ENIP_SERVER: "$HOME_NET"
port-groups:
- HTTP_PORTS: "80"
+ # Incluse HTTP_PORTS declaration from external file.
+ include: /var/ipfire/suricata/suricata-http-ports.yaml
+
SHELLCODE_PORTS: "!80"
ORACLE_PORTS: 1521
SSH_PORTS: "[22,222]"
MODBUS_PORTS: 502
FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
FTP_PORTS: 21
+ GENEVE_PORTS: 6081
+ VXLAN_PORTS: 4789
+ TEREDO_PORTS: 3544
##
## Ruleset specific options.
default-rule-path: /var/lib/suricata
rule-files:
# Include enabled ruleset files from external file.
- include: /var/ipfire/suricata/suricata-used-rulefiles.yaml
-
-classification-file: /var/lib/suricata/classification.config
-reference-config-file: /var/lib/suricata/reference.config
-threshold-file: /var/lib/suricata/threshold.config
+ include: /var/ipfire/suricata/suricata-used-rulesfiles.yaml
+classification-file: /usr/share/suricata/classification.config
+reference-config-file: /usr/share/suricata/reference.config
+threshold-file: /usr/share/suricata/threshold.config
##
## Logging options.
##
default-log-dir: /var/log/suricata/
-# global stats configuration
+# Global stats configuration
stats:
- enabled: yes
- # The interval field (in seconds) controls at what interval
- # the loggers are invoked.
+ enabled: no
+ # The interval field (in seconds) controls the interval at
+ # which stats are updated in the log.
interval: 8
-
- # Add decode events as stats.
+ # Add decode events to stats.
#decoder-events: true
# Decoder event prefix in stats. Has been 'decoder' before, but that leads
# to missing events in the eve.stats records. See issue #2225.
- decoder-events-prefix: "decoder.event"
+ #decoder-events-prefix: "decoder.event"
# Add stream events as stats.
#stream-events: false
+# Plugins -- Experimental -- specify the filename for each plugin shared object
+plugins:
+# - /path/to/plugin.so
+
# Configure the type of alert (and other) logging you would like.
outputs:
# a line based alerts log similar to Snort's fast.log
threads: no # per thread stats
#null-values: yes # print counters that have value 0
+ # Extensible Event Format (nicknamed EVE) event log in JSON format
+ - eve-log:
+ enabled: no
+ filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+ filename: eve.json
+ # Enable for multi-threaded eve.json output; output files are amended with
+ # an identifier, e.g., eve.9.json
+ #threaded: false
+ #prefix: "@cee: " # prefix to prepend to each log entry
+ # the following are valid when type: syslog above
+ #identity: "suricata"
+ #facility: local5
+ #level: Info ## possible levels: Emergency, Alert, Critical,
+ ## Error, Warning, Notice, Info, Debug
+ #ethernet: no # log ethernet header in events when available
+ #redis:
+ # server: 127.0.0.1
+ # port: 6379
+ # async: true ## if redis replies are read asynchronously
+ # mode: list ## possible values: list|lpush (default), rpush, channel|publish
+ # ## lpush and rpush are using a Redis list. "list" is an alias for lpush
+ # ## publish is using a Redis channel. "channel" is an alias for publish
+ # key: suricata ## key or channel to use (default to suricata)
+ # Redis pipelining set up. This will enable to only do a query every
+ # 'batch-size' events. This should lower the latency induced by network
+ # connection at the cost of some memory. There is no flushing implemented
+ # so this setting should be reserved to high traffic Suricata deployments.
+ # pipelining:
+ # enabled: yes ## set enable to yes to enable query pipelining
+ # batch-size: 10 ## number of entries to keep in buffer
+
+ # Include top level metadata. Default yes.
+ #metadata: no
+
+ # include the name of the input pcap file in pcap file processing mode
+ pcap-file: false
+
+ # Community Flow ID
+ # Adds a 'community_id' field to EVE records. These are meant to give
+ # records a predictable flow ID that can be used to match records to
+ # output of other tools such as Zeek (Bro).
+ #
+ # Takes a 'seed' that needs to be same across sensors and tools
+ # to make the id less predictable.
+
+ # enable/disable the community id feature.
+ community-id: false
+ # Seed value for the ID output. Valid values are 0-65535.
+ community-id-seed: 0
+
+ # HTTP X-Forwarded-For support by adding an extra field or overwriting
+ # the source or destination IP address (depending on flow direction)
+ # with the one reported in the X-Forwarded-For HTTP header. This is
+ # helpful when reviewing alerts for traffic that is being reverse
+ # or forward proxied.
+ xff:
+ enabled: no
+ # Two operation modes are available: "extra-data" and "overwrite".
+ mode: extra-data
+ # Two proxy deployments are supported: "reverse" and "forward". In
+ # a "reverse" deployment the IP address used is the last one, in a
+ # "forward" deployment the first IP address is used.
+ deployment: reverse
+ # Header name where the actual IP address will be reported. If more
+ # than one IP address is present, the last IP address will be the
+ # one taken into consideration.
+ header: X-Forwarded-For
+
+ types:
+ - alert:
+ # payload: yes # enable dumping payload in Base64
+ # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
+ # payload-printable: yes # enable dumping payload in printable (lossy) format
+ # packet: yes # enable dumping of packet (without stream segments)
+ # metadata: no # enable inclusion of app layer metadata with alert. Default yes
+ # http-body: yes # Requires metadata; enable dumping of HTTP body in Base64
+ # http-body-printable: yes # Requires metadata; enable dumping of HTTP body in printable format
+
+ # Enable the logging of tagged packets for rules using the
+ # "tag" keyword.
+ tagged-packets: yes
+ # Enable logging the final action taken on a packet by the engine
+ # (e.g: the alert may have action 'allowed' but the verdict be
+ # 'drop' due to another alert. That's the engine's verdict)
+ # verdict: yes
+ # app layer frames
+ - frame:
+ # disabled by default as this is very verbose.
+ enabled: no
+ - anomaly:
+ # Anomaly log records describe unexpected conditions such
+ # as truncated packets, packets with invalid IP/UDP/TCP
+ # length values, and other events that render the packet
+ # invalid for further processing or describe unexpected
+ # behavior on an established stream. Networks which
+ # experience high occurrences of anomalies may experience
+ # packet processing degradation.
+ #
+ # Anomalies are reported for the following:
+ # 1. Decode: Values and conditions that are detected while
+ # decoding individual packets. This includes invalid or
+ # unexpected values for low-level protocol lengths as well
+ # as stream related events (TCP 3-way handshake issues,
+ # unexpected sequence number, etc).
+ # 2. Stream: This includes stream related events (TCP
+ # 3-way handshake issues, unexpected sequence number,
+ # etc).
+ # 3. Application layer: These denote application layer
+ # specific conditions that are unexpected, invalid or are
+ # unexpected given the application monitoring state.
+ #
+ # By default, anomaly logging is enabled. When anomaly
+ # logging is enabled, applayer anomaly reporting is
+ # also enabled.
+ enabled: yes
+ #
+ # Choose one or more types of anomaly logging and whether to enable
+ # logging of the packet header for packet anomalies.
+ types:
+ # decode: no
+ # stream: no
+ # applayer: yes
+ #packethdr: no
+ - http:
+ extended: yes # enable this for extended logging information
+ # custom allows additional HTTP fields to be included in eve-log.
+ # the example below adds three additional fields when uncommented
+ #custom: [Accept-Encoding, Accept-Language, Authorization]
+ # set this value to one and only one from {both, request, response}
+ # to dump all HTTP headers for every HTTP request and/or response
+ # dump-all-headers: none
+ - dns:
+ # This configuration uses the new DNS logging format,
+ # the old configuration is still available:
+ # https://docs.suricata.io/en/latest/output/eve/eve-json-output.html#dns-v1-format
+
+ # As of Suricata 5.0, version 2 of the eve dns output
+ # format is the default.
+ #version: 2
+
+ # Enable/disable this logger. Default: enabled.
+ #enabled: yes
+
+ # Control logging of requests and responses:
+ # - requests: enable logging of DNS queries
+ # - responses: enable logging of DNS answers
+ # By default both requests and responses are logged.
+ #requests: no
+ #responses: no
+
+ # Format of answer logging:
+ # - detailed: array item per answer
+ # - grouped: answers aggregated by type
+ # Default: all
+ #formats: [detailed, grouped]
+
+ # DNS record types to log, based on the query type.
+ # Default: all.
+ #types: [a, aaaa, cname, mx, ns, ptr, txt]
+ - tls:
+ extended: yes # enable this for extended logging information
+ # output TLS transaction where the session is resumed using a
+ # session id
+ #session-resumption: no
+ # custom controls which TLS fields that are included in eve-log
+ #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s]
+ - files:
+ force-magic: no # force logging magic on all logged files
+ # force logging of checksums, available hash functions are md5,
+ # sha1 and sha256
+ #force-hash: [md5]
+ #- drop:
+ # alerts: yes # log alerts that caused drops
+ # flows: all # start or all: 'start' logs only a single drop
+ # # per flow direction. All logs each dropped pkt.
+ # Enable logging the final action taken on a packet by the engine
+ # (will show more information in case of a drop caused by 'reject')
+ # verdict: yes
+ - smtp:
+ #extended: yes # enable this for extended logging information
+ # this includes: bcc, message-id, subject, x_mailer, user-agent
+ # custom fields logging from the list:
+ # reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
+ # x-originating-ip, in-reply-to, references, importance, priority,
+ # sensitivity, organization, content-md5, date
+ #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
+ # output md5 of fields: body, subject
+ # for the body you need to set app-layer.protocols.smtp.mime.body-md5
+ # to yes
+ #md5: [body, subject]
+
+ #- dnp3
+ - ftp
+ - rdp
+ - nfs
+ - smb
+ - tftp
+ - ike
+ - dcerpc
+ - krb5
+ - bittorrent-dht
+ - snmp
+ - rfb
+ - sip
+ - quic
+ - dhcp:
+ enabled: yes
+ # When extended mode is on, all DHCP messages are logged
+ # with full detail. When extended mode is off (the
+ # default), just enough information to map a MAC address
+ # to an IP address is logged.
+ extended: no
+ - ssh
+ - mqtt:
+ # passwords: yes # enable output of passwords
+ - http2
+ - pgsql:
+ enabled: no
+ # passwords: yes # enable output of passwords. Disabled by default
+ - stats:
+ totals: yes # stats for all threads merged together
+ threads: no # per thread stats
+ deltas: no # include delta values
+ # bi-directional flows
+ - flow
+ # uni-directional flows
+ #- netflow
+
+ # Metadata event type. Triggered whenever a pktvar is saved
+ # and will include the pktvars, flowvars, flowbits and
+ # flowints.
+ #- metadata
+
+ # EXPERIMENTAL per packet output giving TCP state tracking details
+ # including internal state, flags, etc.
+ # This output is experimental, meant for debugging and subject to
+ # change in both config and output without any notice.
+ #- stream:
+ # all: false # log all TCP packets
+ # event-set: false # log packets that have a decoder/stream event
+ # state-update: false # log packets triggering a TCP state update
+ # spurious-retransmission: false # log spurious retransmission packets
+
logging:
- # The default log level, can be overridden in an output section.
+ # The default log level: can be overridden in an output section.
# Note that debug level logging will only be emitted if Suricata was
# compiled with the --enable-debug configure option.
#
- # This value is overriden by the SC_LOG_LEVEL env var.
- default-log-level: notice
+ # This value is overridden by the SC_LOG_LEVEL env var.
+ default-log-level: Info
+
+ # The default output format. Optional parameter, should default to
+ # something reasonable if not provided. Can be overridden in an
+ # output section. You can leave this out to get the default.
+ #
+ # This console log format value can be overridden by the SC_LOG_FORMAT env var.
+ #default-log-format: "%D: %S: %M"
+ #
+ # For the pre-7.0 log format use:
+ #default-log-format: "[%i] %t [%S] - (%f:%l) <%d> (%n) -- "
# A regex to filter output. Can be overridden in an output section.
# Defaults to empty (no filter).
#
- # This value is overriden by the SC_LOG_OP_FILTER env var.
+ # This value is overridden by the SC_LOG_OP_FILTER env var.
default-output-filter:
+ # Requires libunwind to be available when Suricata is configured and built.
+ # If a signal unexpectedly terminates Suricata, displays a brief diagnostic
+ # message with the offending stacktrace if enabled.
+ #stacktrace-on-signal: on
+
# Define your logging outputs. If none are defined, or they are all
- # disabled you will get the default - console output.
+ # disabled you will get the default: console output.
outputs:
- console:
enabled: no
enabled: no
level: info
filename: /var/log/suricata/suricata.log
+ # format: "[%i - %m] %z %d: %S: %M"
# type: json
- syslog:
enabled: yes
facility: local5
format: ""
+ #format: "[%i] <%d> -- "
# type: json
##
nfq:
mode: repeat
- repeat-mark: 1879048192
- repeat-mask: 1879048192
-# bypass-mark: 1
-# bypass-mask: 1
+ repeat-mark: 2147483648
+ repeat-mask: 2147483648
+ bypass-mark: 1073741824
+ bypass-mask: 1073741824
# route-queue: 2
# batchcount: 20
- fail-open: yes
+ fail-open: no
##
## Step 5: App Layer Protocol Configuration
##
-# Configure the app-layer parsers. The protocols section details each
-# protocol.
+# Configure the app-layer parsers.
+#
+# The error-policy setting applies to all app-layer parsers. Values can be
+# "drop-flow", "pass-flow", "bypass", "drop-packet", "pass-packet", "reject" or
+# "ignore" (the default).
+#
+# The protocol's section details each protocol.
#
# The option "enabled" takes 3 values - "yes", "no", "detection-only".
# "yes" enables both detection and the parser, "no" disables both, and
# "detection-only" enables protocol detection only (parser disabled).
app-layer:
+ # error-policy: ignore
protocols:
+ telnet:
+ enabled: yes
+ rfb:
+ enabled: yes
+ detection-ports:
+ dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909
+ mqtt:
+ enabled: yes
+ # max-msg-length: 1mb
+ # subscribe-topic-match-limit: 100
+ # unsubscribe-topic-match-limit: 100
+ # Maximum number of live MQTT transactions per flow
+ # max-tx: 4096
krb5:
- enabled: no # Requires rust
- ikev2:
+ enabled: yes
+ bittorrent-dht:
+ enabled: yes
+ snmp:
+ enabled: yes
+ ike:
enabled: yes
tls:
enabled: yes
detection-ports:
dp: "[443,444,465,853,993,995]"
- # Completely stop processing TLS/SSL session after the handshake
- # completed. If bypass is enabled this will also trigger flow
- # bypass. If disabled (the default), TLS/SSL session is still
- # tracked for Heartbleed and other anomalies.
- #no-reassemble: yes
+ # Generate JA3 fingerprint from client hello. If not specified it
+ # will be disabled by default, but enabled if rules require it.
+ ja3-fingerprints: auto
+
+ # What to do when the encrypted communications start:
+ # - default: keep tracking TLS session, check for protocol anomalies,
+ # inspect tls_* keywords. Disables inspection of unmodified
+ # 'content' signatures.
+ # - bypass: stop processing this flow as much as possible. No further
+ # TLS parsing and inspection. Offload flow bypass to kernel
+ # or hardware if possible.
+ # - full: keep tracking and inspection as normal. Unmodified content
+ # keyword signatures are inspected as well.
+ #
+ # For best performance, select 'bypass'.
+ #
+ encryption-handling: bypass
+
+ pgsql:
+ enabled: no
+ # Stream reassembly size for PostgreSQL. By default, track it completely.
+ stream-depth: 0
+ # Maximum number of live PostgreSQL transactions per flow
+ # max-tx: 1024
dcerpc:
enabled: yes
+ # Maximum number of live DCERPC transactions per flow
+ # max-tx: 1024
ftp:
enabled: yes
+ # memcap: 64mb
+ rdp:
+ enabled: yes
ssh:
enabled: yes
+ #hassh: yes
+ http2:
+ enabled: yes
+ # Maximum number of live HTTP2 streams in a flow
+ #max-streams: 4096
+ # Maximum headers table size
+ #max-table-size: 65536
+ # Maximum reassembly size for header + continuation frames
+ #max-reassembly-size: 102400
smtp:
enabled: yes
+ raw-extraction: no
+ # Maximum number of live SMTP transactions per flow
+ # max-tx: 256
# Configure SMTP-MIME Decoder
mime:
# Decode MIME messages from SMTP transactions
# (may be resource intensive)
- # This field supercedes all others because it turns the entire
+ # This field supersedes all others because it turns the entire
# process on or off
decode-mime: yes
- # Decode MIME entity bodies (ie. base64, quoted-printable, etc.)
+ # Decode MIME entity bodies (ie. Base64, quoted-printable, etc.)
decode-base64: yes
decode-quoted-printable: yes
# Extract URLs and save in state data structure
extract-urls: yes
+ # Scheme of URLs to extract
+ # (default is [http])
+ #extract-urls-schemes: [http, https, ftp, mailto]
+ # Log the scheme of URLs that are extracted
+ # (default is no)
+ #log-url-scheme: yes
# Set to yes to compute the md5 of the mail body. You will then
# be able to journalize it.
body-md5: no
content-inspect-window: 4096
imap:
enabled: yes
- msn:
- enabled: yes
smb:
enabled: yes
detection-ports:
dp: 139, 445
- # smb2 detection is disabled internally inside the engine.
- #smb2:
- # enabled: yes
+ # Maximum number of live SMB transactions per flow
+ # max-tx: 1024
+
+ # Stream reassembly size for SMB streams. By default track it completely.
+ #stream-depth: 0
+
+ nfs:
+ enabled: yes
+ # max-tx: 1024
+ tftp:
+ enabled: yes
dns:
# memcaps. Globally and per flow/state.
global-memcap: 32mb
# How many unreplied DNS requests are considered a flood.
# If the limit is reached, app-layer-event:dns.flooded; will match.
- request-flood: 512
+ #request-flood: 512
tcp:
enabled: yes
enabled: yes
memcap: 256mb
+ # Byte Range Containers default settings
+ # byterange:
+ # memcap: 100mb
+ # timeout: 60
+
+ # memcap: Maximum memory capacity for HTTP
+ # Default is unlimited, values can be 64mb, e.g.
+
# default-config: Used when no server-config matches
# personality: List of personalities used by default
# request-body-limit: Limit reassembly of request body for inspection
# by http_client_body & pcre /P option.
# response-body-limit: Limit reassembly of response body for inspection
# by file_data, http_server_body & pcre /Q option.
- # double-decode-path: Double decode path section of the URI
- # double-decode-query: Double decode query section of the URI
- # response-body-decompress-layer-limit:
- # Limit to how many layers of compression will be
- # decompressed. Defaults to 2.
+ #
+ # For advanced options, see the user guide
+
+
+ # server-config: List of server configurations to use if address matches
+ # address: List of IP addresses or networks for this block
+ # personality: List of personalities used by this block
+ #
+ # Then, all the fields from default-config can be overloaded
#
# Currently Available Personalities:
# Minimal, Generic, IDS (default), IIS_4_0, IIS_5_0, IIS_5_1, IIS_6_0,
# Can be specified in kb, mb, gb. Just a number indicates
# it's in bytes.
- request-body-limit: 0
- response-body-limit: 0
+ request-body-limit: 100kb
+ response-body-limit: 100kb
+
+ # inspection limits
+ request-body-minimal-inspect-size: 32kb
+ request-body-inspect-window: 4kb
+ response-body-minimal-inspect-size: 40kb
+ response-body-inspect-window: 16kb
# response body decompression (0 disables)
response-body-decompress-layer-limit: 2
# auto will use http-body-inline mode in IPS mode, yes or no set it statically
http-body-inline: auto
- # Take a random value for inspection sizes around the specified value.
- # This lower the risk of some evasion technics but could lead
- # detection change between runs. It is set to 'yes' by default.
- randomize-inspection-sizes: yes
- # If randomize-inspection-sizes is active, the value of various
- # inspection size will be choosen in the [1 - range%, 1 + range%]
+ # Decompress SWF files. Disabled by default.
+ # Two types: 'deflate', 'lzma', 'both' will decompress deflate and lzma
+ # compress-depth:
+ # Specifies the maximum amount of data to decompress,
+ # set 0 for unlimited.
+ # decompress-depth:
+ # Specifies the maximum amount of decompressed data to obtain,
+ # set 0 for unlimited.
+ swf-decompression:
+ enabled: no
+ type: both
+ compress-depth: 100kb
+ decompress-depth: 100kb
+
+ # Use a random value for inspection sizes around the specified value.
+ # This lowers the risk of some evasion techniques but could lead
+ # to detection change between runs. It is set to 'yes' by default.
+ #randomize-inspection-sizes: yes
+ # If "randomize-inspection-sizes" is active, the value of various
+ # inspection size will be chosen from the [1 - range%, 1 + range%]
# range
- # Default value of randomize-inspection-range is 10.
- randomize-inspection-range: 10
+ # Default value of "randomize-inspection-range" is 10.
+ #randomize-inspection-range: 10
# decoding
double-decode-path: no
double-decode-query: no
+ # Can enable LZMA decompression
+ #lzma-enabled: false
+ # Memory limit usage for LZMA decompression dictionary
+ # Data is decompressed until dictionary reaches this size
+ #lzma-memlimit: 1mb
+ # Maximum decompressed size with a compression ratio
+ # above 2048 (only LZMA can reach this ratio, deflate cannot)
+ #compression-bomb-limit: 1mb
+ # Maximum time spent decompressing a single transaction in usec
+ #decompression-time-limit: 100000
+ # Maximum number of live transactions per flow
+ #max-tx: 512
+
+ server-config:
+
+ #- apache:
+ # address: [192.168.1.0/24, 127.0.0.0/8, "::1"]
+ # personality: Apache_2
+ # # Can be specified in kb, mb, gb. Just a number indicates
+ # # it's in bytes.
+ # request-body-limit: 4096
+ # response-body-limit: 4096
+ # double-decode-path: no
+ # double-decode-query: no
+
+ #- iis7:
+ # address:
+ # - 192.168.0.0/24
+ # - 192.168.10.0/24
+ # personality: IIS_7_0
+ # # Can be specified in kb, mb, gb. Just a number indicates
+ # # it's in bytes.
+ # request-body-limit: 4096
+ # response-body-limit: 4096
+ # double-decode-path: no
+ # double-decode-query: no
+
+ # Note: Modbus probe parser is minimalist due to the limited usage in the field.
+ # Only Modbus message length (greater than Modbus header length)
+ # and protocol ID (equal to 0) are checked in probing parser
+ # It is important to enable detection port and define Modbus port
+ # to avoid false positives
+ modbus:
+ # How many unanswered Modbus requests are considered a flood.
+ # If the limit is reached, the app-layer-event:modbus.flooded; will match.
+ #request-flood: 500
+
+ enabled: no
+ detection-ports:
+ dp: 502
+ # According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it
+ # is recommended to keep the TCP connection opened with a remote device
+ # and not to open and close it for each MODBUS/TCP transaction. In that
+ # case, it is important to set the depth of the stream reassembling as
+ # unlimited (stream.reassembly.depth: 0)
+
+ # Stream reassembly size for modbus. By default track it completely.
+ stream-depth: 0
+
+ # DNP3
+ dnp3:
+ enabled: no
+ detection-ports:
+ dp: 20000
+
+ # SCADA EtherNet/IP and CIP protocol support
+ enip:
+ enabled: no
+ detection-ports:
+ dp: 44818
+ sp: 44818
+
+ ntp:
+ enabled: yes
+
+ quic:
+ enabled: yes
+
+ dhcp:
+ enabled: yes
+
+ sip:
+ #enabled: yes
# Limit for the maximum number of asn1 frames to decode (default 256)
asn1-max-frames: 256
+# Datasets default settings
+datasets:
+ # Default fallback memcap and hashsize values for datasets in case these
+ # were not explicitly defined.
+ defaults:
+ #memcap: 100mb
+ #hashsize: 2048
+
+ rules:
+ # Set to true to allow absolute filenames and filenames that use
+ # ".." components to reference parent directories in rules that specify
+ # their filenames.
+ #allow-absolute-filenames: false
+
+ # Allow datasets in rules write access for "save" and
+ # "state". This is enabled by default, however write access is
+ # limited to the data directory.
+ #allow-write: true
##############################################################################
##
## Run Options
##
-# Run suricata as user and group.
+# Run Suricata with a specific user-id and group-id:
run-as:
user: suricata
group: suricata
+security:
+ # if true, prevents process creation from Suricata by calling
+ # setrlimit(RLIMIT_NPROC, 0)
+ limit-noproc: true
+ # Use landlock security module under Linux
+ landlock:
+ enabled: yes
+ directories:
+ write:
+ - /run
+ # /usr and /etc folders are added to read list to allow
+ # file magic to be used.
+ read:
+ - /etc/suricata
+ - /usr/share/misc
+ - /usr/share/suricata
+ - /var/ipfire/suricata
+ - /var/lib/suricata
+
+ lua:
+ # Allow Lua rules. Disabled by default.
+ #allow-rules: false
+
+# Some logging modules will use that name in event as identifier. The default
+# value is the hostname
+#sensor-name: suricata
+
+# Default location of the pid file. The pid file is only used in
+# daemon mode (start Suricata with -D). If not running in daemon mode
+# the --pidfile command line option must be used to create a pid file.
+pid-file: /var/run/suricata.pid
+
+# Daemon working directory
+# Suricata will change directory to this one if provided
+# Default: "/"
+#daemon-directory: "/"
+
+# Umask.
+# Suricata will use this umask if it is provided. By default it will use the
+# umask passed on by the shell.
+#umask: 022
+
# Suricata core dump configuration. Limits the size of the core dump file to
# approximately max-dump. The actual core dump size will be a multiple of the
# page size. Core dumps that would be larger than max-dump are truncated. On
coredump:
max-dump: unlimited
-# If suricata box is a router for the sniffed networks, set it to 'router'. If
+# If the Suricata box is a router for the sniffed networks, set it to 'router'. If
# it is a pure sniffing setup, set it to 'sniffer-only'.
-# If set to auto, the variable is internally switch to 'router' in IPS mode
+# If set to auto, the variable is internally switched to 'router' in IPS mode
# and 'sniffer-only' in IDS mode.
# This feature is currently only used by the reject* keywords.
host-mode: auto
# Number of packets preallocated per thread. The default is 1024. A higher number
# will make sure each CPU will be more easily kept busy, but may negatively
# impact caching.
-max-pending-packets: 1024
+#max-pending-packets: 1024
# Runmode the engine should use. Please check --list-runmodes to get the available
-# runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned
-# load balancing).
+# runmodes for each packet acquisition method. Default depends on selected capture
+# method. 'workers' generally gives best performance.
runmode: workers
# Specifies the kind of flow load balancer used by the flow pinned autofp mode.
#
# Supported schedulers are:
#
-# round-robin - Flows assigned to threads in a round robin fashion.
-# active-packets - Flows assigned to threads that have the lowest number of
-# unprocessed packets (default).
-# hash - Flow alloted usihng the address hash. More of a random
-# technique. Was the default in Suricata 1.2.1 and older.
+# hash - Flow assigned to threads using the 5-7 tuple hash.
+# ippair - Flow assigned to threads using addresses only.
+# ftp-hash - Flow assigned to threads using the hash, except for FTP, so that
+# ftp-data flows will be handled by the same thread
#
-#autofp-scheduler: active-packets
+#autofp-scheduler: hash
-# Preallocated size for packet. Default is 1514 which is the classical
-# size for pcap on ethernet. You should adjust this value to the highest
+# Preallocated size for each packet. Default is 1514 which is the classical
+# size for pcap on Ethernet. You should adjust this value to the highest
# packet size (MTU + hardware header) on your system.
-default-packet-size: 1514
+#default-packet-size: 1514
-# Unix command socket can be used to pass commands to suricata.
-# An external tool can then connect to get information from suricata
+# Unix command socket that can be used to pass commands to Suricata.
+# An external tool can then connect to get information from Suricata
# or trigger some modifications of the engine. Set enabled to yes
# to activate the feature. In auto mode, the feature will only be
# activated in live capture mode. You can use the filename variable to set
## Detection settings
##
-# Set the order of alerts bassed on actions
+# Set the order of alerts based on actions
# The default order is pass, drop, reject, alert
# action-order:
# - pass
# - reject
# - alert
+# Define maximum number of possible alerts that can be triggered for the same
+# packet. Default is 15
+#packet-alert-max: 15
+
+# Exception Policies
+#
+# Define a common behavior for all exception policies.
+# In IPS mode, the default is drop-flow. For cases when that's not possible, the
+# engine will fall to drop-packet. To fallback to old behavior (setting each of
+# them individually, or ignoring all), set this to ignore.
+# All values available for exception policies can be used, and there is one
+# extra option: auto - which means drop-flow or drop-packet (as explained above)
+# in IPS mode, and ignore in IDS mode. Exception policy values are: drop-packet,
+# drop-flow, reject, bypass, pass-packet, pass-flow, ignore (disable).
+exception-policy: pass-packet
+
# When run with the option --engine-analysis, the engine will read each of
# the parameters below, and print reports for each of the enabled sections
# and exit. The reports are printed to a file in the default log dir
# Defrag settings:
+# The memcap-policy value can be "drop-packet", "pass-packet", "reject" or
+# "ignore" (which is the default).
defrag:
memcap: 64mb
+ # memcap-policy: ignore
hash-size: 65536
trackers: 65535 # number of defragmented flows to follow
max-frags: 65535 # number of fragments to keep (higher than trackers)
# By default, the reserved memory (memcap) for flows is 32MB. This is the limit
# for flow allocation inside the engine. You can change this value to allow
# more memory usage for flows.
-# The hash-size determine the size of the hash used to identify flows inside
+# The hash-size determines the size of the hash used to identify flows inside
# the engine, and by default the value is 65536.
-# At the startup, the engine can preallocate a number of flows, to get a better
+# At startup, the engine can preallocate a number of flows, to get better
# performance. The number of flows preallocated is 10000 by default.
-# emergency-recovery is the percentage of flows that the engine need to
-# prune before unsetting the emergency state. The emergency state is activated
-# when the memcap limit is reached, allowing to create new flows, but
-# prunning them with the emergency timeouts (they are defined below).
+# emergency-recovery is the percentage of flows that the engine needs to
+# prune before clearing the emergency state. The emergency state is activated
+# when the memcap limit is reached, allowing new flows to be created, but
+# pruning them with the emergency timeouts (they are defined below).
# If the memcap is reached, the engine will try to prune flows
-# with the default timeouts. If it doens't find a flow to prune, it will set
-# the emergency bit and it will try again with more agressive timeouts.
-# If that doesn't work, then it will try to kill the last time seen flows
-# not in use.
+# with the default timeouts. If it doesn't find a flow to prune, it will set
+# the emergency bit and it will try again with more aggressive timeouts.
+# If that doesn't work, then it will try to kill the oldest flows using
+# last time seen flows.
# The memcap can be specified in kb, mb, gb. Just a number indicates it's
# in bytes.
+# The memcap-policy can be "drop-packet", "pass-packet", "reject" or "ignore"
+# (which is the default).
flow:
memcap: 256mb
+ #memcap-policy: ignore
hash-size: 65536
prealloc: 10000
emergency-recovery: 30
- managers: 1
- recyclers: 1
+ #managers: 1 # default to one flow manager
+ #recyclers: 1 # default to one flow recycler thread
-# This option controls the use of vlan ids in the flow (and defrag)
+# This option controls the use of VLAN ids in the flow (and defrag)
# hashing. Normally this should be enabled, but in some (broken)
-# setups where both sides of a flow are not tagged with the same vlan
-# tag, we can ignore the vlan id's in the flow hashing.
+# setups where both sides of a flow are not tagged with the same VLAN
+# tag, we can ignore the VLAN id's in the flow hashing.
vlan:
use-for-tracking: true
+# This option controls the use of livedev ids in the flow (and defrag)
+# hashing. This is enabled by default and should be disabled if
+# multiple live devices are used to capture traffic from the same network
+livedev:
+ use-for-tracking: true
+
# Specific timeouts for flows. Here you can specify the timeouts that the
# active flows will wait to transit from the current state to another, on each
-# protocol. The value of "new" determine the seconds to wait after a hanshake or
-# stream startup before the engine free the data of that flow it doesn't
+# protocol. The value of "new" determines the seconds to wait after a handshake or
+# stream startup before the engine frees the data of that flow it doesn't
# change the state to established (usually if we don't receive more packets
# of that flow). The value of "established" is the amount of
-# seconds that the engine will wait to free the flow if it spend that amount
+# seconds that the engine will wait to free the flow if that time elapses
# without receiving new packets or closing the connection. "closed" is the
# amount of time to wait after a flow is closed (usually zero). "bypassed"
# timeout controls locally bypassed flows. For these flows we don't do any other
# engine is configured.
#
# stream:
-# memcap: 32mb # Can be specified in kb, mb, gb. Just a
+# memcap: 64mb # Can be specified in kb, mb, gb. Just a
# # number indicates it's in bytes.
+# memcap-policy: ignore # Can be "drop-flow", "pass-flow", "bypass",
+# # "drop-packet", "pass-packet", "reject" or
+# # "ignore" default is "ignore"
# checksum-validation: yes # To validate the checksum of received
# # packet. If csum validation is specified as
-# # "yes", then packet with invalid csum will not
+# # "yes", then packets with invalid csum values will not
# # be processed by the engine stream/app layer.
-# # Warning: locally generated trafic can be
+# # Warning: locally generated traffic can be
# # generated without checksum due to hardware offload
# # of checksum. You can control the handling of checksum
# # on a per-interface basis via the 'checksum-checks'
# # option
-# prealloc-sessions: 2k # 2k sessions prealloc'd per stream thread
+# prealloc-sessions: 2048 # 2k sessions prealloc'd per stream thread
# midstream: false # don't allow midstream session pickups
+# midstream-policy: ignore # Can be "drop-flow", "pass-flow", "bypass",
+# # "drop-packet", "pass-packet", "reject" or
+# # "ignore" default is "ignore"
# async-oneside: false # don't enable async stream handling
# inline: no # stream inline mode
# drop-invalid: yes # in inline mode, drop packets that are invalid with regards to streaming engine
+# max-syn-queued: 10 # Max different SYNs to queue
# max-synack-queued: 5 # Max different SYN/ACKs to queue
-# bypass: no # Bypass packets when stream.depth is reached
+# bypass: no # Bypass packets when stream.reassembly.depth is reached.
+# # Warning: first side to reach this triggers
+# # the bypass.
+# liberal-timestamps: false # Treat all timestamps as if the Linux policy applies. This
+# # means it's slightly more permissive. Enabled by default.
#
# reassembly:
-# memcap: 64mb # Can be specified in kb, mb, gb. Just a number
+# memcap: 256mb # Can be specified in kb, mb, gb. Just a number
# # indicates it's in bytes.
+# memcap-policy: ignore # Can be "drop-flow", "pass-flow", "bypass",
+# # "drop-packet", "pass-packet", "reject" or
+# # "ignore" default is "ignore"
# depth: 1mb # Can be specified in kb, mb, gb. Just a number
# # indicates it's in bytes.
# toserver-chunk-size: 2560 # inspect raw stream in chunks of at least
# # this size. Can be specified in kb, mb,
# # gb. Just a number indicates it's in bytes.
# randomize-chunk-size: yes # Take a random value for chunk size around the specified value.
-# # This lower the risk of some evasion technics but could lead
-# # detection change between runs. It is set to 'yes' by default.
+# # This lowers the risk of some evasion techniques but could lead
+# # to detection change between runs. It is set to 'yes' by default.
# randomize-chunk-range: 10 # If randomize-chunk-size is active, the value of chunk-size is
# # a random value between (1 - randomize-chunk-range/100)*toserver-chunk-size
# # and (1 + randomize-chunk-range/100)*toserver-chunk-size and the same
stream:
memcap: 256mb
prealloc-sessions: 4096
- checksum-validation: yes # reject wrong csums
+ #memcap-policy: ignore
+ checksum-validation: yes # reject incorrect csums
+ midstream: true
+ midstream-policy: pass-flow
inline: auto # auto will use inline mode in IPS mode, yes or no set it statically
+ bypass: yes # Bypass packets when stream.reassembly.depth is reached.
reassembly:
memcap: 256mb
+ #memcap-policy: ignore
depth: 1mb # reassemble 1mb into a stream
toserver-chunk-size: 2560
toclient-chunk-size: 2560
randomize-chunk-size: yes
+ #randomize-chunk-range: 10
raw: yes
segment-prealloc: 2048
check-overlap-different-data: true
# Host table:
#
-# Host table is used by tagging and per host thresholding subsystems.
+# Host table is used by the tagging and per host thresholding subsystems.
#
host:
hash-size: 4096
decoder:
# Teredo decoder is known to not be completely accurate
- # it will sometimes detect non-teredo as teredo.
+ # as it will sometimes detect non-teredo as teredo.
teredo:
enabled: false
+ # ports to look for Teredo. Max 4 ports. If no ports are given, or
+ # the value is set to 'any', Teredo detection runs on _all_ UDP packets.
+ ports: $TEREDO_PORTS # syntax: '[3544, 1234]' or '3533' or 'any'.
+
+ # VXLAN decoder is assigned to up to 4 UDP ports. By default only the
+ # IANA assigned port 4789 is enabled.
+ vxlan:
+ enabled: true
+ ports: $VXLAN_PORTS # syntax: '[8472, 4789]' or '4789'.
+ # Geneve decoder is assigned to up to 4 UDP ports. By default only the
+ # IANA assigned port 6081 is enabled.
+ geneve:
+ enabled: true
+ ports: $GENEVE_PORTS # syntax: '[6081, 1234]' or '6081'.
+
+ # maximum number of decoder layers for a packet
+ # max-layers: 16
##
## Performance tuning and profiling
##
# The detection engine builds internal groups of signatures. The engine
-# allow us to specify the profile to use for them, to manage memory on an
-# efficient way keeping a good performance. For the profile keyword you
-# can use the words "low", "medium", "high" or "custom". If you use custom
-# make sure to define the values at "- custom-values" as your convenience.
+# allows us to specify the profile to use for them, to manage memory in an
+# efficient way keeping good performance. For the profile keyword you
+# can use the words "low", "medium", "high" or "custom". If you use custom,
+# make sure to define the values in the "custom-values" section.
# Usually you would prefer medium/high/low.
#
# "sgh mpm-context", indicates how the staging should allot mpm contexts for
# in the content inspection code. For certain payload-sig combinations, we
# might end up taking too much time in the content inspection code.
# If the argument specified is 0, the engine uses an internally defined
-# default limit. On not specifying a value, we use no limits on the recursion.
+# default limit. When a value is not specified, there are no limits on the recursion.
detect:
- profile: custom
+ profile: medium
custom-values:
- toclient-groups: 200
- toserver-groups: 200
+ toclient-groups: 3
+ toserver-groups: 25
sgh-mpm-context: auto
inspection-recursion-limit: 3000
-
# If set to yes, the loading of signatures will be made after the capture
# is started. This will limit the downtime in IPS mode.
delayed-detect: yes
default: mpm
# the grouping values above control how many groups are created per
- # direction. Port whitelisting forces that port to get it's own group.
+ # direction. Port whitelisting forces that port to get its own group.
# Very common ports will benefit, as well as ports with many expensive
# rules.
grouping:
# The supported algorithms are:
# "ac" - Aho-Corasick, default implementation
# "ac-bs" - Aho-Corasick, reduced memory implementation
-# "ac-cuda" - Aho-Corasick, CUDA implementation
# "ac-ks" - Aho-Corasick, "Ken Steele" variant
# "hs" - Hyperscan, available when built with Hyperscan support
#
# signature groups, specified by the conf - "detect.sgh-mpm-context".
# Selecting "ac" as the mpm would require "detect.sgh-mpm-context"
# to be set to "single", because of ac's memory requirements, unless the
-# ruleset is small enough to fit in one's memory, in which case one can
-# use "full" with "ac". Rest of the mpms can be run in "full" mode.
-#
-# There is also a CUDA pattern matcher (only available if Suricata was
-# compiled with --enable-cuda: b2g_cuda. Make sure to update your
-# max-pending-packets setting above as well if you use b2g_cuda.
+# ruleset is small enough to fit in memory, in which case one can
+# use "full" with "ac". The rest of the mpms can be run in "full" mode.
mpm-algo: auto
threading:
set-cpu-affinity: no
# Tune cpu affinity of threads. Each family of threads can be bound
- # on specific CPUs.
+ # to specific CPUs.
#
# These 2 apply to the all runmodes:
# management-cpu-set is used for flow timeout handling, counters
#
cpu-affinity:
- management-cpu-set:
- cpu: [ 0 ] # include only these cpus in affinity settings
+ cpu: [ 0 ] # include only these CPUs in affinity settings
- receive-cpu-set:
- cpu: [ 0 ] # include only these cpus in affinity settings
+ cpu: [ 0 ] # include only these CPUs in affinity settings
- worker-cpu-set:
cpu: [ "all" ]
mode: "exclusive"
+ # Use explicitly 3 threads and don't compute number by using
+ # detect-thread-ratio variable:
+ # threads: 3
prio:
low: [ 0 ]
medium: [ "1-2" ]
high: [ 3 ]
default: "medium"
- - verdict-cpu-set:
- cpu: [ 0 ]
- prio:
- default: "high"
+ #- verdict-cpu-set:
+ # cpu: [ 0 ]
+ # prio:
+ # default: "high"
#
# By default Suricata creates one "detect" thread per available CPU/CPU core.
# This setting allows controlling this behaviour. A ratio setting of 2 will
# thread will always be created.
#
detect-thread-ratio: 1.0
+ #
+ # By default, the per-thread stack size is left to its default setting. If
+ # the default thread stack size is too small, use the following configuration
+ # setting to change the size. Note that if any thread's stack size cannot be
+ # set to this value, a fatal error occurs.
+ #
+ # Generally, the per-thread stack-size should not exceed 8MB.
+ #stack-size: 8mb
projects / ipfire-2.x.git / blobdiff