This blog entry is a mini-howto on the installation and configuration of Suricata with Oinkmaster, on Debian. If you are familiar with the Debian commands it should take no more than five minutes.
It was tested on Debian Sid, but should work for all Debian versions.
Suricata is in Debian since Squeeze, so a simple:
apt-get install suricata
will do the job.
To work, Suricata needs some rules. The package "snort-rules-default" provides some rules for Snort, but since Suricata is compatible these rules will work.
However, these rules have some problems: they are outdated (and updated only very rarely), and they are not written for Suricata (and cannot use the specific keywords). Emerging Threats provides some rules (both open source and Pro). We will now configure Oinkmaster and Suricata to be able to automatically update the signatures.
Oinkmaster is a tool to help you manage your signatures. While it is primarily designed for Snort, it also works for Suricata.
If you have installed Suricata using the default configuration, then Oinkmaster should be installed (it is recommended by the package). If not, run:
apt-get install oinkmaster
Edit the configuration file
url = http://rules.emergingthreats …