{"id":19520,"date":"2017-04-18T06:08:19","date_gmt":"2017-04-17T22:08:19","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/18\/%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%ae%89%e8%a3%9d-suricata-%e5%85%a5%e4%be%b5%e5%81%b5%e6%b8%ac%e7%b3%bb%e7%b5%b1\/"},"modified":"2021-03-18T17:25:00","modified_gmt":"2021-03-18T09:25:00","slug":"%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%ae%89%e8%a3%9d-suricata-%e5%85%a5%e4%be%b5%e5%81%b5%e6%b8%ac%e7%b3%bb%e7%b5%b1","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/04\/18\/%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%ae%89%e8%a3%9d-suricata-%e5%85%a5%e4%be%b5%e5%81%b5%e6%b8%ac%e7%b3%bb%e7%b5%b1\/","title":{"rendered":"\u5728 CentOS 7.x \u4e0a\u5b89\u88dd Suricata \u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71"},"content":{"rendered":"

Suricata \u548c Snort \u4e00\u6a23\uff0c\u90fd\u662f\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71\uff0c\u4e8c\u8005\u4e4b\u9593\u7684\u5dee\u7570\u53ef\u4ee5\u53c3\u8003\uff1a
Snort vs Suricata – Aanval Wiki<\/a><\/p>\n

Suricata \u5b98\u65b9\u7db2\u7ad9\uff1ahttps:\/\/oisf.net\/suricata\/<\/a>
\u53c3\u8003\u7db2\u7ad9\uff1a
\u6d6e\u96f2\u96c5\u7bc9: [\u7814\u7a76] Suricata 3.0 \u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71\u5b89\u88dd (CentOS 7.2 x64)<\/a>
\u5982\u4f55\u5728 Linux \u7cfb\u7d71\u4e0a\u5b89\u88dd Suricata \u5165\u4fb5\u6aa2\u6e2c\u7cfb\u7d71 – \u6bcf\u65e5\u982d\u689d<\/a>
Building an IDS on CentOS using Suricata<\/a>
CentOS Installation – Suricata – Open Information Security Foundation<\/a>
IT Security through Open Source : Suricata – wildcard rule loading<\/a><\/p>\n

1. \u5229\u7528 epel \u5957\u4ef6\u5eab\u5b89\u88dd Suricata
# yum install suricata –enablerepo=epel[@more@]<\/span>2. \u4e0b\u8f09 rules \u4e26\u89e3\u58d3\u7e2e
# wget http:\/\/rules.emergingthreats.net\/open\/suricata\/emerging.rules.tar.gz<\/span>
# tar xvzf suricata\/emerging.rules.tar.gz -C \/etc\/suricata<\/span><\/p>\n

3. \u6e2c\u8a66\u8a2d\u5b9a\u6a94 \/etc\/suricata\/suricata.yaml<\/span>
# \/sbin\/suricata -T -c \/etc\/suricata\/suricata.yaml -i eth0<\/span>
1\/3\/2017 — 14:50:53 – <Info> – Running suricata under test mode<\/span>
1\/3\/2017 — 14:50:53 – <Notice> – This is Suricata version 3.2.1 RELEASE<\/span>
1\/3\/2017 — 14:50:56 – <Notice> – Configuration provided was successfully loaded. Exiting.<\/span><\/p>\n

\u5982\u679c\u6c92\u6709\u505a\u7b2c\u4e8c\u6b65\u9a5f\uff0c\u6703\u6709\u4e00\u4e9b Warning
# \/sbin\/suricata -T -c \/etc\/suricata\/suricata.yaml -i eth0<\/span>
1\/3\/2017 — 14:16:50 – <Info> – Running suricata under test mode<\/span>
1\/3\/2017 — 14:16:50 – <Notice> – This is Suricata version 3.2.1 RELEASE<\/span>
1\/3\/2017 — 14:16:50 – <Warning> – [ERRCODE: SC_ERR_NO_RULES(42)] – No rule files match the pattern \/etc\/suricata\/rules\/botcc.rules<\/span>
1\/3\/2017 — 14:19:04 – <Warning> – [ERRCODE: SC_ERR_NO_RULES(42)] – No rule files match the pattern \/etc\/suricata\/rules\/ciarmy.rules<\/span>
1\/3\/2017 — 14:19:32 – <Warning> – [ERRCODE: SC_ERR_NO_RULES(42)] – No rule files match the pattern \/etc\/suricata\/rules\/compromised.rules<\/span>
1\/3\/2017 — 14:20:18 – <Warning> – [ERRCODE: SC_ERR_NO_RULES(42)] – No rule files match the pattern \/etc\/suricata\/rules\/drop.rules<\/span><\/p>\n

<\/span>
4. \u56e0\u70ba\u4f7f\u7528 systemctl \u4e00\u76f4\u7121\u6cd5\u6b63\u5e38\u555f\u52d5
# mv \/usr\/lib\/systemd\/system\/suricata.service \/root<\/span><\/p>\n

5. \u6240\u4ee5\u81ea\u884c\u5efa\u7acb\u555f\u52d5\u6a94 \/etc\/init.d\/suricatd<\/span>
# vim \/etc\/init.d\/suricatad<\/span>
#!\/bin\/sh<\/span>
# $Id$<\/span>
#<\/span>
# suricatad\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Start\/Stop the suricata IDS daemon.<\/span>
#<\/span>
# chkconfig: 2345 40 60<\/span>
# description:\u00a0 Suricata is a lightweight network intrusion detection tool that <\/span>
#\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 currently detects more than 1100 host and network <\/span>
#\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 vulnerabilities, portscans, backdoors, and more.<\/span>
#<\/span><\/p>\n

# Source function library.<\/span>
. \/etc\/rc.d\/init.d\/functions<\/span><\/p>\n

# See how we were called.<\/span>
case “$1” in<\/span>
\u00a0 start)<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 echo -n “Starting Suricata: “<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 daemon PCAP_FRAMES=max \/sbin\/suricata -D -c \/etc\/suricata\/suricata.yaml -i eth0<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ;;<\/span>
\u00a0 stop)<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 echo -n “Stopping Suricata: “<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 killproc suricata<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 echo<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ;;<\/span>
\u00a0 restart)<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $0 stop<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $0 start<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ;;<\/span>
\u00a0 status)<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 status suricata<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ;;<\/span>
\u00a0 *)<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 echo “Usage: $0 {start|stop|restart|status|}”<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 exit 1<\/span>
esac<\/span><\/p>\n

exit 0<\/span><\/p>\n

6. \u8a2d\u5b9a\u6a94\u6848\u6b0a\u9650
# chmod +x \/etc\/init.d\/suricatad<\/span><\/p>\n

7. \u8a2d\u5b9a\u958b\u6a5f\u6642\u555f\u52d5
# chkconfig –add suricatad<\/span>
# \/etc\/init.d\/suricatad start<\/span>
# \/etc\/init.d\/suricatad status<\/span>
\u25cf suricatad.service – SYSV: Suricata is a lightweight network intrusion detection tool that currently detects more than 1100 host and network vulnerabilities, portscans, backdoors, and more.<\/span>
\u00a0\u00a0 Loaded: loaded (\/etc\/rc.d\/init.d\/suricatad; bad; vendor preset: disabled)<\/span>
\u00a0\u00a0 Active: active (running<\/span>) since Wed 2017-03-01 15:10:45 CST; 3min 58s ago<\/span>
\u00a0\u00a0\u00a0\u00a0 Docs: man:systemd-sysv-generator(8)<\/span>
\u00a0\u00a0 CGroup: \/system.slice\/suricatad.service<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 mq311 \/sbin\/suricata -D -c \/etc\/suricata\/suricata.yaml -i eth0<\/span><\/p>\n

Mar 01 15:10:45 ids systemd[1]: Starting SYSV: Suricata is a lightweight network intrusion detection tool that currently detects more than 1100 host and network vulnerabilities, portscans, back…s, and more….<\/span>
Mar 01 15:10:45 ids suricatad[308]: Starting Suricata: 1\/3\/2017 — 07:10:45 – <Notice> – This is Suricata version 3.2.1 RELEASE<\/span>
Mar 01 15:10:45 ids suricatad[308]: [\u00a0 OK\u00a0 ]<\/span>
Mar 01 15:10:45 ids systemd[1]: Started SYSV: Suricata is a lightweight network intrusion detection tool that currently detects more than 1100 host and network vulnerabilities, portscans, backdoors, and more..<\/span>
Hint: Some lines were ellipsized, use -l to show in full.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Suricata \u548c Snort \u4e00\u6a23\uff0c\u90fd\u662f\u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71\uff0c\u4e8c\u8005\u4e4b\u9593\u7684\u5dee\u7570\u53ef\u4ee5\u53c3\u8003\uff1aSnort vs Suric … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5728 CentOS 7.x \u4e0a\u5b89\u88dd Suricata \u5165\u4fb5\u5075\u6e2c\u7cfb\u7d71\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,146],"tags":[],"class_list":["post-19520","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-78491"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["687382"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19520"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19520"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19520\/revisions"}],"predecessor-version":[{"id":21035,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19520\/revisions\/21035"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}