Re: [PATCH] suricata 6.0.8 - suggested change in 'suricata.yaml': set app-layer mqtt: enabled: yes

["Peter Müller" <peter.mueller@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 3387 bytes --]

Hello *,


> On 30.09.2022 06:57, Michael Tremer wrote:
>> Good morning,
> 
> Hi,
> 
>> Why would we need this change?
> 
> I'm not sure if we *really* need this change. My first thought was to
> enable it to avoid this "ERRCODE"-message during startup:
> 
> ...
> [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol mqtt enable
> status not set, so enabling by default. This behavior will change in
> Suricata 7, so please update your config. See ticket #4744 for more details.
> ...
> 
> v6.0.8 comes with a new rules file for app-layer-events: 'mqtt.rules' to
> detect and avoid mqtt flooding attacks. Current standard action is 'alert'.
> 
> =>
> https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer :
> 
> What is 'mqtt'?
> 
> => https://www.opc-router.com/what-is-mqtt/ :
> 
> "MQTT – Message Queuing Telemetry Transport
> 
> MQTT (Message Queuing Telemetry Transport) is a messaging protocol for
> restricted low-bandwidth networks and extremely high-latency IoT
> devices. Since Message Queuing Telemetry Transport is specialized for
> low-bandwidth, high-latency environments, it is an ideal protocol for
> machine-to-machine (M2M) communication.
> 
> MQTT works on the publisher / subscriber principle and is operated via a
> central broker. This means that the sender and receiver have no direct
> connection. The data sources report their data via a publish and all
> recipients with interest in certain messages (“marked by the topic”) get
> the data delivered because they have registered as subscribers. In IoT
> and IIoT, MQTT is used all the way to connecting cloud environments..."
> 
> I wanted to test v6.0.8 in its (new) standard config, so I activated
> this protocol.
> 
> Until now, I found no information what "this behavioir will change in
> Suricata 7" really means.
> 
> The only information I just found:
> =>
> https://suricata.readthedocs.io/en/latest/upgrade.html#upgrading-6-0-to-7-0
> 
> "Upgrading 5.0 to 6.0
> ...
> Major changes:
> ...
> New protocols enabled by default: mqtt, rfb
> ..."
> 
> 'rfb' is already enabled in our config. If we don't want 'mqtt' we
> should set 'mqtt' to "enabled: no"

just my two cents: I think it cannot hurt to enable this; if it gets us some
more coverage on malicious IoT activity (a pleonasm, I know), there is a benefit
from it.

Acked-by: Peter Müller <peter.mueller(a)ipfire.org>

@Michael: What is your opinion on that?

Thanks, and best regards,
Peter Müller

> 
> Best,
> Matthias
> 
>> -Michael
>>
>>> On 29 Sep 2022, at 21:35, Matthias Fischer <matthias.fischer(a)ipfire.org> wrote:
>>>
>>> Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
>>> ---
>>> config/suricata/suricata.yaml | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml
>>> index 03a7a83af..fb4f9426b 100644
>>> --- a/config/suricata/suricata.yaml
>>> +++ b/config/suricata/suricata.yaml
>>> @@ -371,7 +371,7 @@ app-layer:
>>>         dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909
>>>     # MQTT, disabled by default.
>>>     mqtt:
>>> -      # enabled: no
>>> +      enabled: yes
>>>       # max-msg-length: 1mb
>>>     krb5:
>>>       enabled: yes
>>> -- 
>>> 2.34.1
>>>
>>
>