How to install and configure Suricata on ubuntu 22.04

Heya,

Step 1: Update Your System

Ensure your system is up-to-date:

sudo apt update && sudo apt upgrade -y

tep 2: Install Suricata

1. Add the Suricata PPA:

sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt update

2. Install Suricata:

sudo apt install suricata -y

3. Verify Installation: Check the installed Suricata version:

suricata --version

---

Step 3: Configure Suricata

1. Edit the Configuration File: The main configuration file is located at /etc/suricata/suricata.yaml. Open it for editing:

sudo nano /etc/suricata/suricata.yaml

Configure network interfaces (e.g., eth0):

af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes

2. Download and Update Rules: Suricata uses rules to detect threats. Download the Emerging Threats ruleset:

sudo suricata-update

After downloading, restart Suricata to apply rules:

sudo systemctl restart suricata

---

Step 4: Set Suricata in IDS Mode (Monitor Traffic)

Suricata can run in IDS mode by default, capturing traffic without blocking it. To enable IDS:

• Use tcpdump or af-packet for traffic mirroring, depending on your configuration.

Start Suricata with:

sudo suricata -c /etc/suricata/suricata.yaml -i eth0

---

Step 5: Enable IPS Mode (Block Traffic)

To enable IPS mode:

1. Install Required Tools:

sudo apt install iptables-persistent

2. Modify suricata.yaml: Enable the NFQUEUE section:

nfqueue:
  - id: 0
    bypass: no

3. Configure iptables: Redirect traffic to Suricata:

sudo iptables -I INPUT -j NFQUEUE --queue-num 0
sudo iptables -I FORWARD -j NFQUEUE --queue-num 0

4. Restart Suricata:

sudo systemctl restart suricata

Heya, @setupmybusiness

You can also check our tutorial on how to install Suricata on Ubuntu 22.04, the process will be fairly the same:

https://www.digitalocean.com/community/tutorials/how-to-install-suricata-on-ubuntu-20-04

Regards