How To Install Suricata on Ubuntu 24.04 LTS

In today’s digital landscape, network security is paramount. Suricata, an open-source Intrusion Detection System (IDS) and Intrusion Prevention System (IPS), stands as a powerful sentinel against cyber threats. This robust tool provides real-time traffic analysis and protocol identification, making it an essential component of any robust security infrastructure.

Ubuntu 24.04 LTS, known for its stability and long-term support, serves as an excellent platform for deploying Suricata. This guide will walk you through the process of installing and configuring Suricata on Ubuntu 24.04 LTS, ensuring your network remains protected against potential security breaches.

Whether you’re a system administrator, security professional, or an enthusiast looking to bolster your network defenses, this comprehensive tutorial will equip you with the knowledge to harness Suricata’s capabilities effectively.

Prerequisites

Before diving into the installation process, it’s crucial to ensure your system meets the necessary requirements. Suricata’s performance depends heavily on your hardware specifications and network configuration. Here’s what you’ll need:

System Requirements

• CPU: Multi-core processor (4 cores or more recommended for optimal performance)
• RAM: Minimum 4GB, 8GB or more recommended for high-traffic networks
• Disk Space: At least 5GB free space for Suricata and its rulesets
• Network Interface: A compatible network interface card (NIC) capable of packet capture

User Privileges

To install and configure Suricata, you’ll need root access or sudo privileges on your Ubuntu 24.04 LTS system. This ensures you can modify system files and install packages without restrictions.

Network Configuration

For Suricata to function effectively, your network interface should be configured in promiscuous mode. This allows Suricata to capture and analyze all network traffic, not just packets addressed to your system.

With these prerequisites in place, let’s proceed to the installation process.

Step 1: Update System Packages

Before installing any new software, it’s crucial to ensure your system is up-to-date. This step helps prevent compatibility issues and ensures you have the latest security patches.

Open your terminal and run the following commands:

sudo apt update && sudo apt upgrade -y

This command updates your package lists and upgrades all installed packages to their latest versions. The `-y` flag automatically answers “yes” to any prompts, streamlining the update process.

After the update completes, it’s a good practice to reboot your system to ensure all changes take effect:

sudo reboot

Once your system restarts, you’re ready to proceed with the Suricata installation.

Step 2: Install Suricata

Ubuntu 24.04 LTS offers two primary methods to install Suricata: using the default APT repository or the PPA (Personal Package Archive) repository. Let’s explore both options.

Method 1: Using APT Repository

The simplest way to install Suricata is through Ubuntu’s default repositories. This method ensures stability but may not always provide the latest version.

To install Suricata using APT, run:

sudo apt install suricata -y

After the installation completes, verify it by checking the Suricata version:

suricata --version

This command should display the installed version of Suricata along with compilation options.

Method 2: Using PPA Repository

For those who prefer the latest features and updates, installing Suricata via PPA is recommended. This method provides access to more recent versions of Suricata.

First, add the Suricata PPA to your system:

sudo add-apt-repository ppa:oisf/suricata-stable

Update your package lists to include the new repository:

sudo apt update

Now, install Suricata:

sudo apt install suricata -y

Note: As of the writing of this guide, ensure that the PPA supports Ubuntu 24.04 LTS. If you encounter any issues, revert to the APT repository method.

Regardless of the installation method chosen, you can verify the installation by running:

suricata --build-info

This command provides detailed information about your Suricata build, including enabled features and libraries.

Step 3: Configure Suricata

With Suricata successfully installed, the next crucial step is configuration. Proper configuration ensures Suricata operates effectively within your network environment.

Locating the Configuration File

Suricata’s main configuration file is located at `/etc/suricata/suricata.yaml`. This YAML file contains various settings that control Suricata’s behavior.

To edit this file, use a text editor with root privileges:

sudo nano /etc/suricata/suricata.yaml

Key Configuration Parameters

While the configuration file is extensive, here are some critical sections to focus on:

1. Network Interface: Ensure the correct network interface is specified under the `af-packet` section. For example:

   af-packet:
     - interface: eth0
       threads: auto
       cluster-id: 99
       cluster-type: cluster_flow
       defrag: yes
       use-mmap: yes
       

   Replace `eth0` with your actual network interface name.

2. Home Network: Define your home network to help Suricata distinguish between internal and external traffic:

   vars:
     address-groups:
       HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
       

   Adjust the IP ranges to match your network configuration.

3. Rule Files: Ensure the rule files section is properly configured:

   default-rule-path: /var/lib/suricata/rules
   rule-files:
     - suricata.rules
       

   This section tells Suricata where to find its detection rules.

After making changes, save the file and exit the text editor.

Updating Suricata Rules

For Suricata to effectively detect threats, it needs up-to-date rules. Ubuntu typically installs the `suricata-oinkmaster` package for rule management. Update the rules by running:

sudo suricata-update

This command downloads and installs the latest ruleset from the configured sources.

Step 4: Enable and Start Suricata

With Suricata installed and configured, it’s time to enable and start the service.

Enabling Suricata

To ensure Suricata starts automatically on system boot, enable the service:

sudo systemctl enable suricata

Starting Suricata

Start the Suricata service with:

sudo systemctl start suricata

Verifying Suricata’s Status

Check if Suricata is running correctly:

sudo systemctl status suricata

This command should display “active (running)” if Suricata has started successfully.

Step 5: Testing Suricata Installation

To ensure Suricata is functioning as expected, it’s essential to perform some basic tests.

Generating Test Alerts

One way to test Suricata is by generating test traffic that triggers alerts. You can use tools like `curl` to access known malicious URLs:

curl http://testmynids.org/uid/index.html

This command attempts to access a test page designed to trigger IDS/IPS systems.

Checking Suricata Logs

After generating test traffic, check Suricata’s logs for alerts:

sudo tail -f /var/log/suricata/fast.log

You should see alerts related to the test traffic you generated.

Monitoring Live Traffic

To observe Suricata’s real-time traffic analysis:

sudo tail -f /var/log/suricata/eve.json | jq

This command displays a live feed of Suricata’s JSON output, formatted for readability using `jq`.

Troubleshooting Common Issues

Even with careful installation and configuration, you might encounter some issues. Here are solutions to common problems:

Suricata Fails to Start

If Suricata doesn’t start, check the system logs:

sudo journalctl -u suricata

Look for error messages that might indicate configuration problems or missing dependencies.

No Alerts Generated

If Suricata isn’t generating alerts:

1. Ensure your network interface is correctly specified in the configuration file.
2. Verify that Suricata is running in IDS mode (not IPS mode).
3. Check if the ruleset is properly loaded and up-to-date.

High CPU Usage

If Suricata is consuming excessive CPU resources:

1. Review your hardware specifications against Suricata’s requirements.
2. Adjust the number of threads in the configuration file.
3. Consider enabling multi-queue support on your network interface.

Congratulations! You have successfully installed Suricata. Thanks for using this tutorial for installing the Suricata Intrusion Detection System (IDS) on Ubuntu 24.04 LTS system. For additional help or useful information, we recommend you check the official Suricata website.