Configuring the Built-In Packages repository

Note

This is an Optional step, you only need to do this step if you want to deploy Suricata to offline Hosts with no internet connectivity, skip this step if you have internet connectivity on the Suricata Hosts and use the packages from the official repository (available in IDSTower Cluster Setup Wizard).

IDSTower offers a built-in packages repository that can be used to deploy Suricata & a Logshipper to Suricata Hosts with no internet connectivity (offline).

By default the IDSTower installation package dose not include this repository files and they have to be downloaded separately, This is both to reduce the standard installation package size and to let users be able to update the Built-In Packages repository (eg:to deploy a newer version of Suricata) without having to update IDSTower.

To Enable the Built-In Packages Repository, please follow the below steps:-

  1. Download the appropriate Built-In Packages Repository from https://download.idstower.com/packages/built-in-repos/ , in this example we will download Suricata 6.0.5 packages & Filebeat 7.9.0 packages.

$ sudo curl https://download.idstower.com/packages/built-in-repos/suricata/suricata-6.0.5-linux-x86_64.tar.gz --output suricata-6.0.5-linux-x86_64.tar.gz
$ sudo tar -xzf suricata-6.0.5-linux-x86_64.tar.gz --directory /opt/idstower/resources/playbooks/files/Suricata/packages/
$ sudo curl https://download.idstower.com/packages/built-in-repos/filebeat/filebeat-7.9.0-linux-x86_64.tar.gz --output filebeat-7.9.0-linux-x86_64.tar.gz
$ sudo tar -xzf filebeat-7.9.0-linux-x86_64.tar.gz --directory /opt/idstower/resources/playbooks/files/Filebeat/packages/

Note

Bring Your Own Packages: You can add your own Suricata/Filebeat Packages in IDSTower, they can be obtained from the official repositories and needs just to be placed in the folder structure: /opt/idstower/resources/playbooks/files/Suricata/packages/{version}/{OS_Code}/{ARCH}/ for Suricata and /opt/idstower/resources/playbooks/files/Filebeat/packages/{version}/{OS_Code}/{ARCH}/ for Filebeat, make sure to include all dependency packages for Suricata/Filebeat in the same directory.

IDSTower will pick the appropriate package to install for the target host based on target host Operating System, because of that you will need to create a directory for each OS flavor you will deploy this package to, in the above example we will be deploying Suricata to Centos8.

Please use the following OS Codes according to your target host Operating System:

  • Rocky Linux 8: Rocky8

  • Rocky Linux 9: Rocky9

  • Alma Linux 8: Alma8

  • Alma Linux 9: Alma9

  • Oracle Linux 8: Oracle8

  • Oracle Linux 9: Oracle9

  • CentOS Stream 9: CentOSStream9

  • RHEL 8: RHEL8

  • RHEL 9: RHEL9

  • Amazon Linux 2023: Amazon2023

  • Debian 11 (bullseye): Debian11

  • Debian 12 (bookworm): Debian12

  • Ubuntu18 (Bionic): Ubuntu18

  • Ubuntu20 (Focal): Ubuntu20

Please note that when including your own packages, you need to make sure that the packages are compatible with the OS and architecture of the Suricata Hosts, moreover, you need to make sure that the dependencies need are also included in the same directory and that the dependencies are compatible with the OS and architecture of the Suricata Hosts.

  1. For Docker Installation Only: If you are using the Docker installation method, you need to mount the packages directory to the container, you can do this by adding the following line to your docker run command:

docker run \
   -p 80:80 \
   -p 443:443 \
   -e LicenseKey=<Key> \
   -e Hosting__URL=http://idstower.company.local \
   -e Database__Host=<database host> \
   -e Database__Name=<database name> \
   -e Database__Username=<database username> \
   -e Database__Password=<database password> \
   -v /host/path/to/Suricata/packages:/opt/idstower/resources/playbooks/files/Suricata/packages/ \
   -v /host/path/to/Filebeat/packages:/opt/idstower/resources/playbooks/files/Filebeat/packages/ \
   idstower/idstower:latest
  1. Now you will find the downloaded versions available at the cluster installation wizard when you Built-in Packages Repository as shown below.

Note

If nothing shows up in the “IDS Software to Install”/”Logs Shipper Software to Install” dropdown menus, please make sure you have the correct folder structure in the packages directory.

../_images/built-in-repo-options.png