Mastering Proxmox - Third Edition

Installing/configuring Suricata

We can install Suricata in a Proxmox node using the following command:

    # apt-get install suricata  

After Suricata is installed, we have to load the netfilter queue subsystem's nfnetlink_queue module using the following command:

    # modprobe nfnetlink  

To ensure that this module gets loaded automatically whenever the node is rebooted, we need to add it to the /etc/modules file. The installer installs all the necessary files for Suricata, including Oinkmaster rules. All IDS/IPS engines are heavily dependent on rules. These rules are precompiled and prepackaged in rule files. Oinkmaster is a script that allows us to easily update and manage rules. It is mainly used by Snort but is also supported by Suricata. Without ...