84 lines
1.9 KiB
Plaintext
84 lines
1.9 KiB
Plaintext
|
|
# Installation of Suricata (CentOS 9) with support for the "nfq" module
|
|
############################################################################
|
|
|
|
##### Option 1: Install via YUM package manager
|
|
yum install epel-release -y
|
|
yum install suricata
|
|
|
|
# Check that suricata has support for NFQ
|
|
suricata --build-info | grep NFQ
|
|
# Update rules
|
|
suricata-update
|
|
# Check configuration
|
|
suricata -T -c /etc/suricata/suricata.yaml
|
|
|
|
|
|
##### Option 2: Install from source
|
|
##### Download and install required packages
|
|
yum install epel-release -y
|
|
dnf config-manager --set-enabled crb
|
|
yum groupinstall "Development Tools" -y
|
|
##### Download and install required packages
|
|
yum install epel-release -y
|
|
dnf config-manager --set-enabled crb
|
|
yum groupinstall "Development Tools" -y
|
|
|
|
yum install -y \
|
|
libpcap-devel \
|
|
pcre-devel \
|
|
libyaml-devel \
|
|
file-devel \
|
|
jansson-devel \
|
|
libcap-ng-devel \
|
|
libnetfilter_queue-devel \
|
|
libnfnetlink-devel \
|
|
libnetfilter_queue \
|
|
zlib-devel \
|
|
pcre2-devel \
|
|
rust cargo \
|
|
wget \
|
|
tar
|
|
|
|
|
|
# Download the latest stable version of Suricata
|
|
cd /usr/src/
|
|
wget https://www.openinfosecfoundation.org/download/suricata-8.0.3.tar.gz
|
|
tar zxvf suricata-8.0.3.tar.gz
|
|
|
|
# Compile and install
|
|
cd suricata-8.0.3/
|
|
./configure --enable-nfqueue
|
|
|
|
make -j$(nproc)
|
|
make install
|
|
make install-conf
|
|
make install-rules
|
|
ldconfig
|
|
|
|
# Update rules
|
|
/usr/local/bin/suricata-update
|
|
|
|
|
|
##### Check configuration
|
|
/usr/local/bin/suricata --build-info | grep NFQ
|
|
suricata -T -c /usr/local/etc/suricata/suricata.yaml
|
|
|
|
|
|
##### Example usage
|
|
|
|
# Send packets to suricata via NFQUEUE
|
|
iptables -A OUTPUT -j NFQUEUE --queue-num 0
|
|
iptables -A INPUT -j NFQUEUE --queue-num 0
|
|
|
|
# Run suricata in inline mode (queue 0)
|
|
suricata -q 0 -c /usr/local/etc/suricata/suricata.yaml
|
|
|
|
|
|
##### Check logs
|
|
# Analisar alertas resumidos no ficheiro "fast.log"
|
|
cat fast.log
|
|
# Analisar informação detalhada dos ataques no formato JSON no ficheiro "eve.json"
|
|
cat eve.json | jq 'select(.event_type=="alert")' | more
|
|
|