Installation on Raspberry Pi OS (64-bit)

Raspberry Pi OS (64-bit) is supported as the operating system of the IDSTower server and as a managed Suricata host – and both can be the same Pi, in an all-in-one installation where IDSTower deploys Suricata to the machine it runs on (see One Pi for both: IDSTower and Suricata below).

Note

Validation on real Arm hardware, Raspberry Pi included, is still pending. The installation on this page, with the installation script and IDSTower’s arm64 package, is tested on emulated 64-bit Arm containers. Deploying Suricata and Filebeat to a 64-bit Arm host has not been validated end to end yet: it is exercised on the same emulated containers, which cannot run Suricata’s traffic capture. If you run IDSTower on a Pi, please tell us how it goes – support@idstower.com.

Note

These instructions cover the 64-bit edition of Raspberry Pi OS, which is built on Debian 13 (Trixie). Its /etc/os-release reports ID=debian and VERSION_ID=13, so IDSTower treats it exactly as it treats Debian 13: the installation script recognises it as a fully supported system with no extra option, and the steps below are the Debian 13 steps. The previous release, built on Debian 12 (Bookworm), reports VERSION_ID=12 and installs as Debian 12 in the same way; it has not been tested on Arm.

The 32-bit edition is not supported – neither as an IDSTower server nor as a managed Suricata host. It reports ID=raspbian rather than debian, and IDSTower is not published for 32-bit Arm (armhf), so the installation script stops on it before installing anything. Raspberry Pi recommends the 64-bit image on every 64-bit-capable model (Raspberry Pi 3 and newer, and Compute Modules from CM3 on).

Tip

IDSTower runs a MariaDB database, so give the Pi that runs the IDSTower server an SSD or NVMe drive rather than an SD card.

To use a Raspberry Pi only as a managed Suricata host, you need nothing from this page: add it in the Cluster Setup Wizard like any other target host (see Target Host Requirements).

Quick install

Please use our interactive installation script to quickly install IDSTower:

$ curl -O https://download.idstower.com/install_script/latest/install-IDSTower.sh
$ echo "9aace462c06483b9ee75ffead298abc10a607aa4ee8b97b066deeec845c958dc install-IDSTower.sh" \
 | sha256sum -c -
$ bash install-IDSTower.sh -i

Manual install

Please follow these steps to install IDSTower on Raspberry Pi OS (64-bit). They are identical to the Debian 13 steps; the IDSTower apt repository serves arm64 packages alongside amd64, so nothing here is Pi-specific:

  1. Add IDSTower repository

$ sudo apt update
$ sudo apt install -y curl gnupg2
$ curl -s https://download.idstower.com/repos/apt/idstower.key | gpg --dearmor | sudo tee /usr/share/keyrings/idstower.gpg > /dev/null
$ echo "deb [arch=amd64,arm64 signed-by=/usr/share/keyrings/idstower.gpg] https://download.idstower.com/repos/apt stable main" | sudo tee /etc/apt/sources.list.d/idstower.list

  1. Install Ansible

$ sudo apt update
$ sudo apt install -y ansible-core ansible sshpass

  1. Install MariaDB and IDSTower

$ sudo apt update
$ sudo apt install mariadb-server idstower -y

  1. Start and enable MariaDB service

$ sudo systemctl enable mariadb.service
$ sudo systemctl start mariadb.service
$ sudo systemctl status mariadb.service

  1. (Recommended) Run mariadb-secure-installation Script

$ sudo /usr/bin/mariadb-secure-installation

  1. Create a database user for IDSTower

Note

Change USERNAME and PASSWORD in the command below with your desired username and password for IDSTower database user

$ sudo mariadb -u root -p -e "GRANT ALL ON *.* TO 'USERNAME'@'localhost' IDENTIFIED BY 'PASSWORD' WITH GRANT OPTION; FLUSH PRIVILEGES;"

  1. Edit the appsettings.json configuration file (located in: /opt/idstower/) and set the following settings

    • set the EncryptionKey key value with a 64-character hexadecimal string (32 bytes), this key is used for secure storage of cluster keys and other secrets, you can generate one using:

    $ openssl rand -hex 32

    • set the URL key value with the url you want IDSTower to listen to, example: http://idstower.mydomain.local, this url must be reachable from your Suricata hosts, note that you can use ip addresses as well.

    • set the MySQL Database settings like host, port, database name, username & password via the Database key.

    • for more information on the configuration file, please refer to the IDSTower Configuration Guide page.

  2. Initialize the IDSTower database

$ cd /opt/idstower/
$ sudo ./IDSTower --init-database

  1. Add an admin user to IDSTower

$ cd /opt/idstower/
$ sudo ./IDSTower --add-user [Your Admin Username]

Example:

$ sudo ./IDSTower --add-user admin

  1. Enable and start IDSTower Service

$ sudo chown -R idstower:idstower /var/log/idstower
$ sudo systemctl enable idstower.service
$ sudo systemctl start idstower.service

  1. Verify that IDSTower Service started correctly

$ sudo systemctl status idstower.service

  1. Configure firewall to allow HTTP and HTTPS traffic (if UFW is enabled)

$ sudo ufw allow 80/tcp
$ sudo ufw allow 443/tcp
$ sudo ufw reload

  1. Access IDSTower web interface

You can now access the IDSTower web interface using the URL specified in your appsettings.json configuration file. Log in using the admin username and password you created in step 9.

Note

On first login, you will be redirected to the license activation page. Enter your license key to activate IDSTower.

One Pi for both: IDSTower and Suricata

A single Raspberry Pi can run the IDSTower server and also be the Suricata host it manages. IDSTower deploys Suricata to the machine it runs on the same way it deploys to any other host:

  1. Install IDSTower on the Pi as described above. When the installation script asks for the hostname or IP address used to access IDSTower, choose the Pi’s address on your network, not localhost or 127.0.0.1: Suricata hosts reach IDSTower at that address, including when the Suricata host is the Pi itself (see the URL setting in the IDSTower Configuration Guide).

  2. In the Cluster Setup Wizard, enter the same LAN IP address or hostname as the target host. IDSTower connects to the Pi over SSH, as it does to every target host, so SSH has to be enabled on it – Raspberry Pi OS ships with SSH turned off; turn it on in Raspberry Pi Imager when you write the image, or later with sudo raspi-config. The SSH account needs the same rights as on any other host, see Target Host Requirements.