Project

General

Profile

Feature #2350

implement a config-option for the suricata.yaml-path

Added by Wolfgang Hotwagner over 3 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

At the moment /etc/suricata/suricata.yaml is hardcoded. On my dev-system this file is located at "/usr/local/etc/suricata.yaml" and on Debian Jessie it is "/etc/suricata/suricata-debian.yaml". A configurable suricata-conf-parameter would be very handy.

#1

Updated by Jason Ish over 3 years ago

  • Status changed from New to Assigned
  • Assignee changed from Jason Ish to Wolfgang Hotwagner
  • Target version set to 1.0.0b1
#2

Updated by Victor Julien over 3 years ago

Would it make sense to also have a built-in list of paths to try?

/etc/suricata/suricata.yaml
/usr/local/etc/suricata/suricata.yaml
/etc/suricata/suricata-debian.yaml

etc

#3

Updated by Jason Ish over 3 years ago

Victor Julien wrote:

Would it make sense to also have a built-in list of paths to try?

/etc/suricata/suricata.yaml
/usr/local/etc/suricata/suricata.yaml
/etc/suricata/suricata-debian.yaml

etc

Yes, I think so. That order seems OK as well. However, /etc/suricata/suricata-debian.yaml doesn't seem to be standard. I can't find its usage in Debian using the stock Debian 9 suricata package (3.2.1) or the backport of 4.0.1. So not sure about it being in the defaults.

#4

Updated by Wolfgang Hotwagner over 3 years ago

/etc/suricata/suricata-debian.yaml is standard in Debian Jessie(which is still Supported) but not in Debian Stretch. I would agree to have a built-in list to try for /etc/suricata/suricata.yaml and
/usr/local/etc/suricata/suricata.yaml, but would still implement an option to set the path manually. Just for the user who set suricatas ./configure --prefix= to something different or for Distri-Releases like Jessie.

#5

Updated by Jason Ish over 3 years ago

Yes, the option for setting the conf file is needed. I actually keep mine somewhere else completely.

Having /etc/suricata/suricata-debian.yaml in the default list is fine. Just wasn't aware of its use as a standard location.

#6

Updated by Wolfgang Hotwagner over 3 years ago

I added the changes for multiple default locations for suricata.yaml to my commit

#7

Updated by Jason Ish over 3 years ago

  • Status changed from Assigned to Closed

Also available in: Atom PDF