[development][security][suricata] suricata 使用与调研
0: OISF:https://oisf.net/
1: suricata是什么
https://suricata-ids.org/
2:安装
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_Installation
2.1:部分依赖
检查一个文件的文件类型是什么:
http://www.darwinsys.com/file/
JSON库:
http://www.digip.org/jansson/
跨平台安全套装(Network Security Services):
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS
进程能力权限分析:
http://people.redhat.com/sgrubb/libcap-ng/
包处理有关:
https://github.com/sam-github/libnet
http://netfilter.org/ #就是iptables那一套,也就是说很可能依赖内核协议栈。
2.2: 安装
./configure --prefix=/root/suricata/ --enable-nfqueue --enable-lua
make
make install
ldconfig
make install-conf
make install-rules
2.3 设置
修改配置文件
2.4 运行
[root@dpdk suricata]# ./bin/suricata -c etc/suricata/suricata.yaml -i eth1 --init-errors-fatal 29/6/2017 -- 10:30:16 - <Notice> - This is Suricata version 3.2.2 RELEASE 29/6/2017 -- 10:30:21 - <Notice> - all 8 packet processing threads, 4 management threads initialized, engine started.
2.4.1 将本地真是流量 mirror 到虚拟机的eth1网卡上
使用 daemonlogger 工具
传送们: [daily][mirror][daemonlogger][tc] 我想把一个网卡(port A)的流量,镜像到虚拟机的一个网卡(port VA)上去
2.4.2 发现个有趣的哒。
我的konversion的irc通信,被识别成了Trojan
[root@dpdk suricata]# pwd /root/suricata/var/log/suricata [root@dpdk suricata]# cat fast.log 06/29/2017-17:08:03.159432 [**] [1:2404008:4668] ET CNC Shadowserver Reported CnC Server IP group 9 [**] [Classification:
A Network Trojan was detected] [Priority: 1] {TCP} 192.168.20.56:33230 -> 162.213.39.42:7000 [root@dpdk suricata]#
3. 读文档
用户手册: http://suricata.readthedocs.io/en/latest/
文档中提及的一些相关的库。
https://github.com/redis/hiredis
http://libevent.org/
https://github.com/maxmind/geoip-api-c/tree/master/libGeoIP
规则关键字 ip_proto: 所有IP协议列表 https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers
cookie不能在http_header关键字中匹配,而需要在http_cookie中匹配。
https://filemagic.readthedocs.io/en/latest/guide.html
todo:http://suricata.readthedocs.io/en/latest/rules/file-keywords.html