Commit Graph

17 Commits

Author SHA1 Message Date
Stefan Schantl
067e1847dc suricata.yaml: Add port 222 to list of SSH Ports
The SSH-server listened on port "222" as default on IPFire in the past.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2019-02-01 14:34:25 +01:00
Peter Müller
8059239661 Suricata: drop unused cuda HW acceleration
As stated in https://bugzilla.ipfire.org/show_bug.cgi?id=11808#c5 ,
Cuda hardware acceleration is unused and so the configuration file
section can be removed.

This partially addresses #11808.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2019-01-29 14:07:43 +01:00
Stefan Schantl
36e69d34b1 convert-snort: Use set_ownership() from ids-functions.pl
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2019-01-29 09:05:29 +01:00
Stefan Schantl
4fbd88bfad ruleset-sources: Add Emerging-Threads Pro ruleset
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2019-01-29 09:01:20 +01:00
Stefan Schantl
5b0b4182a8 convert-snort: Settings converter from snort to suricata
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2019-01-22 15:36:00 +01:00
Stefan Schantl
f5ad510e3c suricata: Use "2" as repeat-mark and repeat-mask.
The previous used "1" was already used to mark source-natted
packets.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-12-17 15:04:48 +01:00
Stefan Schantl
fd72c85eb8 Enable threshold file in suricata.yaml
Enable and specify the path to the threshold-file in the suricata.yaml,
otherwise the programm is trying to read it from a build-in default
location and prints the following error message:

Error opening file: "/etc/suricata//threshold.config": No such file or directory

Fixes #11837.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-30 15:12:29 +02:00
Stefan Schantl
21cab141ec suricata: Rule files are now located in /var/lib/suricata
Place the rulefiles from now in "/var/lib/suricata".

Fixes #11834

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-29 12:37:44 +02:00
Stefan Schantl
335114b207 suricata.yaml: Start moving to IPFire specific configuration
Remove a lot of stuff and options which are deactivated during compiling,
unsupported by the plattform or not used in IPFire.

Add an advice to the full documented suricata-example.yaml file which also
is shipped by IPFire.

More work needs to be done.

See #11808

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-24 13:41:38 +02:00
Stefan Schantl
af5e823247 suricata.yaml: Adjust classification and reference config location
Both files are included in the various rulesets, therefore use them
from the rules folder.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-24 10:54:07 +02:00
Stefan Schantl
13d077fdf2 suricata.yaml: Fix include statement for homenet file
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-24 10:28:42 +02:00
Stefan Schantl
04b5c77a45 ruleset-sources: Move to suricata optimized ruleset when using emerginthreads.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-17 07:36:54 +02:00
Stefan Schantl
cc60d3dfd3 suricata: Fix include of used rulefiles yaml
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-12 18:40:31 +02:00
Stefan Schantl
4230305558 suricata: Use HOME_NET declaration from external file
Use the gernerated HOME_NET details from
/var/ipfire/suricata/suricata-homenet.yaml which will be
generated by the WUI.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-12 07:05:24 +02:00
Stefan Schantl
101d3ece24 ids-ruleset-sources: Update download URL for snort rules
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-02 19:33:37 +02:00
Stefan Schantl
1d9b879140 ids-ruleset-sources: New package
Move the file which contains the download URL's for the IDS rulesets
into an own common package. This will allow us in future to easily ship
a changed file with a core update.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-02 19:29:36 +02:00
Stefan Schantl
4c6d6c1ee3 suricata: Install very basic config file
This config file is mostly based on the example configuration shipped
by the suricata project and needs to be enhanched.

See #11808.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
2018-08-02 09:10:25 +02:00