[DPI][suricata] suricata-4.0.3 安装部署

suricata 很值得借鉴。但是首先还是要安装使用，作为第一步的熟悉。

安装文档：https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_Installation

1. 先做个虚拟机：

┬─[tong@T7:~/VM/suricata-centos7]─[:: AM]
╰─>$ cat start.sh
#! /usr/bin/bash

sudo qemu-system-x86_64 -enable-kvm -nographic -vnc 127.0.0.1: \
        -m 2G -drive file=disk.img,if=virtio \
        -name suricata \
        -device virtio-net-pci,netdev=dev0,mac='00:00:00:09:00:00' \
        -netdev tap,ifname=tap-suricata-ctrl,vhost=on,queues=,id=dev0 \
        -cdrom /home/tong/Data/ISO/CentOS--x86_64-DVD-.iso \
        &

2. 安装操作系统CentOS7

使用的版本：CentOS-7-x86_64-DVD-1708.iso  安装 infrastructure server

3. 安装必要的依赖

yum install gcc
yum install pcre-devel
yum install libyaml-devel
yum install libpcap-devel
yum install lua-devel
yum search zlib-devel

4. 从源码编译安装

版本：suricata-4.0.3.tar.gz

编译安装：

[root@suricata suricata-4.0.]# ./configure --prefix=/suricata/usr --sysconfdir=/suricata/etc --localstatedir=/suricata/var --enable-nfqueue --enable-lua
[root@suricata suricata-4.0.]# mak
[root@suricata suricata-4.0.]# make install

都安装了哪些东西？

[root@suricata suricata]# tree
.
└── usr
    ├── bin
    │   ├── suricata
    │   └── suricatasc
    ├── include
    │   └── htp
    │       ├── bstr_builder.h
    │       ├── bstr.h
    │       ├── htp_base64.h
    │       ├── htp_config.h
    │       ├── htp_connection_parser.h
    │       ├── htp_core.h
    │       ├── htp_decompressors.h
    │       ├── htp.h
    │       ├── htp_hooks.h
    │       ├── htp_list.h
    │       ├── htp_multipart.h
    │       ├── htp_table.h
    │       ├── htp_transaction.h
    │       ├── htp_urlencoded.h
    │       ├── htp_utf8_decoder.h
    │       └── htp_version.h
    ├── lib
    │   ├── libhtp.a
    │   ├── libhtp.la
    │   ├── libhtp.so -> libhtp.so.2.0.
    │   ├── libhtp.so. -> libhtp.so.2.0.
    │   ├── libhtp.so.2.0.
    │   ├── pkgconfig
    │   │   └── htp.pc
    │   └── python2.
    │       └── site-packages
    │           ├── suricatasc
    │           │   ├── __init__.py
    │           │   ├── __init__.pyc
    │           │   ├── suricatasc.py
    │           │   └── suricatasc.pyc
    │           └── suricatasc-0.9-py2..egg-info
    └── share
        ├── doc
        │   └── suricata
        │       ├── AUTHORS
        │       ├── Basic_Setup.txt
        │       ├── CentOS_56_Installation.txt
        │       ├── CentOS5.txt
        │       ├── Debian_Installation.txt
        │       ├── Fedora_Core.txt
        │       ├── FreeBSD_8.txt
        │       ├── GITGUIDE
        │       ├── HTP_library_installation.txt
        │       ├── INSTALL
        │       ├── Installation_from_GIT_with_PCRE-JIT.txt
        │       ├── Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1104.txt
        │       ├── Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6.txt
        │       ├── Installation_with_CUDA_and_PF_RING_on_Ubuntu_server_1104.txt
        │       ├── Installation_with_CUDA_on_Scientific_Linux_6.txt
        │       ├── Installation_with_CUDA_on_Ubuntu_server_1104.txt
        │       ├── Installation_with_PF_RING.txt
        │       ├── INSTALL.PF_RING
        │       ├── INSTALL.WINDOWS
        │       ├── Mac_OS_X_106x.txt
        │       ├── NEWS
        │       ├── OpenBSD_Installation_from_GIT.txt
        │       ├── README
        │       ├── Setting_up_IPSinline_for_Linux.txt
        │       ├── Third_Party_Installation_Guides.txt
        │       ├── TODO
        │       ├── Ubuntu_Installation_from_GIT.txt
        │       ├── Ubuntu_Installation.txt
        │       └── Windows.txt
        └── man
            └── man1
                └── suricata.

 directories,  files
[root@suricata suricata]# 

有个man手册，因为我没有直接安装在根目录，所以可以这样打开：

[root@suricata suricata]# man -M /suricata/usr/share/man/ suricata

装完了是没法运行的，还需要配置。自动化配置：

[root@suricata suricata-4.0.3]# make install-conf 
install -d "/suricata/etc/suricata/"
install -d "/suricata/var/log/suricata/files"
install -d "/suricata/var/log/suricata/certs"
install -d "/suricata/var/run/"
install -m 770 -d "/suricata/var/run/suricata"

那么，部署了哪些东西呢？

[root@suricata suricata-4.0.]# diff org install-conf
74a75,
> /suricata/etc
> /suricata/etc/suricata
> /suricata/etc/suricata/suricata.yaml
> /suricata/etc/suricata/classification.config
> /suricata/etc/suricata/reference.config
> /suricata/etc/suricata/threshold.config
> /suricata/var
> /suricata/var/log
> /suricata/var/log/suricata
> /suricata/var/log/suricata/files
> /suricata/var/log/suricata/certs
> /suricata/var/run
> /suricata/var/run/suricata
[root@suricata suricata-4.0.]# 

启动：

[root@suricata ~]# /suricata/usr/bin/suricata -c /suricata/etc/suricata/suricata.yaml -i eth0
// -- :: - <Notice> - This is Suricata version 4.0. RELEASE
// -- :: - <Warning> - [ERRCODE: SC_ERR_NO_RULES()] - No rule files match the pattern /suricata/etc/suricata/rules/botcc.rules
// -- :: - <Warning> - [ERRCODE: SC_ERR_NO_RULES()] - No rule files match the pattern /suricata/etc/suricata/rules/ciarmy.rules
// -- :: - <Warning> - [ERRCODE: SC_ERR_NO_RULES()] - No rule files match the pattern /suricata/etc/suricata/rules/compromised.rules
... ...

安装规则：

在安装的过程中，程序会从网络上，下载最新的规则进行安装。

[root@suricata suricata-4.0.]# make install-rules
install -d "/suricata/etc/suricata/rules"
/usr/bin/wget -qO - https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz | tar -x -z -C "/suricata/etc/suricata/" -f -

You can now start suricata by running as root something like '/suricata/usr/bin/suricata -c /suricata/etc/suricata//suricata.yaml -i eth0'.

If a library like libhtp.so is not found, you can run suricata with:
'LD_LIBRARY_PATH=/suricata/usr/lib /suricata/usr/bin/suricata -c /suricata/etc/suricata//suricata.yaml -i eth0'.

While rules are installed now, it's highly recommended to use a rule manager for maintaining rules.
The two most common are Oinkmaster and Pulledpork. For a guide see:
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Rule_Management_with_Oinkmaster

引申一下: 这里提到了rule manager, 基本上来说,就是用来更新规则的, 可以参考阅读:

http://suricata.readthedocs.io/en/latest/rule-management/index.html

安装规则的时候, 都安装了些什么东西呢?

[root@suricata ~]# diff old new
80a81,
> /suricata/etc/suricata/rules
> /suricata/etc/suricata/rules/emerging-ftp.rules
> /suricata/etc/suricata/rules/emerging-activex.rules
> /suricata/etc/suricata/rules/dshield.rules
> /suricata/etc/suricata/rules/emerging-pop3.rules
> /suricata/etc/suricata/rules/emerging-web_specific_apps.rules
> /suricata/etc/suricata/rules/emerging-icmp.rules
> /suricata/etc/suricata/rules/suricata-1.3-etpro-etnamed.yaml
> /suricata/etc/suricata/rules/emerging-scan.rules
> /suricata/etc/suricata/rules/emerging-current_events.rules
> /suricata/etc/suricata/rules/emerging-imap.rules
> /suricata/etc/suricata/rules/emerging-sql.rules
> /suricata/etc/suricata/rules/emerging-p2p.rules
> /suricata/etc/suricata/rules/drop.rules
> /suricata/etc/suricata/rules/emerging-worm.rules
> /suricata/etc/suricata/rules/suricata-1.3-open.yaml
> /suricata/etc/suricata/rules/emerging-snmp.rules
> /suricata/etc/suricata/rules/emerging-scada.rules
> /suricata/etc/suricata/rules/emerging-malware.rules
> /suricata/etc/suricata/rules/emerging-trojan.rules
> /suricata/etc/suricata/rules/emerging-inappropriate.rules
> /suricata/etc/suricata/rules/emerging-shellcode.rules
> /suricata/etc/suricata/rules/BSD-License.txt
> /suricata/etc/suricata/rules/botcc.portgrouped.rules
> /suricata/etc/suricata/rules/emerging-smtp.rules
> /suricata/etc/suricata/rules/emerging-web_server.rules
> /suricata/etc/suricata/rules/emerging-web_client.rules
> /suricata/etc/suricata/rules/compromised.rules
> /suricata/etc/suricata/rules/emerging-netbios.rules
> /suricata/etc/suricata/rules/botcc.rules
> /suricata/etc/suricata/rules/ciarmy.rules
> /suricata/etc/suricata/rules/emerging-tftp.rules
> /suricata/etc/suricata/rules/classification.config
> /suricata/etc/suricata/rules/rbn.rules
> /suricata/etc/suricata/rules/emerging.conf
> /suricata/etc/suricata/rules/emerging-attack_response.rules
> /suricata/etc/suricata/rules/emerging-deleted.rules
> /suricata/etc/suricata/rules/emerging-mobile_malware.rules
> /suricata/etc/suricata/rules/emerging-rpc.rules
> /suricata/etc/suricata/rules/tor.rules
> /suricata/etc/suricata/rules/rbn-malvertisers.rules
> /suricata/etc/suricata/rules/emerging-icmp_info.rules
> /suricata/etc/suricata/rules/emerging-exploit.rules
> /suricata/etc/suricata/rules/emerging-telnet.rules
> /suricata/etc/suricata/rules/emerging-user_agents.rules
> /suricata/etc/suricata/rules/gpl-2.0.txt
> /suricata/etc/suricata/rules/decoder-events.rules
> /suricata/etc/suricata/rules/stream-events.rules
> /suricata/etc/suricata/rules/smtp-events.rules
> /suricata/etc/suricata/rules/http-events.rules
> /suricata/etc/suricata/rules/dns-events.rules
> /suricata/etc/suricata/rules/tls-events.rules
> /suricata/etc/suricata/rules/modbus-events.rules
> /suricata/etc/suricata/rules/app-layer-events.rules
> /suricata/etc/suricata/rules/dnp3-events.rules
> /suricata/etc/suricata/rules/emerging-info.rules
> /suricata/etc/suricata/rules/emerging-chat.rules
> /suricata/etc/suricata/rules/LICENSE
> /suricata/etc/suricata/rules/emerging-misc.rules
> /suricata/etc/suricata/rules/suricata-4.0-enhanced-open.txt
> /suricata/etc/suricata/rules/reference.config
> /suricata/etc/suricata/rules/gen-msg.map
> /suricata/etc/suricata/rules/emerging-policy.rules
> /suricata/etc/suricata/rules/emerging-dns.rules
> /suricata/etc/suricata/rules/unicode.map
> /suricata/etc/suricata/rules/compromised-ips.txt
> /suricata/etc/suricata/rules/emerging-voip.rules
> /suricata/etc/suricata/rules/suricata-1.2-prior-open.yaml
> /suricata/etc/suricata/rules/emerging-games.rules
> /suricata/etc/suricata/rules/emerging-dos.rules
> /suricata/etc/suricata/rules/sid-msg.map
[root@suricata ~]# 

再次启动:

[root@suricata ~]# /suricata/usr/bin/suricata -c /suricata/etc/suricata/suricata.yaml -i eth0
// -- :: - <Notice> - This is Suricata version 4.0. RELEASE
// -- :: - <Notice> - all  packet processing threads,  management threads initialized, engine started.

至此, 安装部署启动已完成.

下一篇:

[DPI][suricata] suricata 配置使用

一篇参考文章,还不错 :  构建基于Suricata+Splunk的IDS入侵检测系统

http://www.cnblogs.com/ssooking/p/IDS.html