Suricata Installation Guide for Ubuntu

Contents

Currently the following Ubuntu versions are available both in 32bit and 64bit:10.04 Lucid11.04 Natty11.10 Oneiric12.04 Precise12.10 Quantal1 Installation2 Upgrading3 Removing4 Beta Releases5 External Links

Currently the following Ubuntu versions are available both in 32bit and 64bit:

10.04 Lucid
11.04 Natty
11.10 Oneiric
12.04 Precise
12.10 Quantal
1 Installation
2 Upgrading
3 Removing
4 Beta Releases
5 External Links

Pre-Installation Requirements

Before you can build Suricata for your system, run the following command to ensure that you
have everything you need for the installation:

sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \

build-essential autoconf automake libtool libpcap-dev libnet1-dev \
libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \
make libmagic-dev

Depending on the current status of your system, it may take a while to complete this process.

HTP

HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for
other reasons, instructions can be found at HTP library installation.

IPS

By default, Suricata works as an IDS. If you want to use it as a IDS and IPS program, enter:

sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-dev libnfnetlink0

Installation

To download and build Suricata, enter the following:

wget http://www.openinfosecfoundation.org/download/suricata-1.3.1.tar.gztar -xvzf suricata-1.3.1.tar.gz
cd suricata-1.3.1

Compile and install the engine

If you plan to build Suricata with IPS capabilities, enter:

./configure --enable-nfqueue --prefix=/usr --sysconfdir=/etc --localstatedir=/var

instead of

./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var

Continue with the next commands:

./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
make
sudo make install
sudo ldconfig

Auto Setup

You can also use the available auto setup features of Suricata:

Example:

./configure && make && make install-conf

make install-conf would do the regular "make install" and then it would automatically
create/setup all the necessary directories and suricata.yaml for you.

./configure && make && make install-rules

make install-rules would do the regular "make install" and then it would automatically
download and set up the latest ruleset from Emerging Threats available for Suricata.

./configure && make && make install-full

make install-full would combine everything mentioned above (install-conf and install-rules)
- and will present you with a ready to run (configured and set up) Suricata.