From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mentalic To: development@lists.ipfire.org Subject: RE: IPFire meets Suricata - Call for tester Date: Fri, 22 Feb 2019 12:40:26 -0600 Message-ID: <000c01d4cade$14d06860$3e713920$@net> In-Reply-To: <0fa55a1691d9cb790301f4e53b52e3b422712bca.camel@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8147798860376788196==" List-Id: --===============8147798860376788196== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Stafan File I downloaded: 26fbdacc7a7ef6f4ce612c85a87788b9 ipfire-2.x-suricata-rc3_x86_64.tar.gz Yours from below: 300943d7e6fa667b7c33843124182b4f ipfire-2.x-suricata-rc3_x86_64.tar.gz Well, clearly something wrong somewhere. Regards Wayne -----Original Message----- From: Development [mailto:development-bounces(a)lists.ipfire.org] On Behalf O= f Stefan Schantl Sent: Friday, February 22, 2019 4:59 AM To: development(a)lists.ipfire.org Subject: Re: IPFire meets Suricata - Call for tester Hello Wayne, once more thanks for your testing and providing such detailed feedback. > Restored backup from core127 with guardian against a fresh suricata=20 > iso install. > Found: > IPS service was running with no rules downloaded. Box's checked were=20 > enabled, monitor, red and blue. > It did import the oinkcode but no rules sets downloaded automatically. Thats correct, there was no code, which called the downloader in such a case.= I've added it now to the "convert-snort" script, so in future if a snort con= fig has got imported and no ruleset is present it automatically will be downl= oaded. > Since I had two rule sources in guardian I wondered how that would be=20 > handled here were one set is all that's possible. Picked a set and=20 > downloaded them, had to manually pick the rules. Not a big deal to=20 > setup. Made an attempt at importing the suricata tarball into current=20 > release core127 with guardian installed but no luck. Tar command exits=20 > with "This does not look like a tar archive". Had used "tar -xvf" to=20 > extract... Could be doing something wrong here? Mhm, I've checked the archives they work here, may an incomplete download? The md5 checksums should be: c5a6830336fdb75cc1c59e735a0fa655 ipfire-2.x-suricata-rc3_i586.tar.gz 300943d7e6fa667b7c33843124182b4f ipfire-2.x-suricata-rc3_x86_64.tar.gz Please only extract the "outer" tarball and call the "install.sh" script. Thanks in advance, -Stefan >=20 > Regards > Wayne >=20 >=20 > -----Original Message----- > From: Development [mailto:development-bounces(a)lists.ipfire.org] On=20 > Behalf Of Stefan Schantl > Sent: Wednesday, February 20, 2019 1:55 AM > To: development(a)lists.ipfire.org > Subject: Re: IPFire meets Suricata - Call for tester >=20 > Hello again and thanks for the feedback. > > Exposed my test setup directly to my cable modem and noticed a=20 > > couple of things. > >=20 > > -The Firewall log seems to only list items that match my firewall=20 > > rules. Gone was the typical several a minute "drop_input" entry=20 > > noise, there was zero drop_input's in 15min or so. Possible logging=20 > > issue? >=20 > The IDS/IPS events are not logged to the firewall log. They only can=20 > be accessed in the "Logs"->"IPS Logs" section. >=20 > > -Suricata placed entries into IPS log, but what is done with them? > > Don't see a block list like Guardian generated. >=20 > Thats exactly how suricata works and the main benefit why we choose to=20 > switch to suricata. >=20 > The old snort/guardian solution worked like this: >=20 > Snort detected (based on it's ruleset) an event and logged it to it's=20 > logfile. Guardian read this event from the file, parsed it again and=20 > if the configured block count for the matching IP-address was reached,=20 > the host was blocked by an iptables rule (block list). >=20 > The new suricata-based solution works like this: >=20 > Suricata detects (also based on the ruleset) an event and directly=20 > drops the bad package. There is no additional software involved=20 > anymore . >=20 > So one of the benefits of the new approach is to reduce the amount of=20 > time an attack has been recognized until it's blocked immediately. >=20 > > -Are there any incompatibility issues with using the backup function=20 > > to restore to this version? I had made a backup from my core 127=20 > > system with the old intrusion detection/guardian not active just in=20 > > case. >=20 > There is a converter-script available, which will move the old=20 > snort/guardian and rules settings to be used by suricata. This script=20 > automatically will be called if a backup gets restored, which contains=20 > such settings files. >=20 > Therefore I would ask you to test this feature by restoring such a=20 > backup on a fresh installed nightly machine and if possible to install=20 > the "update tarball" on a regular machine with configured snort and/or=20 > guardian. >=20 > In both ways, all your taken settings should be the same for suricata=20 > as before for snort. >=20 > A big thanks in advance and best regards, >=20 > -Stefan >=20 > > Regards > > Wayne > >=20 > > -----Original Message----- > > From: Development [mailto:development-bounces(a)lists.ipfire.org] On=20 > > Behalf Of Mentalic > > Sent: Tuesday, February 19, 2019 4:12 PM > > To: 'Stefan Schantl'; development(a)lists.ipfire.org > > Subject: RE: IPFire meets Suricata - Call for tester > >=20 > > Stefan > >=20 > > Yep I had downloaded the nightly and suspected is was not current,=20 > > and so posted the build number. > >=20 > > With the 5d7d8749 loaded I have not seen any of the previous issues=20 > > nor any others thus far. > >=20 > > Regards > > Wayne > >=20 > > -----Original Message----- > > From: Development [mailto:development-bounces(a)lists.ipfire.org] On=20 > > Behalf Of Stefan Schantl > > Sent: Tuesday, February 19, 2019 5:34 AM > > To: development(a)lists.ipfire.org > > Subject: Re: IPFire meets Suricata - Call for tester > >=20 > > Hello Wayne, > >=20 > > it seems you accidentally downloaded and tested the wrong image. > >=20 > > The latest one is 5d7d8749 were you downloaded one is an older=20 > > release. > >=20 > > Sadly the nightly build service and therefore the images are one day=20 > > later than the upgrade tarballs.... > >=20 > > You simply can update to this release by using the RC3 tarball or=20 > > download the available "5d7d8749" ISO. > >=20 > > Best regards, > >=20 > > -Stefan > > > Loaded the new iso, reports build 77c07352. Still having=20 > > > connection issues with suricata as soon as its activated where=20 > > > existing connections would continue to work, no new connections=20 > > > were possible. > > > Reboot results in no connection timeouts. Disable suricata,=20 > > > reboot, connections work. > > >=20 > > > Any graphical data trend under Status tab reports errors and=20 > > > remains blank. Typically on new installs the trends at least show=20 > > > the chart even though data had not been collected. > > >=20 > > > Configured options: > > > Geoip > > > Proxy on green and blue > > > URL filter > > > suricata on red/blue Running a number of emerging threats rule=20 > > > sets. > > >=20 > > > Regards > > > Wayne > > >=20 > > >=20 > > >=20 > > > -----Original Message----- > > > From: Development [mailto:development-bounces(a)lists.ipfire.org] > > > On > > > Behalf Of Stefan Schantl > > > Sent: Monday, February 18, 2019 7:16 AM > > > To: development(a)lists.ipfire.org > > > Subject: Re: IPFire meets Suricata - Call for tester > > >=20 > > > Hello list, > > >=20 > > > I've uploaded the third release candidate, which hopefully would=20 > > > be the last one. > > >=20 > > > It fixes the issue that no traffic could be passed through the=20 > > > firewall when suricata was running on some machines and no graphs=20 > > > could be displayed anymore. Thanks to Wayne for reporting and=20 > > > Michael Tremer for testing and fixing. > > >=20 > > > The new tarball (i586 for 32bit-systems, and x86_64) can be found > > > here: > > >=20 > > > https://people.ipfire.org/~stevee/suricata/ > > >=20 > > > To start testing download the tarball and place it on your IPFire=20 > > > system. Extract the tarball and launch the install (install.sh)=20 > > > script. > > >=20 > > > If you already have installed a previous test version or image,=20 > > > with the same steps as noted above you can update the the new=20 > > > version. > > >=20 > > > As always, if you prefer a fresh installation, the latest image=20 > > > can be grabbed from here: > > >=20 > > > https://nightly.ipfire.org/next-suricata/latest/x86_64/ > > >=20 > > > Direct link for downloading the ISO image: > > >=20 > > > https://nightly.ipfire.org/next-suricata/latest/x86_64/ipfire-2.21 > > > .x > > > 86 > > > _64-full-core128.iso > > >=20 > > > Thanks for downloading and testing. There are no known bugs so=20 > > > far, as usual please file any bugs to our bugtracker ( > > > https://bugzilla.ipfire.org) and share your feedback on the list. > > >=20 > > > Best regards, > > >=20 > > > -Stefan > > >=20 --===============8147798860376788196==--