suricata *teste*

apt-get install build-essential module-assistant
   36  m-a prepare
   37  sh ./
Installing Suricata, Snorby and Banyard2 on Debian
I have used Snort quite extensively in the past and was curious about toying with Suricata which is similar to Snort but nicer in my view. It has been a few years since I looked at it. I can see the project seems to have evolved quite a lot. One functionality that I will be using down the line will be PF Ring.
On a lazy Sunday afternoon, I thought this was the perfect time to take a look at what it can do in its current form. I used Debian 7.3 for my tests. Everything is packaged which is quite nice though the version of suricata is a bit old on this (1.2.1 vs 1.4.7 on the website). I am very likely to make packages for this later in order to have more functionality.
auto eth1
iface eth1 inet manual
up ifconfig $IFACE up
#post-up ethtool -K eth1 gro off
#post-up ethtool -K eth1 lro off
Pre-installation requirements¶
apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential autoconf automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev libjansson-dev pkg-config apache2 apache2-dev libapr1-dev libaprutil1-dev libcurl4-openssl-dev openssl libssl-dev
By default, Suricata works as an IDS. If you want to use it as a IDS and IPS program, enter:
apt-get -y install libnetfilter-queue-dev
Once you have done the traditional apt-get install suricata
#apt-get install suricata mysql-server postgresql-server-dev-9.4
There is not much to do to get it running, mostly edit: /etc/default/suricata and change this line depending on your network interface, and also allow it to run:
# set to yes to start the server in the init.d script
# Interface to listen on (for pcap mode)
You then should grab the rules to get it all going and monitoring, check out the official page to set this up. I edited /etc/oinkmaster.conf to add the rules I wanted:
url =
You now need to grab the rules, a quick mkdir /etc/suricata/rules && oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules should fix this, and give you something like this:
# oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules
Loading /etc/oinkmaster.conf
Downloading file from… done.
Archive successfully downloaded, unpacking… done.
Setting up rules structures… done.
Processing downloaded rules… disablesid 0, enablesid 0, modifysid 0, localsid 0, total rules 18195
Setting up rules structures… done.
Comparing new files to the old ones… done.
Updating local rules files… done.
[***] Results from Oinkmaster started 20140119 18:15:26 [***]
[*] Rules modifications: [*]
[*] Non-rule line modifications: [*]
[+] Added files (consider updating your snort.conf to include them if needed): [+]
    -> botcc.rules
Restart the thing with a simple service suricata restart and there you are, you can leave it running on your system to learn what kind of traffic is happening. It is worth noting that default rules are set to PASS to avoid messing your traffic up. It is up to you to tune this the right way(tm).
— ??
Configure Suricata and download the rules
___ ??
Create user for snorby
Login to MySQL server with mysql -u root -p
mysql> create user 'admin'@'localhost' identified by 'admin_password';
Query OK, 0 rows affected (0.00 sec)
mysql> grant all privileges on snorby.* to 'admin'@'localhost' with grant option;
Query OK, 0 rows affected (0.02 sec)
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)
Modify MySQL config file my.cnf
By default MySQL only listens to localhost (, however I want MySQL to listen to from all source addresses.
#nano /etc/mysql/my.cnf
Comment the bind-address line. Then restart mysqld service.
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address           =
service mysql restart
lsof -i | grep mysqld
Snorby is a web interface that allows you see events in a nice web inteface. It will require a few things to work nicely, which you can install prior by doing: 
#apt-get install bundler libxml2-dev libxslt-dev libmysqlclient-dev graphviz-dev libgv-ruby wkhtmltopdf
Before you execute the next commands, be careful with your snorby_config.yml file and set your domain to a secure domain and random port, since this is a ruby on rails application, unless you plan on proxying it behind a http server. My 2 cents, opinions my own, etc…
cd /var/www/
git clone
cd snorby
bundle install
cd ../snorby/config 
cp database.yml.example database.yml
vi database.yml ( with the newly created snorby username and password)
cp snorby_config.yml.example snorby_config.yml
vi snorby_config.yml
And paste these lines:
  domain: localhost:3000
  wkhtmltopdf: /usr/bin/wkhtmltopdf
cd initializers/
vi mail_config.rb
bundle exec rake snorby:setup
bundle exec rails server -e production
cd /var/www/snorby
gem install rails bundler –no-ri –no-rdoc passenger
passenger-install-apache2-module -a
Now you need to set up a parser between the suricata logs and the snorby interface, this is where banyard2 comes in. The new version is hosted on github. You will need a few things to get it compiled right.
apt-get install flex bison
cd /opt
git clone
cd libdnet
./configure && make && make install
tar xvfz daq-2.0.6.tar.gz                   
cd daq-2.0.6
./configure && make && make install
cd /opt
git clone
cd /opt/barnyard2/
apt-get install dh-autoreconf libpcap-dev
autoreconf –install
# check out where your MySQL libs are before specifying the same folder
./configure –with-mysql-libraries=/usr/lib/x86_64-linux-gnu/
make && make install
If there were no errors, you should have a nice running setup, time to configure it to send stuff to MySQL. Edit /usr/local/etc/barnyard2.conf and change the following:
# set the appropriate paths to the file(s) your Snort process is using.
# cat /usr/local/etc/barnyard2.conf  | grep -n <text>
config reference_file:      /etc/suricata/reference.config
config classification_file: /etc/suricata/classification.config
config gen_file:            /etc/suricata/rules/
config sid_file:            /etc/suricata/rules/
Enable the interface in barnyard2.conf by Remove the comment # from config interface: line. Which looks like this:
config interface:       eth0
# define the full waldo filepath.
config waldo_file: /var/log/suricata/suricata.waldo
# database: log to a variety of databases
output database: log, mysql, user=snorbydbuser password=snorbydbpassword dbname=snorbydbname host=localhost  <??sensor_name=sensor1??>
Create the log folder for barnyard2
#mkdir /var/log/barnyard2
Create suricata.waldo and create the subdirectories:
#mkdir /var/log/barnyard2
#mkdir /var/log/suricata/ && touch /var/log/suricata/suricata.waldo
Copy the barnyard2.conf 
#cp /usr/local/etc/barnyard2.conf /etc/suricata/
You should then be able to start it and check that it works, if it does, then you can use -D to run as a daemon.
touch /var/log/suricata/suricata.waldo
 1234  barnyard2 -c /etc/suricata/barnyard2.conf -d /var/log/suricata/ -f unified2.alert -w /var/log/suricata/suricata.waldo -d
 1234  barnyard2 -c /usr/local/etc/barnyard2.conf  -d /var/log/suricata/ -f unified2.alert -w /var/log/suricata/suricata.waldo -d
barnyard2 -c /etc/suricata/barnyard2.conf -d /var/log/suricata -f unified2.alert -w /var/log/suricata/suricata.waldo -D
barnyard2 -c /usr/local/etc/barnyard2.conf -d /var/log/suricata/ -f unified2.alert -w /var/log/suricata/suricata.waldo -D
SystemD Startup Scrip
nano /lib/systemd/system/barnyard2.service
With the following content. 
Description=Barnyard NIDS Daemon
ExecStart=/usr/local/bin/barnyard2 -c /etc/suricata/barnyard2.conf -d /var/log/suricata/ -f unified2.alert -w /var/log/suricata/suricata.waldo -D
systemctl enable barnyard2
Reboot the computer and check that both services are started: service barnyard2 status
More on this when I have time 🙂
Default User Credentials for Snorby
    Password: snorby

install Oracle JRE openSUSE

Download the rpm installer jre-7u40-linux-x64.rpm from the oracle java site at

Run as root:

rpm -Uvh jre-7u40-linux-x64.rpm
update-alternatives –install "/usr/bin/java" "java" "/usr/java/jre1.7.0_40/bin/java" 1
update-alternatives –set java /usr/java/jre1.7.0_40/bin/java
update-alternatives –install "/usr/lib64/browser-plugins/" "javaplugin" "/usr/java/jre1.7.0_40/lib/amd64/" 1
update-alternatives –set javaplugin /usr/java/jre1.7.0_40/lib/amd64/
Now check:

update-alternatives –list java
update-alternatives –list javaplugin
update-alternatives –config java
update-alternatives –config javaplugin