ports/security/suricata/pkg

+-----------------------------------------------------------------------
| Running ${PKGSTEM} on OpenBSD
+-----------------------------------------------------------------------

Starting Suricata
=================
For normal use, you need to first set your interface and enable the
daemon:

# rcctl enable suricata
# rcctl set suricata flags -i em0

The default configuration uses a very basic set of rules bundled with
Suricata and installed in the ${SYSCONFDIR}/suricata/rules directory.
A standard installation uses additional rules as shown in the following
section.

Rule management
===============
It is possible to download and install rules manually, but it is easier
and quicker to use one of the available tools to do this.

suricata-update
---------------
suricata-update is the recommended way to install and update rules.
Run it with the -D flag to download the rules to the directory
suricata expects (${LOCALSTATEDIR}/suricata/rules):

# suricata-update -D ${LOCALSTATEDIR}/suricata

Oinkmaster
----------
The other common method is with Oinkmaster which can be installed with:

# pkg_add oinkmaster

There are several rulesets. There is for example Emerging Threats (ET)
Emerging Threats Pro and VRT. In this example we are using Emerging
Threats.

Oinkmaster has to know where the rules an be found. These rules can be
found at:

https://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz

And you can download as follow:

# cd /etc && oinkmaster -C ${SYSCONFDIR}/oinkmaster.conf \
	-o ${SYSCONFDIR}/suricata/rules

Edit ${SYSCONFDIR}/suricata/suricata.yaml, comment out the default
default-rule-path section and uncomment the commented out
default-rule-path section.

After updating rules
--------------------
After installing the new rulesets with one of the above methods, restart
Suricata to pick them up:

# rcctl restart suricata

Note that the installed rules have to be updated regularly by the program
used to fetch them initially. For example use cron to update the rules
every 24h.

Inline mode (IPS)
=================
The default configuration captures packets via pcap on a network interface
and runs detection methods.

Suricata can also run "inline" in Intrusion Prevention mode. To do this,
add the following to /etc/pf.conf:

	pass out quick on egress inet proto tcp to port 80 divert-packet port 700

Adjust this to match what traffic Suricata will need to inspect as well as
the divert port use. Configure to enable inline mode on divert port 700
like this:

# rcctl set suricata flags -d 700

Outbound packets might not have a correct checksum yet due to checksum
offloading, therefore Suricata will log "SURICATA TCPv4 invalid checksum"
and ignore these packets. This can be worked around with the following
setting in suricata.yaml:

	stream:
	  checksum-validation: yes

Also adjust the configuration to drop packets:

	- drop:
	  enabled: yes

(Re)start Suricata for the changes to take effect. Note that IPS mode is
mutually exclusive with pcap live mode (-i).