<\/p>\n\n\n\n
Suricata IDS is published in different formats, among the standard ones are the pre-compiled binaries as RPM or DEB packages.<\/p>\n\n\n\n
Those packages offer an easy way to install\/upgrade Suricata and are configured for the most common use-cases, for that, some of the features that you might want to use are disabled in these packages, and you will need to compile Suricata your self to have them available.<\/p>\n\n\n\n
Recently, one of IDSTower users needed to use Napatech NICs with Suricata but faced several hurdles since this features is understandably not enabled by default in the default RPM\/DEB packages and manually compiling Suricata IDS on each cluster host is a bit too much.<\/p>\n\n\n\n
The customer needed a way to compile Suricata once and deploy it to the IDS Cluster using the Custom Packages Repository feature in IDSTower.<\/a><\/p>\n\n\n\n In this post, we will go thru the steps to create a custom Suricata DEB package that have the features that we wants enabled (eBPF support in this example) while maintaining the standard features enabled as well.<\/p>\n\n\n\n We did everything in this tutorial using: a dep package is a simple Unix archive that contains both the application binaries and other utility files, to create the .deb package, we need to obtain Suricata source code, configure it to enable the features\/options we want to use, compile it and finally package it as a DEB file that can be used on Ubuntu\/Debian.<\/p>\n\n\n\n First, we need to download the all of the libraries and tools needed to build Suricata IDS from the source<\/p>\n\n\n\n Then, lets create a directory to host our build and download and extract source code in it.<\/p>\n\n\n\n Once Suricata source code is extracted, proceed to “configure” the build to enable all of the standard features that are normally enabled in the “official” Suricata DEB package, plus eBPF support (notice the option in bold)<\/p>\n\n\n\n Now we are ready to compile Suricata<\/p>\n\n\n\n Compilation will take a while depending on system resources, once it is done successfully, we will proceed to bundle Suricata as a DEB package that can be used to deploy Suricata to Ubuntu\/Debian systems<\/p>\n\n\n\n To create the Suricata IDS .deb package, we will use the checkinstall tool, which is among the easies ways to bundle compiled source code into .deb and .rpm packages.<\/p>\n\n\n\n We will start by creating a list of configuration files we want checkinstall to bundle inside our suricata .deb package<\/p>\n\n\n\n We will need to tell checkinstall about all of the dependencies that Suricata requires to be installed so that they get automatically installed by apt when we install the Suricata package.<\/p>\n\n\n\n Once the checkinstall tool finishes creating the deb package, we can find it written in our source directory and we can proceed to install it and verify that eBPF support is now enabled<\/p>\n\n\n\n Now that you have the Suricata deb package ready, you can use it to install Suricata IDS on other hosts Ubuntu\/Debian hosts.<\/p>\n\n\n\n The same steps that we followed above, can be used to enable other features that are not enabled by default in official Suricata binaries, including Napatech & PF_RING support.<\/p>\n\n\n\n IDSTower helps you provision and deploy you custom Suicata packages to 10’s of hosts using the Custom Packages Repository feature.<\/a> It also offer an easy to use GUI for Suricata hosts configuration management, health monitoring and rules life-cycle management.<\/p>\n\n\n\n If you are interested to learn more on how IDSTower can help you enhance your network security operations, please take a look at the Features that IDSTower offers<\/a> & Download A free license now!<\/a><\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" Suricata IDS is published in different formats, among the standard ones are the pre-compiled binaries as RPM or DEB packages. Those packages offer an easy way to install\/upgrade Suricata and are configured for the most common use-cases, for that, some of the features that you might want to use are disabled in these packages, and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[3],"tags":[13,8,14],"class_list":["post-113","post","type-post","status-publish","format-standard","hentry","category-suricata-ids","tag-deb","tag-suricata","tag-ubuntu"],"yoast_head":"\nThe build setup<\/h4>\n\n\n\n
– Ubuntu 22.04.2 LTS (Jammy Jellyfish)
– Suricata 6.0.11<\/p>\n\n\n\nBuilding the Suricata IDS .deb package, howto<\/h2>\n\n\n\n
Compiling the source code<\/h3>\n\n\n\n
sudo apt update\nsudo apt -y install jq curl checkinstall build-essential pkg-config make rustc cargo\nsudo apt -y install libpcre3 libpcre3-dbg libpcre3-dev libpcap-dev \\\n libnet1-dev libyaml-0-2 libyaml-dev zlib1g zlib1g-dev \\\n libcap-ng-dev libcap-ng0 libmagic-dev \\\n libnss3-dev libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \\\n python3-yaml libjansson-dev libluajit-5.1-dev libhyperscan-dev libmaxminddb-dev liblz4-dev \\\n\t\tlibnetfilter-queue-dev libnetfilter-queue1 \\\n\t\tlibnetfilter-log-dev libnetfilter-log1 \\\n\t\tlibnfnetlink-dev libnfnetlink0\t\\\n\t\tlibelf-dev libbpf-dev<\/code><\/pre>\n\n\n\nmkdir suricata_build\ncd suricata_build\/\nwget https:\/\/www.openinfosecfoundation.org\/download\/suricata-6.0.11.tar.gz\ntar xzvf suricata-6.0.11.tar.gz\ncd suricata-6.0.11\/<\/code><\/pre>\n\n\n\n.\/configure --build=x86_64-linux-gnu --prefix=\/usr\/ --sysconfdir=\/etc\/ --localstatedir=\/var\/ --disable-silent-rules --disable-maintainer-mode --disable-dependency-tracking --enable-nfqueue --disable-gccmarch-native --enable-hiredis --enable-geoip --enable-gccprotect --enable-pie --enable-luajit --enable-ebpf<\/strong><\/code><\/pre>\n\n\n\nmake clean\nmake<\/code><\/pre>\n\n\n\nCreating the DEB package<\/h3>\n\n\n\n
echo \"\/etc\/suricata\" > suricata_conf_files\necho \"\/var\/log\/suricata\" >> suricata_conf_files<\/code><\/pre>\n\n\n\nsudo checkinstall -y -D -A amd64 --install=no --fstrans=no --backup=no --exclude=\/home,\/root --include=.\/suricata_conf_files --requires \"libevent-2.1-7,libevent-pthreads-2.1-7,libhiredis0.14,libhtp2,libhyperscan5,libluajit-5.1-2,libnet1,libnetfilter-log1,libnetfilter-queue1,python3-simplejson\" make install install-conf<\/code><\/pre>\n\n\n\nsudo apt install .\/suricata_6.0.11-1_amd64.deb -y\n\nuser@suricathost:~\/suricata_build\/suricata-6.0.11$ suricata --build-info\nThis is Suricata version 6.0.11 RELEASE\nFeatures: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LUAJIT HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST\nSIMD support: none\nAtomic intrinsics: 1 2 4 8 byte(s)\n64-bits, Little-endian architecture\nGCC version 11.3.0, C version 201112\ncompiled with -fstack-protector\ncompiled with _FORTIFY_SOURCE=2\nL1 cache line size (CLS)=64\nthread local storage method: _Thread_local\ncompiled with LibHTP v0.5.42, linked against LibHTP v0.5.39\n\nSuricata Configuration:\n AF_PACKET support: yes\n eBPF support: yes<\/strong>\n XDP support: yes<\/strong>\n PF_RING support: no\n NFQueue support: yes\n NFLOG support: no\n IPFW support: no\n<\/code><\/pre>\n\n\n\nUsing the Suricata DEB package<\/h2>\n\n\n\n
How IDSTower can help?<\/strong><\/h5>\n\n\n\n