Thank Zhihao Tao for your hard work. The document spent countless nights and weekends, using his hard work to make it convenient for everyone.
If you have any questions, please send a email to zhihao.tao@outlook.com
1. 安裝
1.1 代碼下載
[taozhihao@localhost suricata]$ wget https://www.openinfosecfoundation.org/downloads/suricata-5.0.3.tar.gz
[taozhihao@localhost suricata]$ tar -zxvf suricata-5.0.3.tar.gz
[taozhihao@localhost suricata]$ cd suricata-5.0.3
1.2. 環(huán)境依賴
[taozhihao@localhost suricata-5.0.3]$ sudo yum install -y epel-release
[taozhihao@localhost suricata-5.0.3]$ sudo yum install -y rustc cargo
[taozhihao@localhost suricata]$ sudo yum -y install gcc libpcap-devel pcre-devel libyaml-devel file-devel \
zlib-devel jansson-devel nss-devel libcap-ng-devel libnet-devel tar make \
libnetfilter_queue-devel lua-devel PyYAML libmaxminddb-devel rustc cargo \
lz4-devel
1.3. 代碼編譯
[taozhihao@localhost suricata]$ ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --enable-nfqueue --enable-lua
[taozhihao@localhost suricata]$ make
[taozhihao@localhost suricata]$ sudo make install
[taozhihao@localhost suricata]$ sudo ldconfig
1.4. 環(huán)境配置
[taozhihao@localhost suricata]$ sudo make install-conf
[taozhihao@localhost suricata]$ sudo make install-rules
1.5. 測(cè)試
[root@localhost suricata-5.0.3]# suricata -c /etc/suricata/suricata.yaml -i enp0s3 --init-errors-fatal
- 規(guī)則文件路徑
/var/lib/suricata/rules/suricata.rules
