suricata/rules/drop.rules
> /suricata/etc/suricata/rules/emerging-worm.rules
> /suricata/etc/suricata/rules/suricata-1.3-open.yaml
> /suricata/etc/suricata/rules/emerging-snmp.rules
> /suricata/etc/suricata/rules/emerging-scada.rules
> /suricata/etc/suricata/rules/emerging-malware.rules
> /suricata/etc/suricata/rules/emerging-trojan.rules
> /suricata/etc/suricata/rules/emerging-inappropriate.rules
> /suricata/etc/suricata/rules/emerging-shellcode.rules
> /suricata/etc/suricata/rules/BSD-License.txt
> /suricata/etc/suricata/rules/botcc.portgrouped.rules
> /suricata/etc/suricata/rules/emerging-smtp.rules
> /suricata/etc/suricata/rules/emerging-web_server.rules
> /suricata/etc/suricata/rules/emerging-web_client.rules
> /suricata/etc/suricata/rules/compromised.rules
> /suricata/etc/suricata/rules/emerging-netbios.rules
> /suricata/etc/suricata/rules/botcc.rules
> /suricata/etc/suricata/rules/ciarmy.rules
> /suricata/etc/suricata/rules/emerging-tftp.rules
> /suricata/etc/suricata/rules/classification.config
> /suricata/etc/suricata/rules/rbn.rules
> /suricata/etc/suricata/rules/emerging.conf
> /suricata/etc/suricata/rules/emerging-attack_response.rules
> /suricata/etc/suricata/rules/emerging-deleted.rules
> /suricata/etc/suricata/rules/emerging-mobile_malware.rules
> /suricata/etc/suricata/rules/emerging-rpc.rules
> /suricata/etc/suricata/rules/tor.rules
> /suricata/etc/suricata/rules/rbn-malvertisers.rules
> /suricata/etc/suricata/rules/emerging-icmp_info.rules
> /suricata/etc/suricata/rules/emerging-exploit.rules
> /suricata/etc/suricata/rules/emerging-telnet.rules
> /suricata/etc/suricata/rules/emerging-user_agents.rules
> /suricata/etc/suricata/rules/gpl-2.0.txt
> /suricata/etc/suricata/rules/decoder-events.rules
> /suricata/etc/suricata/rules/stream-events.rules
> /suricata/etc/suricata/rules/smtp-events.rules
> /suricata/etc/suricata/rules/http-events.rules
> /suricata/etc/suricata/rules/dns-events.rules
> /suricata/etc/suricata/rules/tls-events.rules
> /suricata/etc/suricata/rules/modbus-events.rules
> /suricata/etc/suricata/rules/app-layer-events.rules
> /suricata/etc/suricata/rules/dnp3-events.rules
> /suricata/etc/suricata/rules/emerging-info.rules
> /suricata/etc/suricata/rules/emerging-chat.rules
> /suricata/etc/suricata/rules/LICENSE
> /suricata/etc/suricata/rules/emerging-misc.rules
> /suricata/etc/suricata/rules/suricata-4.0-enhanced-open.txt
> /suricata/etc/suricata/rules/reference.config
> /suricata/etc/suricata/rules/gen-msg.map
> /suricata/etc/suricata/rules/emerging-policy.rules
> /suricata/etc/suricata/rules/emerging-dns.rules
> /suricata/etc/suricata/rules/unicode.map
> /suricata/etc/suricata/rules/compromised-ips.txt
> /suricata/etc/suricata/rules/emerging-voip.rules
> /suricata/etc/suricata/rules/suricata-1.2-prior-open.yaml
> /suricata/etc/suricata/rules/emerging-games.rules
> /suricata/etc/suricata/rules/emerging-dos.rules
> /suricata/etc/suricata/rules/sid-msg.map
[root@suricata ~]#

再次启动:

[root@suricata ~]# /suricata/usr/bin/suricata -c /suricata/etc/suricata/suricata.yaml -i eth0
// -- :: - <Notice> - This is Suricata version 4.0. RELEASE
// -- :: - <Notice> - all packet processing threads, management threads initialized, engine started.

至此, 安装部署启动已完成.

下一篇:

[DPI][suricata] suricata 配置使用

一篇参考文章,还不错 :  构建基于Suricata+Splunk的IDS入侵检测系统

http://www.cnblogs.com/ssooking/p/IDS.html