In this tutorial, we will show you how to install Suricata on Debian 12. In today’s ever-evolving digital landscape, network security is paramount. Threats to your network can come from various angles, making it crucial to employ robust intrusion detection systems (IDS) like Suricata. This open-source IDS is known for its speed and accuracy in detecting and preventing network intrusions. To ensure optimal security, it’s essential to keep Suricata up-to-date with the latest version.
This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘
sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Suricata on a Debian 12 (Bookworm).
- A server running one of the following operating systems: Debian 12 (Bookworm).
- It’s recommended that you use a fresh OS install to prevent any potential issues.
- SSH access to the server (or just open Terminal if you’re on a desktop).
- Make sure your Debian 12 system is connected to the internet. An active connection is essential for downloading the required packages and updates during the installation.
non-root sudo useror access to the
root user. We recommend acting as a
non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.
Install Suricata on Debian 12 Bookworm
Step 1. Before we install any software, it’s important to make sure your system is up to date by running the following
apt commands in the terminal:
sudo apt update sudo apt upgrade
This command will refresh the repository, allowing you to install the latest versions of software packages.
Step 2. Installing Dependencies.
You can install these dependencies with the following command:
sudo apt install libpcap-dev libyaml-dev libpcre3 libpcre3-dev libnet1 libnet1-dev libmagic1 libmagic-dev rustc cargo -y
Step 3. Downloading and Compiling Suricata.
With the dependencies in place, it’s time to obtain the latest Suricata source code and compile it:
Extract the downloaded tarball:
tar -xvf suricata-7.0.1.tar.gz
Navigate to the Suricata source code directory:
Configure Suricata for compilation:
./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
make sudo make install
This will configure, compile, and install Suricata on your Debian 12 system.
Step 3. Installing Suricata on Debian 12.
With Suricata compiled, it’s time to install it. Run the following commands:
sudo make install-conf sudo make install-rules
These commands will install the necessary configuration files and rulesets for Suricata.
Step 4. Configuring Suricata.
Suricata’s configuration files are essential for tailoring its behavior to your network. Here’s how you can configure Suricata:
- Network Interface Configuration
Edit the Suricata configuration file to specify the network interfaces you want Suricata to monitor:
sudo nano /etc/suricata/suricata.yaml
af-packet section and define your network interface(s):
af-packet: - interface: eth0 # Replace with your network interface
- Rule Management
To enable Suricata’s default rule management system, execute:
Step 5. Starting and Managing Suricata.
To start Suricata as a service and ensure it runs on system boot, execute the following commands:
sudo systemctl enable suricata sudo systemctl start suricata
To check Suricata’s status, use:
sudo systemctl status suricata
Step 6. Testing Suricata.
After installation and configuration, it’s crucial to test Suricata to ensure it’s functioning correctly. You can generate network traffic or use tools like
wget to simulate network activity and see if Suricata detects any anomalies.
Congratulations! You have successfully installed Suricata. Thanks for using this tutorial to install the latest version of Suricata on Debian 12 Bookworm. For additional help or useful information, we recommend you check the official Suricata website.