In this tutorial, we will show you how to install Suricata on Ubuntu 20.04 LTS. For those of you who didn’t know, Suricata is a Network Security Monitoring tool that processes and controls network traffic. It is used also for generating alerts, and logs, and detecting suspicious packets or requests on any service coming to your server. By default, Suricata works as a passive Intrusion Detection System (IDS) to scan for suspicious traffic on a server or network. It will generate and log alerts for further investigation. It can also be configured as an active Intrusion Prevention System (IPS) to log, alert, and completely block network traffic that matches specific rules.
This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘
sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Suricata network security monitoring on Ubuntu 20.04 (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.
- A server running one of the following operating systems: Ubuntu 20.04, 18.04, 16.04, and any other Debian-based distribution like Linux Mint.
- It’s recommended that you use a fresh OS install to prevent any potential issues.
- SSH access to the server (or just open Terminal if you’re on a desktop).
non-root sudo useror access to the
root user. We recommend acting as a
non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.
Install Suricata on Ubuntu 20.04 LTS Focal Fossa
Step 1. First, make sure that all your system packages are up-to-date by running the following
apt commands in the terminal.
sudo apt update sudo apt upgrade sudo apt install apt-transport-https dirmngr
Step 2. Installing Suricata on Ubuntu 20.04.
By default, Suricata is not available on Ubuntu 20.04 base repository. Now run the following command below to add the Suricata repository on your Ubuntu system:
sudo add-apt-repository ppa:oisf/suricata-stable
Next, update your system’s package and install Suricata using the following command below:
sudo apt update sudo apt install suricata
Once the installation is complete, now enable Suricata (to start automatically upon system boot) and verify the status using the commands below:
sudo systemctl enable suricata sudo systemctl start suricata sudo systemctl status suricata
Step 3. Configure Suricata.
The default Suricata configuration file is located at
/etc/suricata/suricata.yaml. You will need to configure it to protect your internal network:
sudo nano /etc/suricata/suricata.yaml
Add the following file:
.... # more specific is better for alert accuracy and performance address-groups: #HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"HOME_NET: "[192.168.77.21]" #HOME_NET: "[10.0.0.0/8]" #HOME_NET: "[172.16.0.0/12]" #HOME_NET: "any"EXTERNAL_NET: "!$HOME_NET" #EXTERNAL_NET: "any" ....
Save and close the file. Note: In the command above, replace 192.168.77.21 with your internal network.
Step 4. Test Suricata.
Once successfully installed, Suricata has a built-in test mode that will check the configuration file and any included rules for validity. Now run the following command below to test the Suricata rules for syntax errors:
sudo suricata -T -c /etc/suricata/suricata.yaml -v
17/2/2022 -- 16:00:40 - <Info> - Running suricata under test mode 17/2/2022 -- 16:00:40 - <Notice> - This is Suricata version 6.0.3 RELEASE running in SYSTEM mode 17/2/2022 -- 16:00:40 - <Info> - CPUs/cores online: 2 17/2/2022 -- 16:00:40 - <Info> - fast output device (regular) initialized: fast.log 17/2/2022 -- 16:00:40 - <Info> - eve-log output device (regular) initialized: eve.json 17/2/2022 -- 16:00:40 - <Info> - stats output device (regular) initialized: stats.log 17/2/2022 -- 16:00:46 - <Info> - 1 rule files processed. 23869 rules successfully loaded, 0 rules failed 17/2/2022 -- 16:01:46 - <Info> - Threshold config parsed: 0 rule(s) found 17/2/2022 -- 16:01:47 - <Info> - 23882 signatures processed. 1183 are IP-only rules, 4043 are inspecting packet payload, 18453 inspect application layer, 107 are decoder event only 17/2/2022 -- 16:02:36 - <Notice> - Configuration provided was successfully loaded. Exiting. 17/2/2022 -- 16:02:36 - <Info> - cleaning up signature grouping structure... complete
Congratulations! You have successfully installed Suricata. Thanks for using this tutorial for installing the Suricata network security monitoring tool on Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you check the official Suricata website.