ืืืื ืกืืึทืืืกืืืง, ืื ืืึทื ื ืคืื ื ืขืฅ ืคืึทืจืงืขืจ ืื ืงืจืืกืึทื ืืื ืืืขืื 50% ืืขืืขืจ ืืึธืจ. ืืึธืก ืคืืจื ืฆื ืึท ืคืึทืจืืจืขืกืขืจื ืืื ืื ืืึทืกืข ืืืืฃ ืื ืืืกืจืืื ืืื, ืกืคึผืขืฆืืขื, ืื ืงืจืืกืื ืื ืคืึธืจืฉืืขืืื ื ืจืขืงืืืืจืขืืขื ืฅ ืคืื IDS / IPS. ืืืจ ืงืขื ืขื ืงืืืคื ืืืึทืขืจ ืกืคึผืขืฉืึทืืืืื ืืึทืื ืืืึทืจื, ืึธืืขืจ ืขืก ืืื ืึท ืืฉืืคึผืขืจ ืึธืคึผืฆืืข - ืืืคึผืืึทืืขื ืื ื ืืืื ืขืจ ืคืื ืื ืขืคึฟืขื ืขื ืืงืืจ ืกืืกืืขืืขื. ืคืืืข ืึธื ืืืืืขืจ ืึทืืืื ืืกืืจืึทืืึธืจืก ืืจืึทืืื ืึทื ืื ืกืืึธืืื ื ืืื ืงืึทื ืคืืืืขืจ ืึท ืคืจืื IPS ืืื ืืึทื ืฅ ืฉืืืขืจ. ืืื ืืขื ืคืึทื ืคืื Suricata, ืืึธืก ืืื ื ืืฉื ืืขืืึทืืจืข ืืืช - ืืืจ ืงืขื ืขื ืื ืกืืึทืืืจื ืขืก ืืื ืึธื ืืืืื ืจืืคึผืขืืื ื ื ืึธืจืืึทื ืื ืคืืื ืืื ืึท ืกืืื ืคืื ืคืจืื ืึผืืืื ืืื ืึท ืืืกื ืืื ืื.
ืคืืจืืืืก ืืึธื ืืืจ ืืึทืจืคึฟื ืื ืื ืืขืจ ืขืคืขื ืขื IPS?
ืืึทื ื ืืขืืืืื ืื ืกืืึทื ืืึทืจื, ืกื ืึธืจื ืืื ืืขืืืขื ืืื ืึทื ืืืืืงืืื ื ืืื ื ืื ืฉืคึผืขื ื ืืื ืืื, ืึทืืื ืขืก ืืื ืืขืืืขื ืขืจืืืืฉื ืึทืื ืืืื-ืคืึธืืขื. ืืืืขืจ ืื ืืึธืจื, ืขืก ืืื ืงืื ื ืึทืืข ืื ืืึธืืขืจื ืคึฟืขืึดืงืืืื, ืึทืืึท ืืื IPv6 ืฉืืืฆื, ืื ืคืืืืงืืื ืฆื ืคืื ืึทื ืืขืจืงืืืึทืื ืคึผืจืึธืืึธืงืึธืืก ืืืืฃ ืึทืคึผืืึทืงืืืฉืึทื ืืืจืื ืึธืืขืจ ืึท ืื ืืืืขืจืกืึทื ืืึทืื ืึทืงืกืขืก ืืึธืืืืข.
ืื ืืงืขืจืืืง ืกื ืึธืจื 2.X ืืึธืืึธืจ ืืขืืขืจื ื ืฆื ืึทืจืืขืื ืืื ืงืืืคื ืงืึธืจืขืก, ืึธืืขืจ ืคืืจืืืืื ืืืื-ืืจืขืืื ืืื ืงืขื ืืขืจืืืขืจ ื ืืฉื ืึธืคึผืืืืึทื ื ืืฆื ืืึธืืขืจื ืืึทืื ืืืึทืจื ืคึผืืึทืืคืึธืจืืก.
ืืขืจ ืคึผืจืึธืืืขื ืืื ืกืึทืืืื ืืื ืื ืืจืื ืืืขืจืกืืข ืคืื โโืื ืกืืกืืขื, ืึธืืขืจ ืขืก ืืขื ืืืขื ืึทืืื ืืึทื ื ืฆื ืฆืืืจืืืื ืึทื Suricata, ืืขืฉืจืืื ืคึฟืื ืงืจืึทืฆื, ืืขืจืืื ืฆื ืืขืจืฉืืึทื ืขื ืืืืฃ ืื ืืึทืจืง. ืืื 2009, ืขืก ืื ืืขืืืืื ืฆื ืืืื ืืขืืืขืืึธืคึผืขื ืคึผืื ืงื ืืื ืึท ืืืืื-ืืจืขืืขื ืื ืืขืจ ืืจืืจื ืฆื ืกื ืึธืจื, ืืืึธืก ืืื IPS ืคืึทื ืืงืฉืึทื ื ืืืืก ืคืื ืื ืงืขืกืื. ืืขืจ ืงืึธื ืืื ืคืื ืื ืืขืจืืขืืืืื ืืื ืืขืจ ืื GPLv2 ืืขืจืืืืืขื ืืฉ, ืึธืืขืจ ืื ืคืื ืึทื ืฆืืขื ืคึผืึทืจืื ืขืจืก ืคืื ืื ืคึผืจืืืขืงื ืืึธืื ืึทืงืกืขืก ืฆื ืึท ืคืืจืืืื ืืืขืจืกืืข ืคืื โโโโืื ืืึธืืึธืจ. ืขืืืขืืข ืคืจืืืืขืืขื ืืื ืกืงืึทืืึทืืืืืื ืืขื ืขื ืืืืคืืขืฉืืื ืขื ืืื ืืขืจ ืขืจืฉืืขืจ ืืืขืจืกืืขืก ืคืื ืื ืกืืกืืขื, ืึธืืขืจ ืืื ืืขื ืขื ืจืืืึทืืืื ืืึทื ืฅ ืืขืฉืืืื ื.
ืคืืจืืืืก ืกืืจืืงืึทืืึท?
Suricata ืืื ืขืืืขืืข ืืึทืืืฉืืื (ืืื ืกื ืึธืจื): ืืึทืคึผื, ืึทืงืืืึทืืืฉืึทื, ืืืงืึธืืืื ื, ืืืืขืงืฉืึทื ืืื ืจืขืืืืืึทื. ืืืจื ืคืขืืืงืืึทื, ืงืึทืคึผืืฉืขืจื ืคืึทืจืงืขืจ ืืืื ืืืืืขืจ ืืืงืึธืืืื ื ืืื ืืืื ืคืึธืืขื, ืืึธืืฉ ืืึธืก ืืึธืืื ืื ืกืืกืืขื ืืขืจ. ืืืื ื ืืืืืง, ืคึฟืขืืขื ืงืขื ืขื ืืืื ืฆืขืืืืื ืืื ืื ืกืขืืืื ืืก ืืื ืฆืขืฉืืงื ืฆืืืืฉื ืคึผืจืึทืกืขืกืขืจื - Suricata ืืื ืืืืขืจ ืึธืคึผืืืืืืขื ืคึฟืึทืจ ืกืคึผืขืฆืืคืืฉ ืืึทืื ืืืึทืจื, ืืึธืืฉ ืืึธืก ืืื ื ืื ืืขืจ ืึท HOWTO ืืืจืื ืคึฟืึทืจ ืืืืื ืขืจื. ืขืก ืืื ืืืื ืืืื ืฆื ืืืืขืจืงื ืึทื Suricata ืืื ืึทืืืึทื ืกืืจืืข ืืืืคึผ ืืืจืืงืืง ืืืฉืืจืื ืืืืืจื ืืืืฃ ืื HTP ืืืืืืึธืืขืง. ืืื ืงืขื ืขื ืืืื ืืืื ืืขื ืืฆื ืฆื ืงืืึธืฅ ืคืึทืจืงืขืจ ืึธื ืืืืขืงืฉืึทื. ืื ืกืืกืืขื ืืืื ืฉืืืฆื IPv6 ืืืงืึธืืืื ื, ืึทืจืืึทื ืืขืจืขืื ื IPv4-in-IPv6, IPv6-in-IPv6 ืืึทื ืึทืื ืืื ืื ืืขืจืข.
ืคืึทืจืฉืืืขื ืข ืื ืืขืจืคืืืกืื ืงืขื ืขื ืืืื ืืขืืืืื ื ืฆื ืื ืืขืจืกืขืคึผื ืคืึทืจืงืขืจ (NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING), ืืื ืืื Unix Socket ืืึธืืข ืืืจ ืงืขื ืขื ืืืืืึธืืึทืืืฉ ืึทื ืึทืืืื PCAP ืืขืงืขืก ืงืึทืคึผืืฉืขืจื ืืืจื ืื ืื ืืขืจ ืกื ืืคืคืขืจ. ืืื ืึทืืืฉืึทื, ืื ืืึทืืืฉืึทืืขืจ ืึทืจืงืึทืืขืงืืฉืขืจ ืคืื Suricata ืืืื ืขืก ืืจืื ื ืฆื ืคืึทืจืืื ืื ื ืืึทืข ืขืืขืืขื ืื ืฆื ืืึทืคึผื, ืืขืงืึธืืข, ืึทื ืึทืืืื ืืื ืคึผืจืึธืฆืขืก ื ืขืฅ ืคึผืึทืงืืฅ. ืขืก ืืื ืืืื ืืืืืืืง ืฆื ืืึธื ืึทื ืืื Suricata, ืคืึทืจืงืขืจ ืืื ืืคืืขืฉืืขืื ืืื ืื ื ืึธืจืืึทื ืึธืคึผืขืจืืืืื ื ืกืืกืืขื ืคืืืืขืจ. ืืื GNU/Linux, ืฆืืืื ืึธืคึผืฆืืขืก ืคึฟืึทืจ IPS ืึธืคึผืขืจืึทืฆืืข ืืขื ืขื ืืืจืขืืืืื: ืืืจื ืื NFQUEUE ืจืื (NFQ ืืึธืืข) ืืื ืืืจื ื ืื ืงืึธืคึผืืข (AF_PACKET ืืึธืืข). ืืื ืืขืจ ืขืจืฉืืขืจ ืคืึทื, ืึท ืคึผืึทืงืึทื ืืืึธืก ืึทืจืืึทื iptables ืืื ืืขืฉืืงื ืฆื ืื NFQUEUE ืจืื, ืืื ืขืก ืงืขื ืขื ืืืื ืคึผืจืึทืกืขืกื ืืืืฃ ืืขืจ ืืึทื ืืฆืขืจ ืืืจืื. Suricata ืืืืคื ืขืก ืืืื ืืืื ืืืืืขื ืข ืึผืืืื ืืื ืึทืจืืืกืืขืื ืืืื ืขืจ ืคืื ืืจืื ืืืขืจืืืงืืก: NF_ACCEPT, NF_DROP ืืื NF_REPEAT. ืื ืขืจืฉืืข ืฆืืืื ืืขื ืขื ืืื-ืืงืกืคึผืืึทื ืึทืืึธืจื, ืึธืืขืจ ืื ืืขืฆืืข ืึทืืึทืื ืืืจ ืฆื ืฆืืืื ืคึผืึทืงืืฅ ืืื ืฉืืงื ืืื ืฆื ืื ืึธื ืืืื ืคืื ืื ืงืจืึทื ื ืืคึผืืึทืืืขืก ืืืฉ. ืื AF_PACKET ืืึธืืข ืืื ืคืึทืกืืขืจ, ืึธืืขืจ ืืืคึผืึธืืืึทื ืึท ื ืืืขืจ ืคืื ืจืืกืืจืืงืฉืึทื ื ืืืืฃ ืื ืกืืกืืขื: ืขืก ืืืื ืืึธืื ืฆืืืื ื ืขืฅ ืื ืืขืจืคืืืกืื ืืื ืึทืจืืขื ืืื ืึท ืืืืืืืื. ืื ืืคืืขืฉืืขืื ืคึผืึทืงืึทื ืืื ืคืฉืื ื ืืฉื ืคืึธืจืืืขืจืืื ืฆื ืื ืจืืข ืฆืืืื ื.
ืึท ืืืืืืืง ืฉืืจืื ืคืื Suricata ืืื ืื ืคืืืืงืืื ืฆื ื ืืฆื ืืืืืขืืึทืคึผืืึทื ืฅ ืคึฟืึทืจ ืกื ืึธืจื. ืืขืจ ืึทืืืื ืืกืืจืึทืืึธืจ ืืื ืึทืงืกืขืก ืฆื, ืกืคึผืขืฆืืขื, ืื Sourcefire VRT ืืื OpenSource Emerging Threats ืืขืจืฉื ืฉืืขืื, ืืื ืืขืืื ื ืืื ืื ืืขืฉืขืคื Emerging Threats Pro. ืื ืืื ืึทืคืืื ืจืขืืืืืึทื ืงืขื ืขื ืืืื ืึทื ืึทืืืืื ืืื ืคืึธืืงืก ืืึทืงืขื ืื, ืืื ืจืขืืืืืึทื ืฆื PCAP ืืื Syslog ืืื ืืืื ืืขืฉืืืฆื. ืกืืกืืขื ืกืขืืืื ืืก ืืื ืึผืืืื ืืขื ืขื ืกืืึธืจื ืืื YAML ืืขืงืขืก, ืืืึธืก ืืขื ืขื ืืจืื ื ืฆื ืืืืขื ืขื ืืื ืงืขื ืขื ืืืื ืคึผืจืึทืกืขืกื ืืืืืึธืืึทืืืฉ. ืื ืกืืจืืงืึทืืึท ืืึธืืึธืจ ืื ืขืจืงืขื ื ืคืืืข ืคึผืจืึธืืึธืงืึธืืก, ืึทืืื ืื ืึผืืืื ืืึธื ื ืื ืืึทืจืคึฟื ืฆื ืืืื ืืืื ืฆื ืึท ืคึผืึธืจื ื ืืืขืจ. ืืื ืืขืจืฆื, ืืขืจ ืืึทืืจืืฃ ืคืื ืคืืึธืืืืืืก ืืื ืึทืงืืืืืื ืคึผืจืึทืงืืืกื ืืื ืื ืกืืจืืงืึทืืึท ืึผืืืื. ืฆื ืฉืคึผืืจ ืืจืืืขืจืื ื, ืกืขืกืืข ืืืขืจืืึทืืึทืื ืืขื ืขื ืืขื ืืฆื, ืืืึธืก ืืึธืื ืืืจ ืฆื ืฉืึทืคึฟื ืืื ืฆืืืืืื ืคืึทืจืฉืืื ืงืึธืื ืืขืจืก ืืื ืคืืึทืืก. ืคืืืข IDSs ืืืึทืื ืคืึทืจืฉืืืขื ืข TCP ืงืึทื ืขืงืฉืึทื ื ืืื ืืึทืืื ืืขืจ ืขื ืืืืื ืืื ืงืขื ื ืืฉื ืืขื ืื ืงืฉืจ ืฆืืืืฉื ืืื ืฆื ืึธื ืืืืึทืื ืื ืึธื ืืืื ืคืื ืึท ืืึทืคืึทืื. Suricata ืคืจืืืื ืฆื ืืขื ืื ืืื ืฆืข ืืืื ืืื ืืื ืคืืืข ืงืึทืกืขืก ืื ืขืจืงืขื ื ืืืืืข ืคืึทืจืงืขืจ ืคืื ืื ืืขืจืืขืืืืื ืืืืขืจ ืคืึทืจืฉืืืขื ืข ืงืึทื ืขืงืฉืึทื ื. ืืืจ ืงืขื ืขื ืจืขืื ืืืขืื ืื ืึทืืืืึทื ืืืืืฉืื ืคึฟืึทืจ ืึท ืืึทื ื ืฆืืึทื; ืืืจ ืืืขืื ืืขืกืขืจ ืืืื ืฆื ืืึทื ืืึธื ืืืจืื ื ืืื ืงืึทื ืคืืืืขืจืืืฉืึทื.
ืืื ืฆื ืื ืกืืึทืืืจื?
ืืืจ ืืืขืื ืื ืกืืึทืืืจื Suricata ืืืืฃ ืึท ืืืืจืืืึทื ืกืขืจืืืขืจ ืืื Ubuntu 18.04 LTS. ืื ืงืึทืืึทื ืื ืืืื ืืืื ืขืงืกืึทืงืืืืึทื ืืื ืกืืคึผืขืจืืกืขืจ (ืืืึธืจืฆื). ืื ืืขืจืกื ืืืืขืจ ืึธืคึผืฆืืข ืืื ืฆื ืคืึทืจืืื ืื ืฆื ืื ืกืขืจืืืขืจ ืืืจื SSH ืืื ืึท ื ืึธืจืืึทื ืืึทื ืืฆืขืจ, ืืื ืืขืจื ืึธื ื ืืฆื ืื ืกืืืึธ ืืืืืืึทืืื ืฆื ืขืกืงืึทืืืื ืคึผืจืืืืืืึทืืืฉืึทื. ืขืจืฉืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืื ืกืืึทืืืจื ืื ืคึผืึทืงืึทืืืฉืึทื ืืืึธืก ืืืจ ืืึทืจืคึฟื:
sudo apt -y install libpcre3 libpcre3-dev build-essential autoconf automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev libjansson-dev pkg-config libnetfilter-queue-dev geoip-bin geoip-database geoipupdate apt-transport-httpsืงืึทื ืขืงืืื ื ืึท ืคืื ืืจืืืกื ืืืง ืจืืคึผืึทืืึทืืึธืจื:
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get updateืื ืกืืึทืืืจื ืื ืืขืฆืืข ืกืืึทืืื ืืืขืจืกืืข ืคืื โโSuricata:
sudo apt-get install suricataืืืื ื ืืืืืง, ืจืขืืึทืืืจื ืื ื ืึธืืขื ืคืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืขืก, ืจืืคึผืืืืกืื ื ืื ืคืขืืืงืืึทื eth0 ืืื ืื ืคืึทืงืืืฉ ื ืึธืืขื ืคืื ืื ืคืื ืืจืืืกื ืืืง ืฆืืืื ื ืคืื ืื ืกืขืจืืืขืจ. ืคืขืืืงืืึทื ืกืขืืืื ืืก ืืขื ืขื ืกืืึธืจื ืืื ืื /etc/default/suricata ืืขืงืข, ืืื ืื ืื ืกืขืืืื ืืก ืืขื ืขื ืกืืึธืจื ืืื /etc/suricata/suricata.yaml. IDS ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืืขืจืกืื ืก ืืืืืืขื ืฆื ืขืืืืื ื ืืขื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข. ืขืก ืืื ืคืืืข ืคึผืึทืจืึทืืขืืขืจืก ืืืึธืก, ืืื ื ืึธืืขื ืืื ืฆืื, ืฆืื ืืืคืคืึทืื ืืื ืืืืขืจ ืึทื ืึทืืึธืืืขืก ืคืื ืกื ืึธืจื. ืืขืจ ืกืื ืืึทืงืก ืืื ืคืื ืืขืกืืืืขืื ืืึธืจ ืึทื ืืขืจืฉ, ืึธืืขืจ ืื ืืขืงืข ืืื ืคืื ืืจืื ืืขืจ ืฆื ืืืืขื ืขื ืืื Snort ืงืึทื ืคืืืืขืจืืืฉืึทื ื, ืืื ืขืก ืืื ืืืื ืืื ืงืึทืืขื ืืึทื.
sudo nano /etc/default/suricata
ะธ
sudo nano /etc/suricata/suricata.yaml
ืืคืืขืจืงืืึทืืงืืึทื! ืืืืืขืจ ืืืจ ืึธื ืืืืื, ืืืจ ืืึธื ืงืึธื ืืจืึธืืืจื ืื ืืืึทืืืขืก ืคืื ืื ืืืขืจืืึทืืึทืื ืคืื ืื ืืืึทืจืก ืึธืคึผืืืืืื ื.
ืฆื ืคืึทืจืขื ืืืงื ืื ืกืขืืึทืคึผ, ืืืจ ืืืขื ืืึทืจืคึฟื ืฆื ืื ืกืืึทืืืจื ืกืจืืงืึทืืึท-ืืขืจืืืึทื ืืืงื ืฆื ืืขืจืืืึทื ืืืงื ืืื ืืจืืคืงืืคืืข ืื ืึผืืืื. ืืึธืก ืืื ืืึทื ืฅ ืืจืื ื ืฆื ืืึธื:
sudo apt install python-pip
sudo pip install pyyaml
sudo pip install <a href="https://github.com/OISF/suricata-update/archive/master.zip">https://github.com/OISF/suricata-update/archive/master.zip</a>
sudo pip install --pre --upgrade suricata-updateืืืืึทืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืืืืคื ืื ืกืขืจืืงืึทืืึท-ืืขืจืืืึทื ืืืงื ืืึทืคึฟืขื ืฆื ืื ืกืืึทืืืจื ืื ืืืขืจืืืฉืื ื ืืจืขืฅ ืขืคึฟื ืจืืืขืก:
sudo suricata-update
ืฆื ืืขื ืื ืจืฉืืื ืคืื ืืขืจืฉื ืงืืืืื, ืืืืคื ืื ืคืืืืขื ืืข ืืึทืคึฟืขื:
sudo suricata-update list-sources
ืืขืจืืืึทื ืืืงื ืืขืจืฉื ืงืืืืื:
sudo suricata-update update-sources
ืืืจ ืงืืงื ืืืืืขืจ ืืื ืื ืืขืจืืืึทื ืืืงื ืืงืืจืื:
sudo suricata-update list-sourcesืืืื ื ืืืืืง, ืืืจ ืงืขื ืขื ืึทืจืืึทื ื ืขืืขื ืื ืืืฆื ืคืจืื ืงืืืืื:
sudo suricata-update enable-source ptresearch/attackdetection
sudo suricata-update enable-source oisf/trafficid
sudo suricata-update enable-source sslbl/ssl-fp-blacklistื ืึธื ืืขื, ืืืจ ืืึทืจืคึฟื ืฆื ืืขืจืืืึทื ืืืงื ืื ืึผืืืื ืืืืืขืจ:
sudo suricata-updateืืื ืืขื ืคืื ื, ืื ืื ืกืืึทืืืจืื ื ืืื ืขืจืฉื ืงืึทื ืคืืืืขืจืืืฉืึทื ืคืื Suricata ืืื Ubuntu 18.04 LTS ืงืขื ืขื ืืืื ืืขืจืขืื ื ืืื ืืึทื ืฅ. ืืขืจื ืึธื ืื ืฉืคึผืึทืก ืืืืื: ืืื ืืขืจ ืืืืึทืืขืจ ืึทืจืืืงื ืืืจ ืืืขืื ืคืึทืจืืื ืื ืึท ืืืืจืืืึทื ืกืขืจืืืขืจ ืฆื ืื ืึธืคืืก ื ืขืฅ ืืืจื ืืืคึผื ืืื ืึธื ืืืืื ืฆื ืึทื ืึทืืืื ืึทืืข ืื ืงืึทืืื ื ืืื ืึทืืืืึธืืื ื ืคืึทืจืงืขืจ. ืืืจ ืืืขืื ืืึทืฆืึธืื ืกืคึผืขืฆืืขื ืืคืืขืจืงืืึทืืงืืื ืฆื ืืืึทืงืื ื DDoS ืื ืคืืื, ืืึทืืืืึทืจืข ืึทืงืืืืืืืขืื ืืื ืคืจืืืื ืฆื ืืืืืจืข ืืืึทืื ืขืจืึทืืืืืืื ืืื ืกืขืจืืืืกืขืก ืฆืืืจืืืืขื ืคึฟืื ืฆืืืืจ ื ืขืืืืึธืจืงืก. ืคึฟืึทืจ ืงืืขืจืืื, ืึทืืึทืงืก ืคืื ืื ืืขืจืกื ืคึผืจืึธืกื ืืืืคึผืก ืืืขื ืืืื ืกืืืืึทืืืืืื.
ืืงืืจ: www.habr.com