Suricata is a free and open-source network security monitoring and intrusion detection system (IDS/IPS) designed to detect and prevent network-based attacks. Suricata uses the powerful and efficient Suricata Engine, which is capable of real-time intrusion detection (IDS), inline intrusion prevention (IPS), network security monitoring (NSM), and offline pcap processing.
In this article, we will show you how to install Suricata on Debian 11 (also known as “Bullseye”). We will be using the command line for this tutorial, so you will need to have a basic understanding of how to use the Linux command line.
Before we begin, there are a few prerequisites that you will need to have in place in order to install Suricata on your system:
- A server running Debian 11
- A user account with sudo privileges
- Internet access
- Add the Suricata repository
To install Suricata on Debian 11, you will first need to add the Suricata repository to your system. This will allow you to install Suricata and its dependencies using the apt package manager.
To add the Suricata repository to your system, run the following command:
echo "deb <http://download.opensuse.org/repositories/home:/oisf:/suricata-stable/Debian_11.0/> /" | sudo tee /etc/apt/sources.list.d/suricata-stable.list
This command adds the Suricata repository to the list of available repositories on your system.
- Install the GPG key
To ensure that the packages that you download from the Suricata repository are authentic and have not been tampered with, you will need to install the GPG key for the repository.
To install the GPG key for the Suricata repository, run the following command:
wget -O- <https://download.opensuse.org/repositories/home:/oisf:/suricata-stable/Debian_11.0/Release.key> | sudo apt-key add -
This command downloads the GPG key for the Suricata repository and adds it to the list of trusted keys on your system.
- Update the package list
To ensure that the package manager is aware of the packages that are available in the Suricata repository, you will need to update the package list on your system.
To update the package list on your system, run the following command:
sudo apt update
This command updates the list of available packages from the repositories that are configured on your system.
- Install Suricata
To install Suricata on your system, you will need to use the apt package manager.
To install Suricata, run the following command:
sudo apt install suricata
This command installs Suricata and its dependencies on your system.
- Configure Suricata
To configure Suricata, you will need to edit the Suricata configuration file. This file contains the settings that control how Suricata behaves on your system.
To edit the Suricata configuration file, run the following command:
sudo nano /etc/suricata/suricata.yaml
This command opens the Suricata configuration file in the nano text editor.
In the configuration file, you can set various options, such as the network interface that Suricata should monitor, the rules that Suricata should use to detect attacks, and the output formats for the logs that Suricata generates.
After you have made the desired changes to the configuration file, save the file and exit the editor.
- Start Suricata
To start Suricata on your system, you will need to use the systemctl command. This command allows you to manage system services, such as Suricata.
To start Suricata, run the following command:
sudo systemctl start suricata
This will start the Suricata service on your system.
- Enable Suricata
To ensure that Suricata starts automatically when your system boots, you will need to enable the Suricata service.
To enable the Suricata service, run the following command:
sudo systemctl enable suricata
This will enable the Suricata service on your system, and it will start automatically when the system boots.
Conclusion
In this article, we showed you how to install Suricata on Debian 11. We covered all of the necessary steps, including adding the Suricata repository, installing the GPG key, updating the package list, installing Suricata, configuring Suricata, starting Suricata, and enabling the Suricata service. With Suricata installed and configured on your system, you can use it to detect and prevent network-based attacks.