1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
|
.. _Installation from GIT:
Installation from GIT
=====================
Ubuntu Installation from GIT
----------------------------
This document will explain how to install and use the most recent code of
Suricata on Ubuntu. Installing from GIT on other operating systems is
basically the same, except that some commands are Ubuntu-specific
(like sudo and apt-get). In case you are using another operating system,
you should replace those commands with your OS-specific commands.
.. note::
These instructions were tested on Ubuntu 22.04.
Pre-installation requirements
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Before you can build Suricata for your system, run the following command
to ensure that you have everything you need for the installation.
.. code-block:: bash
sudo apt-get -y install libpcre2-dev build-essential autoconf \
automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev \
pkg-config zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 make \
libmagic-dev libjansson-dev rustc cargo jq git-core
Add ``${HOME}/.cargo/bin`` to your path:
.. code-block:: bash
export PATH=$PATH:${HOME}/.cargo/bin
cargo install --force cbindgen
Depending on the current status of your system, it may take a while to
complete this process.
**IPS**
By default, Suricata works as an IDS. If you want to use it as an IDS and IPS
program, enter:
.. code-block:: bash
sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 \
libnfnetlink-dev libnfnetlink0
Suricata
~~~~~~~~
First, it is convenient to create a directory for Suricata.
Name it 'suricata' or 'oisf', for example. Open the terminal and enter:
.. code-block:: bash
mkdir suricata # mkdir oisf
Followed by:
.. code-block:: bash
cd suricata # cd oisf
Next, enter the following line in the terminal:
.. code-block:: bash
git clone https://github.com/OISF/suricata.git
cd suricata
Libhtp and suricata-update are not bundled. Get them by doing:
.. code-block:: bash
./scripts/bundle.sh
Followed by:
.. code-block:: bash
./autogen.sh
To configure, please enter:
.. code-block:: bash
./configure
To compile, please enter:
.. code-block:: bash
make
To install Suricata, enter:
.. code-block:: bash
sudo make install
sudo ldconfig
Auto-setup
~~~~~~~~~~
You can also use the available auto-setup features of Suricata. Ex:
.. code-block:: bash
./configure && make && sudo make install-conf
*make install-conf*
would do the regular "make install" and then it would automatically
create/setup all the necessary directories and ``suricata.yaml`` for you.
.. code-block:: bash
./configure && make && make install-rules
*make install-rules*
would do the regular "make install" and then it would automatically download
and set-up the latest ruleset from Emerging Threats available for Suricata.
.. code-block:: bash
./configure && make && make install-full
*make install-full*
would combine everything mentioned above (install-conf and install-rules) -
and will present you with a ready to run (configured and set-up) Suricata.
Post installation
~~~~~~~~~~~~~~~~~
Please continue with :ref:`Basic setup`.
In case you have already created your Suricata directory and cloned the
repository in it, if you want to update your local repository with the
most recent code, please run:
.. code-block:: bash
cd suricata/suricata
next, enter:
.. code-block:: bash
git pull
After that, you should run *./autogen.sh* again.
|
