|
|
|
|
Autogenerated on 2012-11-29
|
|
|
|
|
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Debian_Installation
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Debian Installation
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Pre-installation requirements
|
|
|
|
|
|
|
|
|
|
Before you can build Suricata for your system, run the following command to
|
|
|
|
|
ensure that you have everything you need for the installation.
|
|
|
|
|
Make sure you will enter all the following commands as root/super-user,
|
|
|
|
|
otherwise it will not work.
|
|
|
|
|
|
|
|
|
|
apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \
|
|
|
|
|
build-essential autoconf automake libtool libpcap-dev libnet1-dev \
|
|
|
|
|
libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev \
|
|
|
|
|
pkg-config
|
|
|
|
|
|
|
|
|
|
Depending on the current status of your system, it may take a while to complete
|
|
|
|
|
this process.
|
|
|
|
|
|
|
|
|
|
HTP
|
|
|
|
|
|
|
|
|
|
HTP is bundled with Suricata and installed automatically. If you need to
|
|
|
|
|
install HTP manually for other reasons, instructions can be found at HTP
|
|
|
|
|
library_installation.
|
|
|
|
|
|
|
|
|
|
IPS
|
|
|
|
|
|
|
|
|
|
By default, Suricata works as an IDS. If you want to use it as a IDS and IPS
|
|
|
|
|
program, enter:
|
|
|
|
|
|
|
|
|
|
apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-
|
|
|
|
|
dev libnfnetlink0
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Suricata
|
|
|
|
|
|
|
|
|
|
To download and build Suricata, enter the following:
|
|
|
|
|
|
|
|
|
|
wget http://www.openinfosecfoundation.org/download/suricata-1.3.3.tar.gz
|
|
|
|
|
tar -xvzf suricata-1.3.3.tar.gz
|
|
|
|
|
cd suricata-1.3.3
|
|
|
|
|
|
|
|
|
|
Compile and install the program
|
|
|
|
|
If you plan to build Suricata with IPS capabilities, enter:
|
|
|
|
|
|
|
|
|
|
./configure --enable-nfqueue --prefix=/usr --sysconfdir=/etc --
|
|
|
|
|
localstatedir=/var
|
|
|
|
|
|
|
|
|
|
instead of
|
|
|
|
|
|
|
|
|
|
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
|
|
|
|
|
|
|
|
|
|
Continue with the next commands:
|
|
|
|
|
|
|
|
|
|
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
|
|
|
|
|
make
|
|
|
|
|
make install
|
|
|
|
|
|
|
|
|
|
To make sure the existing list with libraries will be updated with the new
|
|
|
|
|
library, enter:
|
|
|
|
|
|
|
|
|
|
ldconfig
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Auto setup
|
|
|
|
|
|
|
|
|
|
You can also use the available auto setup features of Suricata:
|
|
|
|
|
ex:
|
|
|
|
|
|
|
|
|
|
./configure && make && make install-conf
|
|
|
|
|
|
|
|
|
|
make install-conf
|
|
|
|
|
would do the regular "make install" and then it would automatically create/
|
|
|
|
|
setup all the necessary directories and suricata.yaml for you.
|
|
|
|
|
|
|
|
|
|
./configure && make && make install-rules
|
|
|
|
|
|
|
|
|
|
make install-rules
|
|
|
|
|
would do the regular "make install" and then it would automatically download
|
|
|
|
|
and set up the latest ruleset from Emerging Threats available for Suricata
|
|
|
|
|
|
|
|
|
|
./configure && make && make install-full
|
|
|
|
|
|
|
|
|
|
make install-full
|
|
|
|
|
would combine everything mentioned above (install-conf and install-rules) - and
|
|
|
|
|
will present you with a ready to run (configured and set up) Suricata
|
|
|
|
|
Please continue with the Basic_Setup.
|
