]>
Commit | Line | Data |
---|---|---|
1 | %YAML 1.1 | |
2 | --- | |
3 | ||
4 | ## | |
5 | ## IPFire specific configuration file - an untouched example configuration | |
6 | ## can be found in suricata-example.yaml. | |
7 | ## | |
8 | ||
9 | vars: | |
10 | address-groups: | |
11 | # Include HOME_NET declaration from external file. | |
12 | include: /var/ipfire/suricata/suricata-homenet.yaml | |
13 | ||
14 | EXTERNAL_NET: "!$HOME_NET" | |
15 | #EXTERNAL_NET: "any" | |
16 | ||
17 | HTTP_SERVERS: "$HOME_NET" | |
18 | SMTP_SERVERS: "$HOME_NET" | |
19 | SQL_SERVERS: "$HOME_NET" | |
20 | DNS_SERVERS: "$HOME_NET" | |
21 | TELNET_SERVERS: "$HOME_NET" | |
22 | AIM_SERVERS: "$EXTERNAL_NET" | |
23 | DNP3_SERVER: "$HOME_NET" | |
24 | DNP3_CLIENT: "$HOME_NET" | |
25 | MODBUS_CLIENT: "$HOME_NET" | |
26 | MODBUS_SERVER: "$HOME_NET" | |
27 | ENIP_CLIENT: "$HOME_NET" | |
28 | ENIP_SERVER: "$HOME_NET" | |
29 | ||
30 | port-groups: | |
31 | HTTP_PORTS: "80" | |
32 | SHELLCODE_PORTS: "!80" | |
33 | ORACLE_PORTS: 1521 | |
34 | SSH_PORTS: 22 | |
35 | DNP3_PORTS: 20000 | |
36 | MODBUS_PORTS: 502 | |
37 | FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]" | |
38 | FTP_PORTS: 21 | |
39 | ||
40 | ## | |
41 | ## Ruleset specific options. | |
42 | ## | |
43 | default-rule-path: /var/lib/suricata | |
44 | rule-files: | |
45 | # Include enabled ruleset files from external file. | |
46 | include: /var/ipfire/suricata/suricata-used-rulefiles.yaml | |
47 | ||
48 | classification-file: /var/lib/suricata/classification.config | |
49 | reference-config-file: /var/lib/suricata/reference.config | |
50 | threshold-file: /var/lib/suricata/threshold.config | |
51 | ||
52 | ||
53 | ## | |
54 | ## Logging options. | |
55 | ## | |
56 | default-log-dir: /var/log/suricata/ | |
57 | ||
58 | # global stats configuration | |
59 | stats: | |
60 | enabled: yes | |
61 | # The interval field (in seconds) controls at what interval | |
62 | # the loggers are invoked. | |
63 | interval: 8 | |
64 | ||
65 | # Configure the type of alert (and other) logging you would like. | |
66 | outputs: | |
67 | # a line based alerts log similar to Snort's fast.log | |
68 | - fast: | |
69 | enabled: yes | |
70 | filename: fast.log | |
71 | append: yes | |
72 | #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' | |
73 | ||
74 | # Stats.log contains data from various counters of the suricata engine. | |
75 | - stats: | |
76 | enabled: yes | |
77 | filename: stats.log | |
78 | append: no # append to file (yes) or overwrite it (no) | |
79 | totals: yes # stats for all threads merged together | |
80 | threads: no # per thread stats | |
81 | #null-values: yes # print counters that have value 0 | |
82 | ||
83 | logging: | |
84 | # The default log level, can be overridden in an output section. | |
85 | # Note that debug level logging will only be emitted if Suricata was | |
86 | # compiled with the --enable-debug configure option. | |
87 | # | |
88 | # This value is overriden by the SC_LOG_LEVEL env var. | |
89 | default-log-level: notice | |
90 | ||
91 | # A regex to filter output. Can be overridden in an output section. | |
92 | # Defaults to empty (no filter). | |
93 | # | |
94 | # This value is overriden by the SC_LOG_OP_FILTER env var. | |
95 | default-output-filter: | |
96 | ||
97 | # Define your logging outputs. If none are defined, or they are all | |
98 | # disabled you will get the default - console output. | |
99 | outputs: | |
100 | - console: | |
101 | enabled: no | |
102 | # type: json | |
103 | - file: | |
104 | enabled: no | |
105 | level: info | |
106 | filename: /var/log/suricata/suricata.log | |
107 | # type: json | |
108 | - syslog: | |
109 | enabled: yes | |
110 | facility: local5 | |
111 | format: "[%i] <%d> -- " | |
112 | # type: json | |
113 | ||
114 | ## | |
115 | ## Netfilter configuration | |
116 | ## | |
117 | ||
118 | nfq: | |
119 | mode: repeat | |
120 | repeat-mark: 1 | |
121 | repeat-mask: 1 | |
122 | bypass-mark: 1 | |
123 | bypass-mask: 1 | |
124 | # route-queue: 2 | |
125 | # batchcount: 20 | |
126 | fail-open: yes | |
127 | ||
128 | ## | |
129 | ## Step 5: App Layer Protocol Configuration | |
130 | ## | |
131 | ||
132 | # Configure the app-layer parsers. The protocols section details each | |
133 | # protocol. | |
134 | # | |
135 | # The option "enabled" takes 3 values - "yes", "no", "detection-only". | |
136 | # "yes" enables both detection and the parser, "no" disables both, and | |
137 | # "detection-only" enables protocol detection only (parser disabled). | |
138 | app-layer: | |
139 | protocols: | |
140 | tls: | |
141 | enabled: yes | |
142 | detection-ports: | |
143 | dp: 443 | |
144 | ||
145 | # Completely stop processing TLS/SSL session after the handshake | |
146 | # completed. If bypass is enabled this will also trigger flow | |
147 | # bypass. If disabled (the default), TLS/SSL session is still | |
148 | # tracked for Heartbleed and other anomalies. | |
149 | #no-reassemble: yes | |
150 | dcerpc: | |
151 | enabled: yes | |
152 | ftp: | |
153 | enabled: yes | |
154 | ssh: | |
155 | enabled: yes | |
156 | smtp: | |
157 | enabled: yes | |
158 | # Configure SMTP-MIME Decoder | |
159 | mime: | |
160 | # Decode MIME messages from SMTP transactions | |
161 | # (may be resource intensive) | |
162 | # This field supercedes all others because it turns the entire | |
163 | # process on or off | |
164 | decode-mime: yes | |
165 | ||
166 | # Decode MIME entity bodies (ie. base64, quoted-printable, etc.) | |
167 | decode-base64: yes | |
168 | decode-quoted-printable: yes | |
169 | ||
170 | # Maximum bytes per header data value stored in the data structure | |
171 | # (default is 2000) | |
172 | header-value-depth: 2000 | |
173 | ||
174 | # Extract URLs and save in state data structure | |
175 | extract-urls: yes | |
176 | # Set to yes to compute the md5 of the mail body. You will then | |
177 | # be able to journalize it. | |
178 | body-md5: no | |
179 | # Configure inspected-tracker for file_data keyword | |
180 | inspected-tracker: | |
181 | content-limit: 100000 | |
182 | content-inspect-min-size: 32768 | |
183 | content-inspect-window: 4096 | |
184 | imap: | |
185 | enabled: detection-only | |
186 | msn: | |
187 | enabled: detection-only | |
188 | smb: | |
189 | enabled: yes | |
190 | detection-ports: | |
191 | dp: 139, 445 | |
192 | # smb2 detection is disabled internally inside the engine. | |
193 | #smb2: | |
194 | # enabled: yes | |
195 | # Note: NFS parser depends on Rust support: pass --enable-rust | |
196 | # to configure. | |
197 | nfs: | |
198 | enabled: no | |
199 | dns: | |
200 | # memcaps. Globally and per flow/state. | |
201 | #global-memcap: 16mb | |
202 | #state-memcap: 512kb | |
203 | ||
204 | # How many unreplied DNS requests are considered a flood. | |
205 | # If the limit is reached, app-layer-event:dns.flooded; will match. | |
206 | #request-flood: 500 | |
207 | ||
208 | tcp: | |
209 | enabled: yes | |
210 | detection-ports: | |
211 | dp: 53 | |
212 | udp: | |
213 | enabled: yes | |
214 | detection-ports: | |
215 | dp: 53 | |
216 | http: | |
217 | enabled: yes | |
218 | # memcap: 64mb | |
219 | ||
220 | # default-config: Used when no server-config matches | |
221 | # personality: List of personalities used by default | |
222 | # request-body-limit: Limit reassembly of request body for inspection | |
223 | # by http_client_body & pcre /P option. | |
224 | # response-body-limit: Limit reassembly of response body for inspection | |
225 | # by file_data, http_server_body & pcre /Q option. | |
226 | # double-decode-path: Double decode path section of the URI | |
227 | # double-decode-query: Double decode query section of the URI | |
228 | # response-body-decompress-layer-limit: | |
229 | # Limit to how many layers of compression will be | |
230 | # decompressed. Defaults to 2. | |
231 | # | |
232 | # server-config: List of server configurations to use if address matches | |
233 | # address: List of ip addresses or networks for this block | |
234 | # personalitiy: List of personalities used by this block | |
235 | # request-body-limit: Limit reassembly of request body for inspection | |
236 | # by http_client_body & pcre /P option. | |
237 | # response-body-limit: Limit reassembly of response body for inspection | |
238 | # by file_data, http_server_body & pcre /Q option. | |
239 | # double-decode-path: Double decode path section of the URI | |
240 | # double-decode-query: Double decode query section of the URI | |
241 | # | |
242 | # uri-include-all: Include all parts of the URI. By default the | |
243 | # 'scheme', username/password, hostname and port | |
244 | # are excluded. Setting this option to true adds | |
245 | # all of them to the normalized uri as inspected | |
246 | # by http_uri, urilen, pcre with /U and the other | |
247 | # keywords that inspect the normalized uri. | |
248 | # Note that this does not affect http_raw_uri. | |
249 | # Also, note that including all was the default in | |
250 | # 1.4 and 2.0beta1. | |
251 | # | |
252 | # meta-field-limit: Hard size limit for request and response size | |
253 | # limits. Applies to request line and headers, | |
254 | # response line and headers. Does not apply to | |
255 | # request or response bodies. Default is 18k. | |
256 | # If this limit is reached an event is raised. | |
257 | # | |
258 | # Currently Available Personalities: | |
259 | # Minimal, Generic, IDS (default), IIS_4_0, IIS_5_0, IIS_5_1, IIS_6_0, | |
260 | # IIS_7_0, IIS_7_5, Apache_2 | |
261 | libhtp: | |
262 | default-config: | |
263 | personality: IDS | |
264 | ||
265 | # Can be specified in kb, mb, gb. Just a number indicates | |
266 | # it's in bytes. | |
267 | request-body-limit: 100kb | |
268 | response-body-limit: 100kb | |
269 | ||
270 | # inspection limits | |
271 | request-body-minimal-inspect-size: 32kb | |
272 | request-body-inspect-window: 4kb | |
273 | response-body-minimal-inspect-size: 40kb | |
274 | response-body-inspect-window: 16kb | |
275 | ||
276 | # response body decompression (0 disables) | |
277 | response-body-decompress-layer-limit: 2 | |
278 | ||
279 | # auto will use http-body-inline mode in IPS mode, yes or no set it statically | |
280 | http-body-inline: auto | |
281 | ||
282 | # Take a random value for inspection sizes around the specified value. | |
283 | # This lower the risk of some evasion technics but could lead | |
284 | # detection change between runs. It is set to 'yes' by default. | |
285 | #randomize-inspection-sizes: yes | |
286 | # If randomize-inspection-sizes is active, the value of various | |
287 | # inspection size will be choosen in the [1 - range%, 1 + range%] | |
288 | # range | |
289 | # Default value of randomize-inspection-range is 10. | |
290 | #randomize-inspection-range: 10 | |
291 | ||
292 | # decoding | |
293 | double-decode-path: no | |
294 | double-decode-query: no | |
295 | ||
296 | server-config: | |
297 | ||
298 | #- apache: | |
299 | # address: [192.168.1.0/24, 127.0.0.0/8, "::1"] | |
300 | # personality: Apache_2 | |
301 | # # Can be specified in kb, mb, gb. Just a number indicates | |
302 | # # it's in bytes. | |
303 | # request-body-limit: 4096 | |
304 | # response-body-limit: 4096 | |
305 | # double-decode-path: no | |
306 | # double-decode-query: no | |
307 | ||
308 | #- iis7: | |
309 | # address: | |
310 | # - 192.168.0.0/24 | |
311 | # - 192.168.10.0/24 | |
312 | # personality: IIS_7_0 | |
313 | # # Can be specified in kb, mb, gb. Just a number indicates | |
314 | # # it's in bytes. | |
315 | # request-body-limit: 4096 | |
316 | # response-body-limit: 4096 | |
317 | # double-decode-path: no | |
318 | # double-decode-query: no | |
319 | ||
320 | # Note: Modbus probe parser is minimalist due to the poor significant field | |
321 | # Only Modbus message length (greater than Modbus header length) | |
322 | # And Protocol ID (equal to 0) are checked in probing parser | |
323 | # It is important to enable detection port and define Modbus port | |
324 | # to avoid false positive | |
325 | modbus: | |
326 | # How many unreplied Modbus requests are considered a flood. | |
327 | # If the limit is reached, app-layer-event:modbus.flooded; will match. | |
328 | #request-flood: 500 | |
329 | ||
330 | enabled: no | |
331 | detection-ports: | |
332 | dp: 502 | |
333 | # According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it | |
334 | # is recommended to keep the TCP connection opened with a remote device | |
335 | # and not to open and close it for each MODBUS/TCP transaction. In that | |
336 | # case, it is important to set the depth of the stream reassembling as | |
337 | # unlimited (stream.reassembly.depth: 0) | |
338 | ||
339 | # Stream reassembly size for modbus. By default track it completely. | |
340 | stream-depth: 0 | |
341 | ||
342 | # DNP3 | |
343 | dnp3: | |
344 | enabled: no | |
345 | detection-ports: | |
346 | dp: 20000 | |
347 | ||
348 | # SCADA EtherNet/IP and CIP protocol support | |
349 | enip: | |
350 | enabled: no | |
351 | detection-ports: | |
352 | dp: 44818 | |
353 | sp: 44818 | |
354 | ||
355 | # Note: parser depends on experimental Rust support | |
356 | # with --enable-rust-experimental passed to configure | |
357 | ntp: | |
358 | enabled: no | |
359 | ||
360 | # Limit for the maximum number of asn1 frames to decode (default 256) | |
361 | asn1-max-frames: 256 | |
362 | ||
363 | ||
364 | ############################################################################## | |
365 | ## | |
366 | ## Advanced settings below | |
367 | ## | |
368 | ############################################################################## | |
369 | ||
370 | ## | |
371 | ## Run Options | |
372 | ## | |
373 | ||
374 | # Run suricata as user and group. | |
375 | #run-as: | |
376 | # user: suri | |
377 | # group: suri | |
378 | ||
379 | # Some logging module will use that name in event as identifier. The default | |
380 | # value is the hostname | |
381 | #sensor-name: suricata | |
382 | ||
383 | # Default location of the pid file. The pid file is only used in | |
384 | # daemon mode (start Suricata with -D). If not running in daemon mode | |
385 | # the --pidfile command line option must be used to create a pid file. | |
386 | #pid-file: /var/run/suricata.pid | |
387 | ||
388 | # Daemon working directory | |
389 | # Suricata will change directory to this one if provided | |
390 | # Default: "/" | |
391 | #daemon-directory: "/" | |
392 | ||
393 | # Suricata core dump configuration. Limits the size of the core dump file to | |
394 | # approximately max-dump. The actual core dump size will be a multiple of the | |
395 | # page size. Core dumps that would be larger than max-dump are truncated. On | |
396 | # Linux, the actual core dump size may be a few pages larger than max-dump. | |
397 | # Setting max-dump to 0 disables core dumping. | |
398 | # Setting max-dump to 'unlimited' will give the full core dump file. | |
399 | # On 32-bit Linux, a max-dump value >= ULONG_MAX may cause the core dump size | |
400 | # to be 'unlimited'. | |
401 | ||
402 | coredump: | |
403 | max-dump: unlimited | |
404 | ||
405 | # If suricata box is a router for the sniffed networks, set it to 'router'. If | |
406 | # it is a pure sniffing setup, set it to 'sniffer-only'. | |
407 | # If set to auto, the variable is internally switch to 'router' in IPS mode | |
408 | # and 'sniffer-only' in IDS mode. | |
409 | # This feature is currently only used by the reject* keywords. | |
410 | host-mode: auto | |
411 | ||
412 | # Number of packets preallocated per thread. The default is 1024. A higher number | |
413 | # will make sure each CPU will be more easily kept busy, but may negatively | |
414 | # impact caching. | |
415 | # | |
416 | # If you are using the CUDA pattern matcher (mpm-algo: ac-cuda), different rules | |
417 | # apply. In that case try something like 60000 or more. This is because the CUDA | |
418 | # pattern matcher buffers and scans as many packets as possible in parallel. | |
419 | #max-pending-packets: 1024 | |
420 | ||
421 | # Runmode the engine should use. Please check --list-runmodes to get the available | |
422 | # runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned | |
423 | # load balancing). | |
424 | #runmode: autofp | |
425 | ||
426 | # Specifies the kind of flow load balancer used by the flow pinned autofp mode. | |
427 | # | |
428 | # Supported schedulers are: | |
429 | # | |
430 | # round-robin - Flows assigned to threads in a round robin fashion. | |
431 | # active-packets - Flows assigned to threads that have the lowest number of | |
432 | # unprocessed packets (default). | |
433 | # hash - Flow alloted usihng the address hash. More of a random | |
434 | # technique. Was the default in Suricata 1.2.1 and older. | |
435 | # | |
436 | #autofp-scheduler: active-packets | |
437 | ||
438 | # Preallocated size for packet. Default is 1514 which is the classical | |
439 | # size for pcap on ethernet. You should adjust this value to the highest | |
440 | # packet size (MTU + hardware header) on your system. | |
441 | #default-packet-size: 1514 | |
442 | ||
443 | # Unix command socket can be used to pass commands to suricata. | |
444 | # An external tool can then connect to get information from suricata | |
445 | # or trigger some modifications of the engine. Set enabled to yes | |
446 | # to activate the feature. In auto mode, the feature will only be | |
447 | # activated in live capture mode. You can use the filename variable to set | |
448 | # the file name of the socket. | |
449 | unix-command: | |
450 | enabled: no | |
451 | #filename: custom.socket | |
452 | ||
453 | # Magic file. The extension .mgc is added to the value here. | |
454 | #magic-file: /usr/share/file/magic | |
455 | #magic-file: | |
456 | ||
457 | legacy: | |
458 | uricontent: enabled | |
459 | ||
460 | ## | |
461 | ## Detection settings | |
462 | ## | |
463 | ||
464 | # Set the order of alerts bassed on actions | |
465 | # The default order is pass, drop, reject, alert | |
466 | # action-order: | |
467 | # - pass | |
468 | # - drop | |
469 | # - reject | |
470 | # - alert | |
471 | ||
472 | # IP Reputation | |
473 | #reputation-categories-file: /etc/suricata/iprep/categories.txt | |
474 | #default-reputation-path: /etc/suricata/iprep | |
475 | #reputation-files: | |
476 | # - reputation.list | |
477 | ||
478 | # When run with the option --engine-analysis, the engine will read each of | |
479 | # the parameters below, and print reports for each of the enabled sections | |
480 | # and exit. The reports are printed to a file in the default log dir | |
481 | # given by the parameter "default-log-dir", with engine reporting | |
482 | # subsection below printing reports in its own report file. | |
483 | engine-analysis: | |
484 | # enables printing reports for fast-pattern for every rule. | |
485 | rules-fast-pattern: yes | |
486 | # enables printing reports for each rule | |
487 | rules: yes | |
488 | ||
489 | #recursion and match limits for PCRE where supported | |
490 | pcre: | |
491 | match-limit: 3500 | |
492 | match-limit-recursion: 1500 | |
493 | ||
494 | ## | |
495 | ## Advanced Traffic Tracking and Reconstruction Settings | |
496 | ## | |
497 | ||
498 | # Host specific policies for defragmentation and TCP stream | |
499 | # reassembly. The host OS lookup is done using a radix tree, just | |
500 | # like a routing table so the most specific entry matches. | |
501 | host-os-policy: | |
502 | # Make the default policy windows. | |
503 | windows: [0.0.0.0/0] | |
504 | bsd: [] | |
505 | bsd-right: [] | |
506 | old-linux: [] | |
507 | linux: [] | |
508 | old-solaris: [] | |
509 | solaris: [] | |
510 | hpux10: [] | |
511 | hpux11: [] | |
512 | irix: [] | |
513 | macos: [] | |
514 | vista: [] | |
515 | windows2k3: [] | |
516 | ||
517 | # Defrag settings: | |
518 | ||
519 | defrag: | |
520 | memcap: 32mb | |
521 | hash-size: 65536 | |
522 | trackers: 65535 # number of defragmented flows to follow | |
523 | max-frags: 65535 # number of fragments to keep (higher than trackers) | |
524 | prealloc: yes | |
525 | timeout: 60 | |
526 | ||
527 | # Enable defrag per host settings | |
528 | # host-config: | |
529 | # | |
530 | # - dmz: | |
531 | # timeout: 30 | |
532 | # address: [192.168.1.0/24, 127.0.0.0/8, 1.1.1.0/24, 2.2.2.0/24, "1.1.1.1", "2.2.2.2", "::1"] | |
533 | # | |
534 | # - lan: | |
535 | # timeout: 45 | |
536 | # address: | |
537 | # - 192.168.0.0/24 | |
538 | # - 192.168.10.0/24 | |
539 | # - 172.16.14.0/24 | |
540 | ||
541 | # Flow settings: | |
542 | # By default, the reserved memory (memcap) for flows is 32MB. This is the limit | |
543 | # for flow allocation inside the engine. You can change this value to allow | |
544 | # more memory usage for flows. | |
545 | # The hash-size determine the size of the hash used to identify flows inside | |
546 | # the engine, and by default the value is 65536. | |
547 | # At the startup, the engine can preallocate a number of flows, to get a better | |
548 | # performance. The number of flows preallocated is 10000 by default. | |
549 | # emergency-recovery is the percentage of flows that the engine need to | |
550 | # prune before unsetting the emergency state. The emergency state is activated | |
551 | # when the memcap limit is reached, allowing to create new flows, but | |
552 | # prunning them with the emergency timeouts (they are defined below). | |
553 | # If the memcap is reached, the engine will try to prune flows | |
554 | # with the default timeouts. If it doens't find a flow to prune, it will set | |
555 | # the emergency bit and it will try again with more agressive timeouts. | |
556 | # If that doesn't work, then it will try to kill the last time seen flows | |
557 | # not in use. | |
558 | # The memcap can be specified in kb, mb, gb. Just a number indicates it's | |
559 | # in bytes. | |
560 | ||
561 | flow: | |
562 | memcap: 128mb | |
563 | hash-size: 65536 | |
564 | prealloc: 10000 | |
565 | emergency-recovery: 30 | |
566 | #managers: 1 # default to one flow manager | |
567 | #recyclers: 1 # default to one flow recycler thread | |
568 | ||
569 | # This option controls the use of vlan ids in the flow (and defrag) | |
570 | # hashing. Normally this should be enabled, but in some (broken) | |
571 | # setups where both sides of a flow are not tagged with the same vlan | |
572 | # tag, we can ignore the vlan id's in the flow hashing. | |
573 | vlan: | |
574 | use-for-tracking: true | |
575 | ||
576 | # Specific timeouts for flows. Here you can specify the timeouts that the | |
577 | # active flows will wait to transit from the current state to another, on each | |
578 | # protocol. The value of "new" determine the seconds to wait after a hanshake or | |
579 | # stream startup before the engine free the data of that flow it doesn't | |
580 | # change the state to established (usually if we don't receive more packets | |
581 | # of that flow). The value of "established" is the amount of | |
582 | # seconds that the engine will wait to free the flow if it spend that amount | |
583 | # without receiving new packets or closing the connection. "closed" is the | |
584 | # amount of time to wait after a flow is closed (usually zero). "bypassed" | |
585 | # timeout controls locally bypassed flows. For these flows we don't do any other | |
586 | # tracking. If no packets have been seen after this timeout, the flow is discarded. | |
587 | # | |
588 | # There's an emergency mode that will become active under attack circumstances, | |
589 | # making the engine to check flow status faster. This configuration variables | |
590 | # use the prefix "emergency-" and work similar as the normal ones. | |
591 | # Some timeouts doesn't apply to all the protocols, like "closed", for udp and | |
592 | # icmp. | |
593 | ||
594 | flow-timeouts: | |
595 | ||
596 | default: | |
597 | new: 30 | |
598 | established: 300 | |
599 | closed: 0 | |
600 | bypassed: 100 | |
601 | emergency-new: 10 | |
602 | emergency-established: 100 | |
603 | emergency-closed: 0 | |
604 | emergency-bypassed: 50 | |
605 | tcp: | |
606 | new: 60 | |
607 | established: 600 | |
608 | closed: 60 | |
609 | bypassed: 100 | |
610 | emergency-new: 5 | |
611 | emergency-established: 100 | |
612 | emergency-closed: 10 | |
613 | emergency-bypassed: 50 | |
614 | udp: | |
615 | new: 30 | |
616 | established: 300 | |
617 | bypassed: 100 | |
618 | emergency-new: 10 | |
619 | emergency-established: 100 | |
620 | emergency-bypassed: 50 | |
621 | icmp: | |
622 | new: 30 | |
623 | established: 300 | |
624 | bypassed: 100 | |
625 | emergency-new: 10 | |
626 | emergency-established: 100 | |
627 | emergency-bypassed: 50 | |
628 | ||
629 | # Stream engine settings. Here the TCP stream tracking and reassembly | |
630 | # engine is configured. | |
631 | # | |
632 | # stream: | |
633 | # memcap: 32mb # Can be specified in kb, mb, gb. Just a | |
634 | # # number indicates it's in bytes. | |
635 | # checksum-validation: yes # To validate the checksum of received | |
636 | # # packet. If csum validation is specified as | |
637 | # # "yes", then packet with invalid csum will not | |
638 | # # be processed by the engine stream/app layer. | |
639 | # # Warning: locally generated trafic can be | |
640 | # # generated without checksum due to hardware offload | |
641 | # # of checksum. You can control the handling of checksum | |
642 | # # on a per-interface basis via the 'checksum-checks' | |
643 | # # option | |
644 | # prealloc-sessions: 2k # 2k sessions prealloc'd per stream thread | |
645 | # midstream: false # don't allow midstream session pickups | |
646 | # async-oneside: false # don't enable async stream handling | |
647 | # inline: no # stream inline mode | |
648 | # drop-invalid: yes # in inline mode, drop packets that are invalid with regards to streaming engine | |
649 | # max-synack-queued: 5 # Max different SYN/ACKs to queue | |
650 | # bypass: no # Bypass packets when stream.depth is reached | |
651 | # | |
652 | # reassembly: | |
653 | # memcap: 64mb # Can be specified in kb, mb, gb. Just a number | |
654 | # # indicates it's in bytes. | |
655 | # depth: 1mb # Can be specified in kb, mb, gb. Just a number | |
656 | # # indicates it's in bytes. | |
657 | # toserver-chunk-size: 2560 # inspect raw stream in chunks of at least | |
658 | # # this size. Can be specified in kb, mb, | |
659 | # # gb. Just a number indicates it's in bytes. | |
660 | # toclient-chunk-size: 2560 # inspect raw stream in chunks of at least | |
661 | # # this size. Can be specified in kb, mb, | |
662 | # # gb. Just a number indicates it's in bytes. | |
663 | # randomize-chunk-size: yes # Take a random value for chunk size around the specified value. | |
664 | # # This lower the risk of some evasion technics but could lead | |
665 | # # detection change between runs. It is set to 'yes' by default. | |
666 | # randomize-chunk-range: 10 # If randomize-chunk-size is active, the value of chunk-size is | |
667 | # # a random value between (1 - randomize-chunk-range/100)*toserver-chunk-size | |
668 | # # and (1 + randomize-chunk-range/100)*toserver-chunk-size and the same | |
669 | # # calculation for toclient-chunk-size. | |
670 | # # Default value of randomize-chunk-range is 10. | |
671 | # | |
672 | # raw: yes # 'Raw' reassembly enabled or disabled. | |
673 | # # raw is for content inspection by detection | |
674 | # # engine. | |
675 | # | |
676 | # segment-prealloc: 2048 # number of segments preallocated per thread | |
677 | # | |
678 | # check-overlap-different-data: true|false | |
679 | # # check if a segment contains different data | |
680 | # # than what we've already seen for that | |
681 | # # position in the stream. | |
682 | # # This is enabled automatically if inline mode | |
683 | # # is used or when stream-event:reassembly_overlap_different_data; | |
684 | # # is used in a rule. | |
685 | # | |
686 | stream: | |
687 | memcap: 64mb | |
688 | checksum-validation: yes # reject wrong csums | |
689 | inline: auto # auto will use inline mode in IPS mode, yes or no set it statically | |
690 | reassembly: | |
691 | memcap: 256mb | |
692 | depth: 1mb # reassemble 1mb into a stream | |
693 | toserver-chunk-size: 2560 | |
694 | toclient-chunk-size: 2560 | |
695 | randomize-chunk-size: yes | |
696 | #randomize-chunk-range: 10 | |
697 | #raw: yes | |
698 | #segment-prealloc: 2048 | |
699 | #check-overlap-different-data: true | |
700 | ||
701 | # Host table: | |
702 | # | |
703 | # Host table is used by tagging and per host thresholding subsystems. | |
704 | # | |
705 | host: | |
706 | hash-size: 4096 | |
707 | prealloc: 1000 | |
708 | memcap: 32mb | |
709 | ||
710 | # IP Pair table: | |
711 | # | |
712 | # Used by xbits 'ippair' tracking. | |
713 | # | |
714 | #ippair: | |
715 | # hash-size: 4096 | |
716 | # prealloc: 1000 | |
717 | # memcap: 32mb | |
718 | ||
719 | # Decoder settings | |
720 | ||
721 | decoder: | |
722 | # Teredo decoder is known to not be completely accurate | |
723 | # it will sometimes detect non-teredo as teredo. | |
724 | teredo: | |
725 | enabled: true | |
726 | ||
727 | ||
728 | ## | |
729 | ## Performance tuning and profiling | |
730 | ## | |
731 | ||
732 | # The detection engine builds internal groups of signatures. The engine | |
733 | # allow us to specify the profile to use for them, to manage memory on an | |
734 | # efficient way keeping a good performance. For the profile keyword you | |
735 | # can use the words "low", "medium", "high" or "custom". If you use custom | |
736 | # make sure to define the values at "- custom-values" as your convenience. | |
737 | # Usually you would prefer medium/high/low. | |
738 | # | |
739 | # "sgh mpm-context", indicates how the staging should allot mpm contexts for | |
740 | # the signature groups. "single" indicates the use of a single context for | |
741 | # all the signature group heads. "full" indicates a mpm-context for each | |
742 | # group head. "auto" lets the engine decide the distribution of contexts | |
743 | # based on the information the engine gathers on the patterns from each | |
744 | # group head. | |
745 | # | |
746 | # The option inspection-recursion-limit is used to limit the recursive calls | |
747 | # in the content inspection code. For certain payload-sig combinations, we | |
748 | # might end up taking too much time in the content inspection code. | |
749 | # If the argument specified is 0, the engine uses an internally defined | |
750 | # default limit. On not specifying a value, we use no limits on the recursion. | |
751 | detect: | |
752 | profile: medium | |
753 | custom-values: | |
754 | toclient-groups: 3 | |
755 | toserver-groups: 25 | |
756 | sgh-mpm-context: auto | |
757 | inspection-recursion-limit: 3000 | |
758 | # If set to yes, the loading of signatures will be made after the capture | |
759 | # is started. This will limit the downtime in IPS mode. | |
760 | #delayed-detect: yes | |
761 | ||
762 | prefilter: | |
763 | # default prefiltering setting. "mpm" only creates MPM/fast_pattern | |
764 | # engines. "auto" also sets up prefilter engines for other keywords. | |
765 | # Use --list-keywords=all to see which keywords support prefiltering. | |
766 | default: mpm | |
767 | ||
768 | # the grouping values above control how many groups are created per | |
769 | # direction. Port whitelisting forces that port to get it's own group. | |
770 | # Very common ports will benefit, as well as ports with many expensive | |
771 | # rules. | |
772 | grouping: | |
773 | #tcp-whitelist: 53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080 | |
774 | #udp-whitelist: 53, 135, 5060 | |
775 | ||
776 | profiling: | |
777 | # Log the rules that made it past the prefilter stage, per packet | |
778 | # default is off. The threshold setting determines how many rules | |
779 | # must have made it past pre-filter for that rule to trigger the | |
780 | # logging. | |
781 | #inspect-logging-threshold: 200 | |
782 | grouping: | |
783 | dump-to-disk: false | |
784 | include-rules: false # very verbose | |
785 | include-mpm-stats: false | |
786 | ||
787 | # Select the multi pattern algorithm you want to run for scan/search the | |
788 | # in the engine. | |
789 | # | |
790 | # The supported algorithms are: | |
791 | # "ac" - Aho-Corasick, default implementation | |
792 | # "ac-bs" - Aho-Corasick, reduced memory implementation | |
793 | # "ac-cuda" - Aho-Corasick, CUDA implementation | |
794 | # "ac-ks" - Aho-Corasick, "Ken Steele" variant | |
795 | # "hs" - Hyperscan, available when built with Hyperscan support | |
796 | # | |
797 | # The default mpm-algo value of "auto" will use "hs" if Hyperscan is | |
798 | # available, "ac" otherwise. | |
799 | # | |
800 | # The mpm you choose also decides the distribution of mpm contexts for | |
801 | # signature groups, specified by the conf - "detect.sgh-mpm-context". | |
802 | # Selecting "ac" as the mpm would require "detect.sgh-mpm-context" | |
803 | # to be set to "single", because of ac's memory requirements, unless the | |
804 | # ruleset is small enough to fit in one's memory, in which case one can | |
805 | # use "full" with "ac". Rest of the mpms can be run in "full" mode. | |
806 | # | |
807 | # There is also a CUDA pattern matcher (only available if Suricata was | |
808 | # compiled with --enable-cuda: b2g_cuda. Make sure to update your | |
809 | # max-pending-packets setting above as well if you use b2g_cuda. | |
810 | ||
811 | mpm-algo: auto | |
812 | ||
813 | # Select the matching algorithm you want to use for single-pattern searches. | |
814 | # | |
815 | # Supported algorithms are "bm" (Boyer-Moore) and "hs" (Hyperscan, only | |
816 | # available if Suricata has been built with Hyperscan support). | |
817 | # | |
818 | # The default of "auto" will use "hs" if available, otherwise "bm". | |
819 | ||
820 | spm-algo: auto | |
821 | ||
822 | # Suricata is multi-threaded. Here the threading can be influenced. | |
823 | threading: | |
824 | set-cpu-affinity: no | |
825 | # Tune cpu affinity of threads. Each family of threads can be bound | |
826 | # on specific CPUs. | |
827 | # | |
828 | # These 2 apply to the all runmodes: | |
829 | # management-cpu-set is used for flow timeout handling, counters | |
830 | # worker-cpu-set is used for 'worker' threads | |
831 | # | |
832 | # Additionally, for autofp these apply: | |
833 | # receive-cpu-set is used for capture threads | |
834 | # verdict-cpu-set is used for IPS verdict threads | |
835 | # | |
836 | cpu-affinity: | |
837 | - management-cpu-set: | |
838 | cpu: [ 0 ] # include only these cpus in affinity settings | |
839 | - receive-cpu-set: | |
840 | cpu: [ 0 ] # include only these cpus in affinity settings | |
841 | - worker-cpu-set: | |
842 | cpu: [ "all" ] | |
843 | mode: "exclusive" | |
844 | # Use explicitely 3 threads and don't compute number by using | |
845 | # detect-thread-ratio variable: | |
846 | # threads: 3 | |
847 | prio: | |
848 | low: [ 0 ] | |
849 | medium: [ "1-2" ] | |
850 | high: [ 3 ] | |
851 | default: "medium" | |
852 | #- verdict-cpu-set: | |
853 | # cpu: [ 0 ] | |
854 | # prio: | |
855 | # default: "high" | |
856 | # | |
857 | # By default Suricata creates one "detect" thread per available CPU/CPU core. | |
858 | # This setting allows controlling this behaviour. A ratio setting of 2 will | |
859 | # create 2 detect threads for each CPU/CPU core. So for a dual core CPU this | |
860 | # will result in 4 detect threads. If values below 1 are used, less threads | |
861 | # are created. So on a dual core CPU a setting of 0.5 results in 1 detect | |
862 | # thread being created. Regardless of the setting at a minimum 1 detect | |
863 | # thread will always be created. | |
864 | # | |
865 | detect-thread-ratio: 1.0 | |
866 | ||
867 | # Profiling settings. Only effective if Suricata has been built with the | |
868 | # the --enable-profiling configure flag. | |
869 | # | |
870 | profiling: | |
871 | # Run profiling for every xth packet. The default is 1, which means we | |
872 | # profile every packet. If set to 1000, one packet is profiled for every | |
873 | # 1000 received. | |
874 | #sample-rate: 1000 | |
875 | ||
876 | # rule profiling | |
877 | rules: | |
878 | ||
879 | # Profiling can be disabled here, but it will still have a | |
880 | # performance impact if compiled in. | |
881 | enabled: yes | |
882 | filename: rule_perf.log | |
883 | append: yes | |
884 | ||
885 | # Sort options: ticks, avgticks, checks, matches, maxticks | |
886 | # If commented out all the sort options will be used. | |
887 | #sort: avgticks | |
888 | ||
889 | # Limit the number of sids for which stats are shown at exit (per sort). | |
890 | limit: 10 | |
891 | ||
892 | # output to json | |
893 | json: yes | |
894 | ||
895 | # per keyword profiling | |
896 | keywords: | |
897 | enabled: yes | |
898 | filename: keyword_perf.log | |
899 | append: yes | |
900 | ||
901 | # per rulegroup profiling | |
902 | rulegroups: | |
903 | enabled: yes | |
904 | filename: rule_group_perf.log | |
905 | append: yes | |
906 | ||
907 | # packet profiling | |
908 | packets: | |
909 | ||
910 | # Profiling can be disabled here, but it will still have a | |
911 | # performance impact if compiled in. | |
912 | enabled: yes | |
913 | filename: packet_stats.log | |
914 | append: yes | |
915 | ||
916 | # per packet csv output | |
917 | csv: | |
918 | ||
919 | # Output can be disabled here, but it will still have a | |
920 | # performance impact if compiled in. | |
921 | enabled: no | |
922 | filename: packet_stats.csv | |
923 | ||
924 | # profiling of locking. Only available when Suricata was built with | |
925 | # --enable-profiling-locks. | |
926 | locks: | |
927 | enabled: no | |
928 | filename: lock_stats.log | |
929 | append: yes | |
930 | ||
931 | pcap-log: | |
932 | enabled: no | |
933 | filename: pcaplog_stats.log | |
934 | append: yes | |
935 | ||
936 | ## | |
937 | ## Hardware accelaration | |
938 | ## | |
939 | ||
940 | # Cuda configuration. | |
941 | cuda: | |
942 | # The "mpm" profile. On not specifying any of these parameters, the engine's | |
943 | # internal default values are used, which are same as the ones specified in | |
944 | # in the default conf file. | |
945 | mpm: | |
946 | # The minimum length required to buffer data to the gpu. | |
947 | # Anything below this is MPM'ed on the CPU. | |
948 | # Can be specified in kb, mb, gb. Just a number indicates it's in bytes. | |
949 | # A value of 0 indicates there's no limit. | |
950 | data-buffer-size-min-limit: 0 | |
951 | # The maximum length for data that we would buffer to the gpu. | |
952 | # Anything over this is MPM'ed on the CPU. | |
953 | # Can be specified in kb, mb, gb. Just a number indicates it's in bytes. | |
954 | data-buffer-size-max-limit: 1500 | |
955 | # The ring buffer size used by the CudaBuffer API to buffer data. | |
956 | cudabuffer-buffer-size: 500mb | |
957 | # The max chunk size that can be sent to the gpu in a single go. | |
958 | gpu-transfer-size: 50mb | |
959 | # The timeout limit for batching of packets in microseconds. | |
960 | batching-timeout: 2000 | |
961 | # The device to use for the mpm. Currently we don't support load balancing | |
962 | # on multiple gpus. In case you have multiple devices on your system, you | |
963 | # can specify the device to use, using this conf. By default we hold 0, to | |
964 | # specify the first device cuda sees. To find out device-id associated with | |
965 | # the card(s) on the system run "suricata --list-cuda-cards". | |
966 | device-id: 0 | |
967 | # No of Cuda streams used for asynchronous processing. All values > 0 are valid. | |
968 | # For this option you need a device with Compute Capability > 1.0. | |
969 | cuda-streams: 2 | |
970 | ||
971 | ## | |
972 | ## Include other configs | |
973 | ## | |
974 | ||
975 | # Includes. Files included here will be handled as if they were | |
976 | # inlined in this configuration file. | |
977 | #include: include1.yaml | |
978 | #include: include2.yaml |