How To Install Suricata on Debian 12

In this tutorial, we will show you how to install Suricata on Debian 12. In today’s ever-evolving digital landscape, network security is paramount. Threats to your network can come from various angles, making it crucial to employ robust intrusion detection systems (IDS) like Suricata. This open-source IDS is known for its speed and accuracy in detecting and preventing network intrusions. To ensure optimal security, it’s essential to keep Suricata up-to-date with the latest version.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Suricata on a Debian 12 (Bookworm).

Prerequisites

• A server running one of the following operating systems: Debian 12 (Bookworm).
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• Make sure your Debian 12 system is connected to the internet. An active connection is essential for downloading the required packages and updates during the installation.
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Suricata on Debian 12 Bookworm

Step 1. Before we install any software, it’s important to make sure your system is up to date by running the following apt commands in the terminal:

sudo apt update
sudo apt upgrade

This command will refresh the repository, allowing you to install the latest versions of software packages.

Step 2. Installing Dependencies.

You can install these dependencies with the following command:

sudo apt install libpcap-dev libyaml-dev libpcre3 libpcre3-dev libnet1 libnet1-dev libmagic1 libmagic-dev rustc cargo -y

Step 3. Downloading and Compiling Suricata.

With the dependencies in place, it’s time to obtain the latest Suricata source code and compile it:

wget https://www.openinfosecfoundation.org/download/suricata-7.0.1.tar.gz

Extract the downloaded tarball:

tar -xvf suricata-7.0.1.tar.gz

Navigate to the Suricata source code directory:

cd suricata-7.0.1

Configure Suricata for compilation:

./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var

Compile Suricata:

make
sudo make install

This will configure, compile, and install Suricata on your Debian 12 system.

Step 3. Installing Suricata on Debian 12.

With Suricata compiled, it’s time to install it. Run the following commands:

sudo make install-conf
sudo make install-rules

These commands will install the necessary configuration files and rulesets for Suricata.

Step 4. Configuring Suricata.

Suricata’s configuration files are essential for tailoring its behavior to your network. Here’s how you can configure Suricata:

• Network Interface Configuration

Edit the Suricata configuration file to specify the network interfaces you want Suricata to monitor:

sudo nano /etc/suricata/suricata.yaml

Locate the af-packet section and define your network interface(s):

af-packet:
- interface: eth0 # Replace with your network interface

• Rule Management

To enable Suricata’s default rule management system, execute:

sudo suricata-update

Step 5. Starting and Managing Suricata.

To start Suricata as a service and ensure it runs on system boot, execute the following commands:

sudo systemctl enable suricata
sudo systemctl start suricata

To check Suricata’s status, use:

sudo systemctl status suricata

Step 6. Testing Suricata.

After installation and configuration, it’s crucial to test Suricata to ensure it’s functioning correctly. You can generate network traffic or use tools like ping, curl, or wget to simulate network activity and see if Suricata detects any anomalies.

Congratulations! You have successfully installed Suricata. Thanks for using this tutorial to install the latest version of Suricata on Debian 12 Bookworm. For additional help or useful information, we recommend you check the official Suricata website.