Suricata is a free and open-source network security monitoring and intrusion detection system (IDS/IPS) designed to detect and prevent network-based attacks. Suricata uses the powerful and efficient Suricata Engine, which is capable of real-time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitoring (NSM), and offline pcap processing.

In this article, we will show you how to install Suricata on Debian 11 (also known as “Bullseye”). We will be using the command line for this tutorial, so you will need to have a basic understanding of how to use the Linux command line.

Before we begin, there are a few prerequisites that you will need to have in place in order to install Suricata on your system:

1. A server running Debian 11
2. A user account with sudo privileges
3. Internet access

• Add the Suricata repository

To install Suricata on Debian 11, you will first need to add the Suricata repository to your system. This will allow you to install Suricata and its dependencies using the apt package manager.

To add the Suricata repository to your system, run the following command:

echo "deb <http://download.opensuse.org/repositories/home:/oisf:/suricata-stable/Debian_11.0/> /" | sudo tee /etc/apt/sources.list.d/suricata-stable.list

This command adds the Suricata repository to the list of available repositories on your system.

• Install the GPG key

To ensure that the packages that you download from the Suricata repository are authentic and have not been tampered with, you will need to install the GPG key for the repository.

To install the GPG key for the Suricata repository, run the following command:

wget -O- <https://download.opensuse.org/repositories/home:/oisf:/suricata-stable/Debian_11.0/Release.key> | sudo apt-key add -

This command downloads the GPG key for the Suricata repository and adds it to the list of trusted keys on your system.

• Update the package list

To ensure that the package manager is aware of the packages that are available in the Suricata repository, you will need to update the package list on your system.

To update the package list on your system, run the following command:

sudo apt update

This command updates the list of available packages from the repositories that are configured on your system.

• Install Suricata

To install Suricata on your system, you will need to use the apt package manager.

To install Suricata, run the following command:

sudo apt install suricata

This command installs Suricata and its dependencies on your system.

• Configure Suricata

To configure Suricata, you will need to edit the Suricata configuration file. This file contains the settings that control how Suricata behaves on your system.

To edit the Suricata configuration file, run the following command:

sudo nano /etc/suricata/suricata.yaml

This command opens the Suricata configuration file in the nano text editor.

In the configuration file, you can set various options, such as the network interface that Suricata should monitor, the rules that Suricata should use to detect attacks, and the output formats for the logs that Suricata generates.

After you have made the desired changes to the configuration file, save the file and exit the editor.

• Start Suricata

To start Suricata on your system, you will need to use the systemctl command. This command allows you to manage system services, such as Suricata.

To start Suricata, run the following command:

sudo systemctl start suricata

This will start the Suricata service on your system.

• Enable Suricata

To ensure that Suricata starts automatically when your system boots, you will need to enable the Suricata service.

To enable the Suricata service, run the following command:

sudo systemctl enable suricata

This will enable the Suricata service on your system, and it will start automatically when the system boots.

Conclusion

In this article, we showed you how to install Suricata on Debian 11. We covered all of the necessary steps, including adding the Suricata repository, installing the GPG key, updating the package list, installing Suricata, configuring Suricata, starting Suricata, and enabling the Suricata service. With Suricata installed and configured on your system, you can use it to detect and prevent network-based attacks.