How To Install Suricata on Ubuntu 20.04 LTS

In this tutorial, we will show you how to install Suricata on Ubuntu 20.04 LTS. For those of you who didn’t know, Suricata is a Network Security Monitoring tool that processes and controls network traffic. It is used also for generating alerts, and logs, and detecting suspicious packets or requests on any service coming to your server. By default, Suricata works as a passive Intrusion Detection System (IDS) to scan for suspicious traffic on a server or network. It will generate and log alerts for further investigation. It can also be configured as an active Intrusion Prevention System (IPS) to log, alert, and completely block network traffic that matches specific rules.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Suricata network security monitoring on Ubuntu 20.04 (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.

Prerequisites

• A server running one of the following operating systems: Ubuntu 20.04, 18.04, 16.04, and any other Debian-based distribution like Linux Mint.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Suricata on Ubuntu 20.04 LTS Focal Fossa

Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.

sudo apt update
sudo apt upgrade
sudo apt install apt-transport-https dirmngr

Step 2. Installing Suricata on Ubuntu 20.04.

By default, Suricata is not available on Ubuntu 20.04 base repository. Now run the following command below to add the Suricata repository on your Ubuntu system:

sudo add-apt-repository ppa:oisf/suricata-stable

Next, update your system’s package and install Suricata using the following command below:

sudo apt update
sudo apt install suricata

Once the installation is complete, now enable Suricata (to start automatically upon system boot) and verify the status using the commands below:

sudo systemctl enable suricata
sudo systemctl start suricata
sudo systemctl status suricata

Step 3. Configure Suricata.

The default Suricata configuration file is located at /etc/suricata/suricata.yaml. You will need to configure it to protect your internal network:

sudo nano /etc/suricata/suricata.yaml

Add the following file:

....
# more specific is better for alert accuracy and performance
  address-groups:
    #HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
     HOME_NET: "[192.168.77.21]"
    #HOME_NET: "[10.0.0.0/8]"
    #HOME_NET: "[172.16.0.0/12]"
    #HOME_NET: "any"

    EXTERNAL_NET: "!$HOME_NET"
    #EXTERNAL_NET: "any"
....

Save and close the file. Note: In the command above, replace 192.168.77.21 with your internal network.

Step 4. Test Suricata.

Once successfully installed, Suricata has a built-in test mode that will check the configuration file and any included rules for validity. Now run the following command below to test the Suricata rules for syntax errors:

sudo suricata -T -c /etc/suricata/suricata.yaml -v

Output:

17/2/2022 -- 16:00:40 - <Info> - Running suricata under test mode
17/2/2022 -- 16:00:40 - <Notice> - This is Suricata version 6.0.3 RELEASE running in SYSTEM mode
17/2/2022 -- 16:00:40 - <Info> - CPUs/cores online: 2
17/2/2022 -- 16:00:40 - <Info> - fast output device (regular) initialized: fast.log
17/2/2022 -- 16:00:40 - <Info> - eve-log output device (regular) initialized: eve.json
17/2/2022 -- 16:00:40 - <Info> - stats output device (regular) initialized: stats.log
17/2/2022 -- 16:00:46 - <Info> - 1 rule files processed. 23869 rules successfully loaded, 0 rules failed
17/2/2022 -- 16:01:46 - <Info> - Threshold config parsed: 0 rule(s) found
17/2/2022 -- 16:01:47 - <Info> - 23882 signatures processed. 1183 are IP-only rules, 4043 are inspecting packet payload, 18453 inspect application layer, 107 are decoder event only
17/2/2022 -- 16:02:36 - <Notice> - Configuration provided was successfully loaded. Exiting.
17/2/2022 -- 16:02:36 - <Info> - cleaning up signature grouping structure... complete

Congratulations! You have successfully installed Suricata. Thanks for using this tutorial for installing the Suricata network security monitoring tool on Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you check the official Suricata website.