【Suricata】01-基于debian11、12安装Suricata 7.0.0

目录

1.源码包安装

1.1 安装依赖

1.2 编译安装

1.3 通用配置选项

1.4 编译安装suricata

1.4.1 v7.0.0/7.0.2/v7.0.3安装

2.二进制包安装

---

1.源码包安装

从源发行版文件进行安装可以最大程度地控制Suricata的安装。

1.1 安装依赖

# 最小依赖安装
apt-get install build-essential libpcap-dev   \
                libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
                libcap-ng-dev libcap-ng0 make libmagic-dev         \
                libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \
                python-yaml rustc cargo libpcre2-dev libnuma-dev dpdk-dev libmaxminddb-dev liblz4-dev

# 推荐依赖安装
# Installed Rust and cargo as indicated above
apt-get install autoconf automake build-essential ccache clang curl git \
                gosu jq libbpf-dev libcap-ng0 libcap-ng-dev libelf-dev \
                libevent-dev libgeoip-dev libhiredis-dev libjansson-dev \
                liblua5.1-dev libmagic-dev libnet1-dev libpcap-dev \
                libpcre2-dev libtool libyaml-0-2 libyaml-dev m4 make \
                pkg-config python3 python3-dev python3-yaml sudo zlib1g \
                zlib1g-dev libnuma-dev dpdk-dev libmaxminddb-dev cargo
cargo install --force cbindgen  # 安装比较费时，且需rust在1.64版本及以上

默认的suricata工作模式是IDS，如果想工作在IPS，需要安装如下软件包：

apt-get install libnetfilter-queue-dev libnetfilter-queue1  \
                libnetfilter-log-dev libnetfilter-log1      \
                libnfnetlink-dev libnfnetlink0

1.2 编译安装

下载Suricata源码：

地址：