From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 1/7] suricata: Include all default rules
Date: Fri, 19 Nov 2021 17:44:52 +0000 [thread overview]
Message-ID: <20211119174458.789486-1-michael.tremer@ipfire.org> (raw)
[-- Attachment #1: Type: text/plain, Size: 3926 bytes --]
These rules do not drop anything, but only alert when internal parts of
the engine trigger an event. This will allow us more insight on what is
happening.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
config/rootfiles/common/suricata | 22 ++++++++++++++++++++++
config/suricata/suricata.yaml | 24 ++++++++++++++++++++++--
lfs/suricata | 3 ---
3 files changed, 44 insertions(+), 5 deletions(-)
diff --git a/config/rootfiles/common/suricata b/config/rootfiles/common/suricata
index 32358483a..21dbeae64 100644
--- a/config/rootfiles/common/suricata
+++ b/config/rootfiles/common/suricata
@@ -19,6 +19,28 @@ usr/bin/suricata
#usr/share/man/man1/suricatactl-filestore.1
#usr/share/man/man1/suricatactl.1
#usr/share/man/man1/suricatasc.1
+usr/share/suricata/
+#usr/share/suricata/classification.config
+#usr/share/suricata/reference.config
+#usr/share/suricata/rules
+#usr/share/suricata/rules/app-layer-events.rules
+#usr/share/suricata/rules/decoder-events.rules
+#usr/share/suricata/rules/dhcp-events.rules
+#usr/share/suricata/rules/dnp3-events.rules
+#usr/share/suricata/rules/dns-events.rules
+#usr/share/suricata/rules/files.rules
+#usr/share/suricata/rules/http2-events.rules
+#usr/share/suricata/rules/http-events.rules
+#usr/share/suricata/rules/ipsec-events.rules
+#usr/share/suricata/rules/kerberos-events.rules
+#usr/share/suricata/rules/modbus-events.rules
+#usr/share/suricata/rules/mqtt-events.rules
+#usr/share/suricata/rules/nfs-events.rules
+#usr/share/suricata/rules/ntp-events.rules
+#usr/share/suricata/rules/smb-events.rules
+#usr/share/suricata/rules/smtp-events.rules
+#usr/share/suricata/rules/stream-events.rules
+#usr/share/suricata/rules/tls-events.rules
var/lib/suricata
var/lib/suricata/classification.config
var/lib/suricata/reference.config
diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
index 6f37671c8..0ad36e705 100644
--- a/config/suricata/suricata.yaml
+++ b/config/suricata/suricata.yaml
@@ -46,8 +46,28 @@ vars:
##
default-rule-path: /var/lib/suricata
rule-files:
- # Include enabled ruleset files from external file.
- include: /var/ipfire/suricata/suricata-used-rulefiles.yaml
+ # Default rules
+ - /usr/share/suricata/rules/app-layer-events.rules
+ - /usr/share/suricata/rules/decoder-events.rules
+ - /usr/share/suricata/rules/dhcp-events.rules
+ - /usr/share/suricata/rules/dnp3-events.rules
+ - /usr/share/suricata/rules/dns-events.rules
+ - /usr/share/suricata/rules/files.rules
+ - /usr/share/suricata/rules/http2-events.rules
+ - /usr/share/suricata/rules/http-events.rules
+ - /usr/share/suricata/rules/ipsec-events.rules
+ - /usr/share/suricata/rules/kerberos-events.rules
+ - /usr/share/suricata/rules/modbus-events.rules
+ - /usr/share/suricata/rules/mqtt-events.rules
+ - /usr/share/suricata/rules/nfs-events.rules
+ - /usr/share/suricata/rules/ntp-events.rules
+ - /usr/share/suricata/rules/smb-events.rules
+ - /usr/share/suricata/rules/smtp-events.rules
+ - /usr/share/suricata/rules/stream-events.rules
+ - /usr/share/suricata/rules/tls-events.rules
+
+ # Include enabled ruleset files from external file
+ - !include: /var/ipfire/suricata/suricata-used-rulefiles.yaml
classification-file: /var/lib/suricata/classification.config
reference-config-file: /var/lib/suricata/reference.config
diff --git a/lfs/suricata b/lfs/suricata
index c7f189bf4..bd57b829e 100644
--- a/lfs/suricata
+++ b/lfs/suricata
@@ -96,9 +96,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
# Install IPFire related config file.
install -m 0644 $(DIR_SRC)/config/suricata/suricata.yaml /etc/suricata
- # Remove shipped rules.
- rm -rvf /usr/share/suricata
-
# Create emtpy rules directory.
-mkdir -p /var/lib/suricata
--
2.30.2
next reply other threads:[~2021-11-19 17:44 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-19 17:44 Michael Tremer [this message]
2021-11-19 17:44 ` [PATCH 2/7] rust: Drop Cargo home directory after build Michael Tremer
2021-11-19 17:44 ` [PATCH 3/7] suricata: Drop extra rootfiles Michael Tremer
2021-11-19 17:44 ` [PATCH 4/7] suricata: This package is supported on all architectures Michael Tremer
2021-11-24 14:54 ` Arne Fitzenreiter
2021-11-24 16:53 ` Michael Tremer
2021-11-19 17:44 ` [PATCH 5/7] suricata: Load *.config files from default location Michael Tremer
2021-11-22 4:21 ` Stefan Schantl
2021-11-22 9:52 ` Michael Tremer
2021-11-19 17:44 ` [PATCH 6/7] IPS: Do not try to show rules when stat on rules tarball fails Michael Tremer
2021-11-19 17:44 ` [PATCH 7/7] suricata: Handle retransmitted SYN with TSval Michael Tremer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211119174458.789486-1-michael.tremer@ipfire.org \
--to=michael.tremer@ipfire.org \
--cc=development@lists.ipfire.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox