Intrusion Prevention System
The verbose builtin Suricata rules are no longer enabled by default which will create less noise in the logs
This is a welcome feature. But I am curious if there is a toggle somewhere to turn Suricata rules back on? Either as a whole, or individually? If not, is this planned in a future update?
edit: after about 20 minutes since upgrading to 188, I see a Suricata log:
SURICATA STREAM Packet with invalid timestamp
Can someone elaborate on what was changed? I did not expect to see any entries in the IPS logs that were from Suricata.
Reading through the code if I understand it correctly if a variable is set it prints the rules into the appropriate suricata file. The default in the code is for the variable to be =0 which means it is not set so as standard will not have the rules in the file.
This can be easily checked by looking in the appropriate file to see if the rules have been written or not.
I cannot check this as currently I donât have access to a Core Update 188 system.
Adolf and I, we are currently at our annual IPFire Meetup and just after breakfast we fixed this. It is not a missed file, it is just that the file is autogenerated which is not happening on the updated systems.
If you want to change this manually, just hit the Save button on the IPS page and that should regenerate the file and reload Suricata.
@ms, you are right (partly). /var/ipfire/suricata/suricata-used-rulesfiles.yaml is autogenerated. But the generating function in ids-functions.pl doesnât contain the modifications cited by @bonnietwin.
So a save in the WUI doesnât change anything.
Adolf, it is true that the commands of update.sh delete the lines in suricata-used-rulesfiles.yaml. But each modification to the rules ( âcustomize rulesetâ in the WUI ) restores the lines. write_used_rulesfile_file() is called as write_used_rulesfiles_file(@enabled_providers) which generates the lines.
Section âDefault rules for used application layer protocols.â is generated in both cases. The modification you cited suppresses that part.
I have now set up a local vm ipfire and vm green client on my laptop so I will be able to test it out here once the builds are completed so I can do a repeat CU188 update.
It seems that all the Suricata default rules are set to alert other than this one set to drop.
stream-events.rules:drop tcp any any â any any (msg:âSURICATA STREAM 3way handshake toclient data injection suspectedâ; flow:to_client; stream-event:3whs_ack_data_inject; classtype:protocol-command-decode; sid:2210057; rev:1;)
Is there a mechanism to enable this one drop rule while leaving the others disabled?
Now that Iâve had about a week of testing the IPS on CU189, I am even more grateful for the removal of the default Suricata rules. Itâs so nice to actually see meaningful rules without exporting thousands of rules into a spreadsheet and sorting them to separate the wheat from the chaff. Another cool thing is I can also more easily tune the used rulesets because other noisy false rules are more visible and can be selectively disabled.