linux环境centos 7 下suricata 源码安装

本文简单的介绍centos7环境下的suricata源码安装步骤和注意事项。

源码下载
下载地址，这里。

生成configure
源码中是没有configure文件的，需要运行autogen.sh生成configure文件。

执行configure
可以直接执行./configure这个时候一些日志和配置等路径使用默认路径，如果想要指定路径则使用如下类似命令：
./configure --sysconfdir=/etc --localstatedir=/var --enable-unittests
可以看到我们增加了一些路径的设置， --enable-unittests表示打开测试用例，这些会在安装完成之后详细解释。在这个过程中可能会提示安装依赖，suricata在centos中常见的依赖如下：

 yum install wget libpcap-devel libnet-devel pcre-devel gcc-c++ automake autoconf libtool make libyaml-devel zlib-devel file-devel jansson-devel nss-devel

做好在执行configure之前提前进行安装，当然还有可能出现如下提示：

checking for cbindgen... no
  Warning: cbindgen too old or not found, it is required to 
      generate header files.
  To install: cargo install --force cbindgen
configure: error: cbindgen required

运行cargo install --force cbindgen即可。

make编译
做完依赖方面的检查之后，运行make命令，会得到如下的输出结果：

Suricata Configuration:
  AF_PACKET support:                       yes
  eBPF support:                            no
  XDP support:                             no
  PF_RING support:                         no
  NFQueue support:                         no
  NFLOG support:                           no
  IPFW support:                            no
  Netmap support:                          no 
  DAG enabled:                             no
  Napatech enabled:                        no
  WinDivert enabled:                       no

  Unix socket enabled:                     yes
  Detection enabled:                       yes

  Libmagic support:                        yes
  libnss support:                          yes
  libnspr support:                         yes
  libjansson support:                      yes
  hiredis support:                         no
  hiredis async with libevent:             no
  Prelude support:                         no
  PCRE jit:                                yes
  LUA support:                             no
  libluajit:                               no
  GeoIP2 support:                          no
  Non-bundled htp:                         no
  Old barnyard2 support:                   no
  Hyperscan support:                       no
  Libnet support:                          no
  liblz4 support:                          yes

  Rust support:                            yes
  Rust strict mode:                        no
  Rust compiler path:                      /usr/bin/rustc
  Rust compiler version:                   rustc 1.40.0
  Cargo path:                              /usr/bin/cargo
  Cargo version:                           cargo 1.40.0
  Cargo vendor:                            yes

  Python support:                          yes
  Python path:                             /usr/bin/python2.7
  Python distutils                         yes
  Python yaml                              yes
  Install suricatactl:                     yes
  Install suricatasc:                      yes
  Install suricata-update:                 not bundled

  Profiling enabled:                       no
  Profiling locks enabled:                 no

Development settings:
  Coccinelle / spatch:                     no
  Unit tests enabled:                      yes
  Debug output enabled:                    no
  Debug validation enabled:                no

Generic build parameters:
  Installation prefix:                     /usr/local
  Configuration directory:                 /etc/suricata/
  Log directory:                           /var/log/suricata/

  --prefix                                 /usr/local
  --sysconfdir                             /etc
  --localstatedir                          /var
  --datarootdir                            /usr/local/share

  Host:                                    x86_64-unknown-linux-gnu
  Compiler:                                gcc (exec name) / gcc (real)
  GCC Protect enabled:                     no
  GCC march native enabled:                yes
  GCC Profile enabled:                     no
  Position Independent Executable enabled: no
  CFLAGS                                   -g -O2 -march=native -I${srcdir}/../rust/gen
  PCAP_CFLAGS                               
  SECCFLAGS                                

To build and install run 'make' and 'make install'.

You can run 'make install-conf' if you want to install initial configuration
files to /etc/suricata/. Running 'make install-full' will install configuration
and rules and provide you a ready-to-run suricata.

To install Suricata into /usr/bin/suricata, have the config in
/etc/suricata and use /var/log/suricata as log dir, use:
./configure --prefix=/usr/ --sysconfdir=/etc/ --localstatedir=/var/

上述的提示是非常的重要，需要仔细的阅读。例如如果你在安装的时候没有加入 --enable-unittest参数选项，则安装完成之后是没法运行测试用例的。即无法使用suricata -u 命令，make之后的显示Unit tests enabled: no。同时还可以看到Debug output enabled: no是no的状态，如果需要的话，需要使用指定的参数将debug输出开关打开。-vvvv表示debug模式，suricata日志有多个级别，如下：

-v: INFO
-vv: PERF
-vvv: CONFIG
-vvvv: DEBUG

如果不打开该选项，debug的输出是不全的。其他所有是no的选项，如果有使用得到，都需要在configure时候指定对应的参数或者安装对应的依赖。作为第一次安装，也不用太在意，因为suricata源码安装时间并不是很长，如果缺少某一项的功能，从头开始即可。

上述的输出还可以看到，在configure的时候指定的目录生效了，如下：

--prefix                                 /usr/local
--sysconfdir                             /etc
--localstatedir                          /var
--datarootdir                            /usr/local/share

sysconfdir 是配置相关目录，例如suricata.yaml这个配置文件路径就是/etc/suricata/suricata.yaml。localstated是一些状态数据目录，例如输出的日志就在 /var/log/suricata/目录下，没有指定则使用默认目录。

安装suricata
在make命令的末尾有如下提示：

Running 'make install-full' will install configuration and rules and provide you a ready-to-run suricata.

查看makefile文件可以发现make install-full相当于如下三条命令

install-full:
	$(MAKE) install
	$(MAKE) install-conf
	$(MAKE) install-rules

如果是初次安装，在编译到install-rules的时候会出现如下的提示。

error: rules not installed as suricata-update not available

如果你仔细查看makefile的make install-rules发现只有这些提示性的输出。原因在于suricata V5.0.2引擎程序和规则是分开来安装的，因此需要单独安装suricata-update程序进行规则的安装。由于该程序是python写的，因此linux环境最好支持python同时安装pip工具，具体安装该程序的步骤见这里。安装完suricata-update，直接运行该程序，则会到指定的网站下载rules，下载到/var/lib/suricata中，如下：

[root@localhost bin]# suricata-update 
23/2/2020 -- 17:46:27 - <Info> -- Using data-directory /var/lib/suricata.
23/2/2020 -- 17:46:27 - <Info> -- Using Suricata configuration /etc/suricata/suricata.yaml
23/2/2020 -- 17:46:27 - <Info> -- Using /usr/local/share/suricata/rules for Suricata provided rules.
23/2/2020 -- 17:46:27 - <Info> -- Found Suricata version 6.0.0-dev at /usr/local/bin/suricata.
23/2/2020 -- 17:46:27 - <Info> -- Loading /etc/suricata/suricata.yaml
23/2/2020 -- 17:46:27 - <Warning> -- Failed to parse: default-log-dir = /var、/log/suricata/
23/2/2020 -- 17:46:27 - <Info> -- Disabling rules with proto modbus
23/2/2020 -- 17:46:27 - <Info> -- Disabling rules with proto enip
23/2/2020 -- 17:46:27 - <Info> -- Disabling rules with proto dnp3
23/2/2020 -- 17:46:27 - <Info> -- No sources configured, will use Emerging Threats Open
23/2/2020 -- 17:46:27 - <Info> -- Fetching https://rules.emergingthreats.net/open/suricata-6.0.0/emerging.rules.tar.gz.
 100% - 2553598/2553598               
23/2/2020 -- 17:50:55 - <Info> -- Done.
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/app-layer-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/decoder-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/dhcp-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/dnp3-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/dns-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/files.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/http-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/ipsec-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/kerberos-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/modbus-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/nfs-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/ntp-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/smb-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/smtp-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/stream-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/tls-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Ignoring file rules/emerging-deleted.rules

23/2/2020 -- 17:51:26 - <Info> -- Loaded 26419 rules.
23/2/2020 -- 17:51:27 - <Info> -- Disabled 14 rules.
23/2/2020 -- 17:51:27 - <Info> -- Enabled 0 rules.
23/2/2020 -- 17:51:27 - <Info> -- Modified 0 rules.
23/2/2020 -- 17:51:27 - <Info> -- Dropped 0 rules.
23/2/2020 -- 17:51:28 - <Info> -- Enabled 69 rules for flowbit dependencies.
23/2/2020 -- 17:51:28 - <Info> -- Creating directory /var/lib/suricata/rules.
23/2/2020 -- 17:51:28 - <Info> -- Backing up current rules.
23/2/2020 -- 17:51:28 - <Info> -- Writing rules to /var/lib/suricata/rules/suricata.rules: total: 26419; enabled: 21145; added: 26419; removed 0; modified: 0
23/2/2020 -- 17:51:30 - <Info> -- Testing with suricata -T.
23/2/2020 -- 17:51:56 - <Info> -- Done.

在安装完suricata之后需要到安装的目录/etc/suricata中将配置文件suricata.yaml中对应的字段修改如下：

default-rule-path: /var/lib/suricata/rules
rule-files:
  - suricata.rules

即告诉suricata引擎，运行的时候，从该目录加载规则。

此时就可以运行suricata了，运行示例如下：

 suricata -c /etc/suricata/suricata.yaml -i ens33 --init-errors-fatal

是一条在线运行的示例，当然也可以通过-r参数离线的读取报文。至于各个参数的含义，通过suricata -h查看

本文为CSDN村中少年原创文章，未经允许不得转载，博主链接这里。