cd /usr/ports/www/apache22/
make install clean

Once installed you will need to allow apache to start.

vi /etc/rc.conf
apache22_enable="YES"

There is also some post installation stuff to do to base, that came up after the installation.

Please read the README file located at:

/usr/local/share/doc/base/README

for how to configure /usr/local/www/base/base_conf.php after
installation.


To make BASE accessible through your web site, you will need to add
the following to your Apache configuration file:

    Alias /base/ "/usr/local/www/base"

In order for the graphing functions to work in BASE, make sure you
include PEAR in your /usr/local/etc/php.ini configuration file, like:

    include_path = ".:/usr/local/share/pear"

If you built BASE with PDF support, make sure you include the FPDF
path in your /usr/local/etc/php.ini configuration file, like:

    include_path = ".:/usr/local/share/pear:/usr/local/share/fpdf"

Almost done setting up BASE.

Ensure your HOME_NET is correct or your results are not going to be so great.

  # Holds the address group vars that would be passed in a Signature.
  # These would be retrieved during the Signature address parsing stage.
  address-groups:

    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"

    EXTERNAL_NET: any

    HTTP_SERVERS: "$HOME_NET"

    SMTP_SERVERS: "$HOME_NET"

    SQL_SERVERS: "$HOME_NET"

    DNS_SERVERS: "$HOME_NET"

    TELNET_SERVERS: "$HOME_NET"

    AIM_SERVERS: any

  # Holds the port group vars that would be passed in a Signature.
  # These would be retrieved during the Signature port parsing stage.
  port-groups:

    HTTP_PORTS: "80"

    SHELLCODE_PORTS: "!80"

    ORACLE_PORTS: 1521

    SSH_PORTS: 22

Now that Suricata is is configured and runs we can install something to manage the events being generated by it.

BASE is listed in the http://www.openinfosecfoundation.org/index.php/faqs as something that is supported.

http://base.secureideas.net/

cd /usr/ports/security/base/
make install clean

BASE has a long list of dependencies to install, so go grab a coffee.

( Lets put it somewhere nice )

vi /usr/local/etc/rc.d/suricata

#!/bin/sh
#
# By Dan OConnor
# PROVIDE: suricata
#
. /etc/rc.subr
name="suricata"
rcvar=${name}_enable
load_rc_config $name
: ${suricata_enable="NO"}
start_cmd=${name}_start
stop_cmd=${name}_stop
suricata_bin="/usr/local/bin/suricata"
suricata_start() {
        ${suricata_bin} -D -c $suricata_conf -i $suricata_int
}
suricata_stop() {
        killall -INT suricata
}
run_rc_command "$1"

chmod +x /usr/local/etc/rc.d/suricata

You can get fancy if you want with the rc script, but this basic one will allow you to start,stop and restart the service as needed.

Add the needed lines to /etc/rc.conf so we can start the service and pass our variables in.

vi /etc/rc.conf
suricata_enable="YES"
suricata_int="em0"
suricata_conf="/usr/local/etc/suricata.yaml"

And give it a test run.

test# /usr/local/etc/rc.d/suricata start
Warning: Invalid global_log_level assigned by user.  Falling back on the default_log_level "Info"
Warning: Invalid global_log_format supplied by user or format length exceeded limit of "128" characters.  Falling back on default log_format "[%i] %t - (%f:%l)  (%n) -- "
Warning: Output_interface not supplied by user.  Falling back on default_output_interface "Console"
[100121] 23/2/2010 -- 05:52:14 - (suricata.c:567)  (main) -- This is Suricata version 0.8.1
[100121] 23/2/2010 -- 05:52:14 - (util-cpu.c:150)  (UtilCpuPrintSummary) -- CPUs Summary: 
[100121] 23/2/2010 -- 05:52:14 - (util-cpu.c:152)  (UtilCpuPrintSummary) -- CPUs online: 1
[100121] 23/2/2010 -- 05:52:14 - (util-cpu.c:154)  (UtilCpuPrintSummary) -- CPUs configured 1
[100121] 23/2/2010 -- 05:52:14 - (output.c:42)  (OutputRegisterModule) -- Output module "AlertFastLog" registered.
[100121] 23/2/2010 -- 05:52:14 - (output.c:42)  (OutputRegisterModule) -- Output module "AlertDebugLog" registered.
[100121] 23/2/2010 -- 05:52:14 - (output.c:42)  (OutputRegisterModule) -- Output module "AlertUnifiedLog" registered.
[100121] 23/2/2010 -- 05:52:14 - (output.c:42)  (OutputRegisterModule) -- Output module "AlertUnifiedAlert" registered.
[100121] 23/2/2010 -- 05:52:14 - (output.c:42)  (OutputRegisterModule) -- Output module "Unified2Alert" registered.
[100121] 23/2/2010 -- 05:52:14 - (output.c:42)  (OutputRegisterModule) -- Output module "LogHttpLog" registered.

test# /usr/local/etc/rc.d/suricata stop

Needs to be cleaned up a bit but we can now start and stop it.

suricata -c /usr/local/etc/suricata.yaml -i em0

Got a good start.

70 rule files processed. 7977 rules succesfully loaded, 5 rules failed

Here is the 5 that did not load, I only added the emerging threats rules not the snort release set ( those caused Suricata to crash ).

[100072] 20/2/2010 -- 22:20:51 - (detect-bytetest.c:267)  (DetectBytetestParse) -- [ERRCODE: SC_ERR_INVALID_OPERATOR(111)] - Invalid operator
[100072] 20/2/2010 -- 22:20:51 - (detect.c:291)  (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(29)] - Error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P eMule KAD Network Hello Request (2)"; content:"|e4 10|"; depth:2; byte_test:2,<=,65535,16,relative; byte_test:2,<=,65535,0,relative; threshold: type limit, count 5, seconds 600, track by_src; classtype:policy-violation; reference:url,emule-project.net; reference:url,doc.emergingthreats.net/2009971; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/P2P/P2P_eMule; sid:2009971; rev:4;)" from file /usr/local/etc/suricata/rules/emerging-p2p.rules at line 194
[100072] 20/2/2010 -- 22:20:52 - (detect-distance.c:48)  (DetectDistanceSetup) -- [ERRCODE: SC_ERR_DISTANCE_MISSING_CONTENT(88)] - distance needs two preceeding content options
[100072] 20/2/2010 -- 22:20:52 - (detect.c:291)  (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(29)] - Error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Egspy Infection Report via HTTP"; flow:established,to_server; uricontent:"/keylogkontrol/"; content:"|0d 0a|User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; distance:0; classtype:trojan-activity; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=EgySpy&threatid=48410; reference:url,doc.emergingthreats.net/2008047; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Egyspy; sid:2008047; rev:2;)" from file /usr/local/etc/suricata/rules/emerging-virus.rules at line 915
[100072] 20/2/2010 -- 22:20:52 - (detect-distance.c:48)  (DetectDistanceSetup) -- [ERRCODE: SC_ERR_DISTANCE_MISSING_CONTENT(88)] - distance needs two preceeding content options
[100072] 20/2/2010 -- 22:20:52 - (detect.c:291)  (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(29)] - Error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Generic Spambot (often Tibs) Post-Infection Checkin"; flow:established,to_server; uricontent:"/access.php?"; nocase; uricontent:"w="; nocase; uricontent:"&a="; nocase; content:"|0d 0a|Host\: "; distance:0; pcre:"/Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a/"; content:"|0d 0a|Cache-Control\: no-cache|0d 0a|"; content:!"|0d 0a|User-Agent\: "; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2008174; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_Tibs; sid:2008174; rev:2;)" from file /usr/local/etc/suricata/rules/emerging-virus.rules at line 2240
[100072] 20/2/2010 -- 22:20:52 - (detect.c:335)  (SigLoadSignatures) -- [ERRCODE: SC_ERR_NO_RULES(32)] - No rules loaded from /usr/local/etc/suricata/rules/emerging-web.rules
[100072] 20/2/2010 -- 22:20:55 - (detect-uricontent.c:303)  (DoDetectUricontentSetup) -- [ERRCODE: SC_ERR_NO_URICONTENT_NEGATION(92)] - uricontent negation is not supported at this time. See bug #31.
[100072] 20/2/2010 -- 22:20:55 - (detect.c:291)  (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(29)] - Error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS Suspicious Mozilla User-Agent - Likely Fake (Mozilla/5.0)"; flow:to_server,established; content:"|0d 0a|User-Agent\: Mozilla/5.0|0d 0a|"; nocase; uricontent:!"|0d 0a|Host\: download.releasenotes.nokia.com"; content:!"Mozilla/5.0|0d 0a|Connection\: Close|0d 0a 0d 0a|"; classtype:trojan-activity; reference:url,doc.emergingthreats.net/2009295; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/USER_AGENTS/USER_Agents_Suspicious; sid:2009295; rev:6;)" from file /usr/local/etc/suricata/rules/emerging-user_agents.rules at line 483
[100072] 20/2/2010 -- 22:20:55 - (detect-distance.c:48)  (DetectDistanceSetup) -- [ERRCODE: SC_ERR_DISTANCE_MISSING_CONTENT(88)] - distance needs two preceeding content options
[100072] 20/2/2010 -- 22:20:55 - (detect.c:291)  (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(29)] - Error parsing signature "alert udp any any -> any 53 (msg:"ET CURRENT_EVENTS DNS BIND 9 Dynamic Update DoS attempt"; byte_test:1,&,40,2; byte_test:1,>,0,5; byte_test:1,>,0,1; content:"|00 00 06|"; distance:8; content:"|c0 0c 00 ff|"; distance:2; reference:cve,2009-0696; classtype:attempted-dos; reference:url,doc.emergingthreats.net/2009701; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_Bind; sid:2009701; rev:3;)" from file /usr/local/etc/suricata/rules/emerging-current_events.rules at line 65
[100072] 20/2/2010 -- 22:20:55 - (detect.c:376)  (SigLoadSignatures) -- 70 rule files processed. 7977 rules succesfully loaded, 5 rules failed
[100072] 20/2/2010 -- 22:20:55 - (detect-engine-sigorder.c:787)  (SCSigOrderSignatures) -- ordering signatures in memory
SCSigOrderSignatures: Total Signatures to be processed by thesigordering module: 7989

Let’s to check to make sure the ids system is logging, check the config file for the logging dir, the default is /var/log/suricata/.  You may have to create a noise rule ( any any -> any any ), but there should start to be alerts hitting the fast.log file.

Now that we know it kinda works, there is some configuration to do in part 3.

Packages needed.

• PCRE
• libyaml
• libnet

Step by step.

cd /usr/ports/devel/pcre/

make install clean

cd /usr/ports/textproc/libyaml/

make install clean

cd /usr/ports/net/libnet/

make install clean

mkdir /usr/local/pkgs/

cd /usr/local/pkgs/

fetch http://www.openinfosecfoundation.org/download/suricata-0.8.1.tar.gz

tar -zvf suricata-0.8.1.tar.gz

cd suricata-0.8.1

./configure && make && make install

Move the config file to somewhere nice

cp suricata.yaml /usr/local/etc/

vi /usr/local/etc/suricata.yaml

Change `default-rule-path: /etc/suricata/rules/` and `classification-file: /etc/suricata/classification.config`, lets put them in the proper place.

/usr/local/etc/suricata/rules/
/usr/local/etc/suricata/etc/classification.config

mkdir /usr/local/etc/suricata/rules

mkdir /var/log/suricata

We can populate the rules folder with something while we are at it.

cd /usr/local/etc/suricata/

fetch http://www.emergingthreats.net/rules/emerging.rules.tar.gz

tar -xvf emerging.rules.tar.gz

You are also going to need some files from the snort ruleset release, go over to snort.org and register.
Get the latest release and unpack it just like the emerging set.

cd /usr/local/etc/suricata/
tar -xvf snortrules-snapshot-2.8.tar.gz

You really don’t need the entire set you just need one file specifically, the classification.config file. But we will pick that up in part 2.