本文简单的介绍centos7环境下的suricata源码安装步骤和注意事项。
源码下载
下载地址，这里。
生成configure
源码中是没有configure文件的，需要运行autogen.sh生成configure文件。
执行configure
可以直接执行./configure这个时候一些日志和配置等路径使用默认路径，如果想要指定路径则使用如下类似命令：
./configure --sysconfdir=/etc --localstatedir=/var --enable-unittests
可以看到我们增加了一些路径的设置， --enable-unittests表示打开测试用例，这些会在安装完成之后详细解释。在这个过程中可能会提示安装依赖，suricata在centos中常见的依赖如下：
yum install wget libpcap-devel libnet-devel pcre-devel gcc-c++ automake autoconf libtool make libyaml-devel zlib-devel file-devel jansson-devel nss-devel
做好在执行configure之前提前进行安装，当然还有可能出现如下提示：
checking for cbindgen... no
Warning: cbindgen too old or not found, it is required to
generate header files.
To install: cargo install --force cbindgen
configure: error: cbindgen required
运行cargo install --force cbindgen即可。
make编译
做完依赖方面的检查之后，运行make命令，会得到如下的输出结果：
Suricata Configuration:
AF_PACKET support: yes
eBPF support: no
XDP support: no
PF_RING support: no
NFQueue support: no
NFLOG support: no
IPFW support: no
Netmap support: no
DAG enabled: no
Napatech enabled: no
WinDivert enabled: no
Unix socket enabled: yes
Detection enabled: yes
Libmagic support: yes
libnss support: yes
libnspr support: yes
libjansson support: yes
hiredis support: no
hiredis async with libevent: no
Prelude support: no
PCRE jit: yes
LUA support: no
libluajit: no
GeoIP2 support: no
Non-bundled htp: no
Old barnyard2 support: no
Hyperscan support: no
Libnet support: no
liblz4 support: yes
Rust support: yes
Rust strict mode: no
Rust compiler path: /usr/bin/rustc
Rust compiler version: rustc 1.40.0
Cargo path: /usr/bin/cargo
Cargo version: cargo 1.40.0
Cargo vendor: yes
Python support: yes
Python path: /usr/bin/python2.7
Python distutils yes
Python yaml yes
Install suricatactl: yes
Install suricatasc: yes
Install suricata-update: not bundled
Profiling enabled: no
Profiling locks enabled: no
Development settings:
Coccinelle / spatch: no
Unit tests enabled: yes
Debug output enabled: no
Debug validation enabled: no
Generic build parameters:
Installation prefix: /usr/local
Configuration directory: /etc/suricata/
Log directory: /var/log/suricata/
--prefix /usr/local
--sysconfdir /etc
--localstatedir /var
--datarootdir /usr/local/share
Host: x86_64-unknown-linux-gnu
Compiler: gcc (exec name) / gcc (real)
GCC Protect enabled: no
GCC march native enabled: yes
GCC Profile enabled: no
Position Independent Executable enabled: no
CFLAGS -g -O2 -march=native -I${srcdir}/../rust/gen
PCAP_CFLAGS
SECCFLAGS
To build and install run 'make' and 'make install'.
You can run 'make install-conf' if you want to install initial configuration
files to /etc/suricata/. Running 'make install-full' will install configuration
and rules and provide you a ready-to-run suricata.
To install Suricata into /usr/bin/suricata, have the config in
/etc/suricata and use /var/log/suricata as log dir, use:
./configure --prefix=/usr/ --sysconfdir=/etc/ --localstatedir=/var/
上述的提示是非常的重要，需要仔细的阅读。例如如果你在安装的时候没有加入 --enable-unittest参数选项，则安装完成之后是没法运行测试用例的。即无法使用suricata -u 命令，make之后的显示Unit tests enabled: no。同时还可以看到Debug output enabled: no是no的状态，如果需要的话，需要使用指定的参数将debug输出开关打开。-vvvv表示debug模式，suricata日志有多个级别，如下：
-v: INFO
-vv: PERF
-vvv: CONFIG
-vvvv: DEBUG
如果不打开该选项，debug的输出是不全的。其他所有是no的选项，如果有使用得到，都需要在configure时候指定对应的参数或者安装对应的依赖。作为第一次安装，也不用太在意，因为suricata源码安装时间并不是很长，如果缺少某一项的功能，从头开始即可。
上述的输出还可以看到，在configure的时候指定的目录生效了，如下：
--prefix /usr/local
--sysconfdir /etc
--localstatedir /var
--datarootdir /usr/local/share
sysconfdir 是配置相关目录，例如suricata.yaml这个配置文件路径就是/etc/suricata/suricata.yaml。localstated是一些状态数据目录，例如输出的日志就在 /var/log/suricata/目录下，没有指定则使用默认目录。
安装suricata
在make命令的末尾有如下提示：
Running 'make install-full' will install configuration and rules and provide you a ready-to-run suricata.
查看makefile文件可以发现make install-full相当于如下三条命令
install-full:
$(MAKE) install
$(MAKE) install-conf
$(MAKE) install-rules
如果是初次安装，在编译到install-rules的时候会出现如下的提示。
error: rules not installed as suricata-update not available
如果你仔细查看makefile的make install-rules发现只有这些提示性的输出。原因在于suricata V5.0.2引擎程序和规则是分开来安装的，因此需要单独安装suricata-update程序进行规则的安装。由于该程序是python写的，因此linux环境最好支持python同时安装pip工具，具体安装该程序的步骤见这里。安装完suricata-update，直接运行该程序，则会到指定的网站下载rules，下载到/var/lib/suricata中，如下：
[root@localhost bin]# suricata-update
23/2/2020 -- 17:46:27 - <Info> -- Using data-directory /var/lib/suricata.
23/2/2020 -- 17:46:27 - <Info> -- Using Suricata configuration /etc/suricata/suricata.yaml
23/2/2020 -- 17:46:27 - <Info> -- Using /usr/local/share/suricata/rules for Suricata provided rules.
23/2/2020 -- 17:46:27 - <Info> -- Found Suricata version 6.0.0-dev at /usr/local/bin/suricata.
23/2/2020 -- 17:46:27 - <Info> -- Loading /etc/suricata/suricata.yaml
23/2/2020 -- 17:46:27 - <Warning> -- Failed to parse: default-log-dir = /var、/log/suricata/
23/2/2020 -- 17:46:27 - <Info> -- Disabling rules with proto modbus
23/2/2020 -- 17:46:27 - <Info> -- Disabling rules with proto enip
23/2/2020 -- 17:46:27 - <Info> -- Disabling rules with proto dnp3
23/2/2020 -- 17:46:27 - <Info> -- No sources configured, will use Emerging Threats Open
23/2/2020 -- 17:46:27 - <Info> -- Fetching https://rules.emergingthreats.net/open/suricata-6.0.0/emerging.rules.tar.gz.
100% - 2553598/2553598
23/2/2020 -- 17:50:55 - <Info> -- Done.
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/app-layer-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/decoder-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/dhcp-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/dnp3-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/dns-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/files.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/http-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/ipsec-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/kerberos-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/modbus-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/nfs-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/ntp-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/smb-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/smtp-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/stream-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/tls-events.rules
23/2/2020 -- 17:50:56 - <Info> -- Ignoring file rules/emerging-deleted.rules
23/2/2020 -- 17:51:26 - <Info> -- Loaded 26419 rules.
23/2/2020 -- 17:51:27 - <Info> -- Disabled 14 rules.
23/2/2020 -- 17:51:27 - <Info> -- Enabled 0 rules.
23/2/2020 -- 17:51:27 - <Info> -- Modified 0 rules.
23/2/2020 -- 17:51:27 - <Info> -- Dropped 0 rules.
23/2/2020 -- 17:51:28 - <Info> -- Enabled 69 rules for flowbit dependencies.
23/2/2020 -- 17:51:28 - <Info> -- Creating directory /var/lib/suricata/rules.
23/2/2020 -- 17:51:28 - <Info> -- Backing up current rules.
23/2/2020 -- 17:51:28 - <Info> -- Writing rules to /var/lib/suricata/rules/suricata.rules: total: 26419; enabled: 21145; added: 26419; removed 0; modified: 0
23/2/2020 -- 17:51:30 - <Info> -- Testing with suricata -T.
23/2/2020 -- 17:51:56 - <Info> -- Done.
在安装完suricata之后需要到安装的目录/etc/suricata中将配置文件suricata.yaml中对应的字段修改如下：
default-rule-path: /var/lib/suricata/rules
rule-files:
- suricata.rules
即告诉suricata引擎，运行的时候，从该目录加载规则。
此时就可以运行suricata了，运行示例如下：
suricata -c /etc/suricata/suricata.yaml -i ens33 --init-errors-fatal
是一条在线运行的示例，当然也可以通过-r参数离线的读取报文。至于各个参数的含义，通过suricata -h查看
本文为CSDN村中少年原创文章，未经允许不得转载，博主链接这里。