Wazuh IDS an einem Switch: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
Zeile 5: Zeile 5:
 
*apt update
 
*apt update
 
*apt install -y suricata
 
*apt install -y suricata
 +
==Minimal Konfiguration==
 +
*cat /etc/suricata/suricata.yaml
 +
<pre>
 +
%YAML 1.1
 +
---
 +
# Standard-Log-Verzeichnis
 +
default-log-dir: /var/log/suricata/
 +
 +
# Statistiken aktivieren
 +
stats:
 +
  enabled: yes
 +
  interval: 8
 +
 +
# Ausgaben konfigurieren
 +
outputs:
 +
  - fast:
 +
      enabled: yes
 +
      filename: fast.log
 +
      append: yes
 +
  - alert-debug:
 +
      enabled: yes
 +
      filename: alert-debug.log
 +
      append: yes
 +
  - stats:
 +
      enabled: yes
 +
      filename: stats.log
 +
      append: yes
 +
      totals: yes
 +
      threads: no
 +
 +
# Logging-Einstellungen
 +
logging:
 +
  default-log-level: notice
 +
  outputs:
 +
  - console:
 +
      enabled: yes
 +
  - file:
 +
      enabled: yes
 +
      level: info
 +
      filename: suricata.log
 +
 +
# Netzwerkschnittstelle für Mirror-Port konfigurieren
 +
af-packet:
 +
  - interface: enp0s9
 +
    threads: auto
 +
    cluster-id: 99
 +
    cluster-type: cluster_flow
 +
    defrag: yes
 +
    use-mmap: yes
 +
    ring-size: 2048
 +
    buffer-size: 65535
 +
    mmap-locked: yes
 +
    tpacket-v3: yes
 +
    checksum-checks: no
 +
 +
# Alternativ PCAP-Modus (wenn AF_PACKET nicht genutzt wird)
 +
pcap:
 +
  - interface: enp0s9
 +
    buffer-size: 65535
 +
    checksum-checks: no
 +
 +
# PID-Datei
 +
pid-file: /var/run/suricata.pid
 +
 +
# Coredump-Einstellungen
 +
coredump:
 +
  max-dump: unlimited
 +
 +
# Host-Modus
 +
host-mode: auto
 +
 +
# Unix-Befehlseingabe konfigurieren
 +
unix-command:
 +
  enabled: yes
 +
  filename: /var/run/suricata-command.socket
 +
 +
# Engine-Analyse-Einstellungen
 +
engine-analysis:
 +
  rules-fast-pattern: yes
 +
  rules: yes
 +
 +
# Defragmentierungseinstellungen
 +
defrag:
 +
  memcap: 32mb
 +
  hash-size: 65536
 +
  trackers: 65535
 +
  max-frags: 65535
 +
  prealloc: yes
 +
  timeout: 60
 +
 +
# Standardregelverzeichnis
 +
default-rule-path: /etc/suricata/rules
 +
 +
# Regel-Dateien
 +
rule-files:
 +
  - local.rules
 +
 +
# Klassifikationsdatei
 +
classification-file: /etc/suricata/classification.config
 +
 +
# Referenzkonfigurationsdatei
 +
reference-config-file: /etc/suricata/reference.config
 +
app-layer:
 +
  protocols:
 +
    http:
 +
      enabled: yes
 +
    tls:
 +
      enabled: yes
 +
    dcerpc:
 +
      enabled: yes
 +
    smb:
 +
      enabled: yes
 +
    ftp:
 +
      enabled: yes
 +
    ssh:
 +
      enabled: yes
 +
    smtp:
 +
      enabled: yes
 +
    dns:
 +
      enabled: yes
 +
    modbus:
 +
      enabled: yes
 +
    enip:
 +
      enabled: yes
 +
    dnp3:
 +
      enabled: yes
 +
    nfs:
 +
      enabled: yes
 +
    ntp:
 +
      enabled: yes
 +
    tftp:
 +
      enabled: yes
 +
    ikev2:
 +
      enabled: yes
 +
    krb5:
 +
      enabled: yes
 +
    dhcp:
 +
      enabled: yes
 +
    snmp:
 +
      enabled: yes
 +
    sip:
 +
      enabled: yes
 +
    rfb:
 +
      enabled: yes
 +
    mqtt:
 +
      enabled: yes
 +
    rdp:
 +
      enabled: yes
 +
    http2:
 +
      enabled: yes
 +
    imap:
 +
      enabled: yes
 +
</pre>

Version vom 26. Februar 2025, 08:38 Uhr

Aufbau

Suricata

Installation

  • apt update
  • apt install -y suricata

Minimal Konfiguration

  • cat /etc/suricata/suricata.yaml
%YAML 1.1
---
# Standard-Log-Verzeichnis
default-log-dir: /var/log/suricata/

# Statistiken aktivieren
stats:
  enabled: yes
  interval: 8

# Ausgaben konfigurieren
outputs:
  - fast:
      enabled: yes
      filename: fast.log
      append: yes
  - alert-debug:
      enabled: yes
      filename: alert-debug.log
      append: yes
  - stats:
      enabled: yes
      filename: stats.log
      append: yes
      totals: yes
      threads: no

# Logging-Einstellungen
logging:
  default-log-level: notice
  outputs:
  - console:
      enabled: yes
  - file:
      enabled: yes
      level: info
      filename: suricata.log

# Netzwerkschnittstelle für Mirror-Port konfigurieren
af-packet:
  - interface: enp0s9
    threads: auto
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    ring-size: 2048
    buffer-size: 65535
    mmap-locked: yes
    tpacket-v3: yes
    checksum-checks: no

# Alternativ PCAP-Modus (wenn AF_PACKET nicht genutzt wird)
pcap:
  - interface: enp0s9
    buffer-size: 65535
    checksum-checks: no

# PID-Datei
pid-file: /var/run/suricata.pid

# Coredump-Einstellungen
coredump:
  max-dump: unlimited

# Host-Modus
host-mode: auto

# Unix-Befehlseingabe konfigurieren
unix-command:
  enabled: yes
  filename: /var/run/suricata-command.socket

# Engine-Analyse-Einstellungen
engine-analysis:
  rules-fast-pattern: yes
  rules: yes

# Defragmentierungseinstellungen
defrag:
  memcap: 32mb
  hash-size: 65536
  trackers: 65535
  max-frags: 65535
  prealloc: yes
  timeout: 60

# Standardregelverzeichnis
default-rule-path: /etc/suricata/rules

# Regel-Dateien
rule-files:
  - local.rules

# Klassifikationsdatei
classification-file: /etc/suricata/classification.config

# Referenzkonfigurationsdatei
reference-config-file: /etc/suricata/reference.config
app-layer:
  protocols:
    http:
      enabled: yes
    tls:
      enabled: yes
    dcerpc:
      enabled: yes
    smb:
      enabled: yes
    ftp:
      enabled: yes
    ssh:
      enabled: yes
    smtp:
      enabled: yes
    dns:
      enabled: yes
    modbus:
      enabled: yes
    enip:
      enabled: yes
    dnp3:
      enabled: yes
    nfs:
      enabled: yes
    ntp:
      enabled: yes
    tftp:
      enabled: yes
    ikev2:
      enabled: yes
    krb5:
      enabled: yes
    dhcp:
      enabled: yes
    snmp:
      enabled: yes
    sip:
      enabled: yes
    rfb:
      enabled: yes
    mqtt:
      enabled: yes
    rdp:
      enabled: yes
    http2:
      enabled: yes
    imap:
      enabled: yes
Abgerufen von „http://wiki.ixheim.de/index.php?title=Wazuh_IDS_an_einem_Switch&oldid=59074“