CentOS Installation¶

Pre-installation requirements¶

You will have to use the Fedora EPEL repository for some packages to enable this repository. It is the same for i386 and x86_64:

CentOS 5

sudo rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-5.noarch.rpm

CentOS 6

sudo rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

Before you can build Suricata for your system, run the following command to ensure that you have everything you need for the installation.

sudo yum -y install libpcap libpcap-devel libnet libnet-devel pcre \
pcre-devel gcc gcc-c++ automake autoconf libtool make libyaml \
libyaml-devel zlib zlib-devel file-devel

Depending on the current status of your system, it may take a while to complete this process.

HTP

HTP is bundled with Suricata and installed automatically. If you need to install HTP manually for other reasons, instructions can be found at HTP library installation.

IPS¶

If you plan to build Suricata with IPS capabilities use:

./configure --enable-nfqueue

There are no pre-built packages in the CentOS base or EPEL for libnfnetlink and libnetfilter_queue. If you wish, you may use the rpms in the Emerging Threats Cent OS repository:

i386

sudo rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnetfilter_queue-0.0.15-1.i386.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnetfilter_queue-devel-0.0.15-1.i386.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnfnetlink-0.0.30-1.i386.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnfnetlink-devel-0.0.30-1.i386.rpm

x86_64

sudo rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/libnetfilter_queue-0.0.15-1.x86_64.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/libnetfilter_queue-devel-0.0.15-1.x86_64.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/libnfnetlink-0.0.30-1.x86_64.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/libnfnetlink-devel-0.0.30-1.x86_64.rpm

libcap-ng installation¶

This installation is needed for dropping privileges.

sudo yum -y install python-devel
#The latest version that will compile is 0.6.6.
wget http://people.redhat.com/sgrubb/libcap-ng/libcap-ng-0.6.6.tar.gz
tar -xzvf libcap-ng-0.6.6
cd libcap-ng-0.6.6
./configure 
make 
sudo make install
ln -s /usr/local/lib/libcap-ng.so.0 /usr/lib64/libcap-ng.so.0

Suricata¶

To download and build Suricata, enter the following:

wget http://www.openinfosecfoundation.org/download/suricata-2.0.11.tar.gz
tar -xvzf suricata-2.0.11.tar.gz
cd suricata-2.0.11

If you are building from Git sources, enter all the following commands:

bash autogen.sh

If you are not building from Git sources, enter only:

./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
make
sudo make install

Auto setup¶

You can also use the available auto setup features of Suricata:

ex:

./configure && make && make install-conf

make install-conf
would do the regular "make install" and then it would automatically create/setup all the necessary directories and suricata.yaml for you.

./configure && make && make install-rules

make install-rules
would do the regular "make install" and then it would automatically download and set up the latest ruleset from Emerging Threats available for Suricata

./configure && make && make install-full

make install-full
would combine everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata

Please continue with the Basic Setup.