thanks!
Suricata Suricata - IDS on AsusWRT Merlin
- Thread starter rgnldo
- Start date
-
- Tags
- asuswrt merlin entware ids suricata
thanks!
default setup and Suricata - IDS/IPS on AsusWRT Merlin setup same log.
18/5/2020 -- 20:26:05 - <Notice> - This is Suricata version 4.1.7 RELEASE
18/5/2020 -- 20:26:05 - <Info> - CPUs/cores online: 2
18/5/2020 -- 20:26:05 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:26:05 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:26:05 - <Info> - fast output device (regular) initialized: fast.log
18/5/2020 -- 20:26:05 - <Info> - Unified2-alert initialized: filename unified2.alert, limit 32 MB
18/5/2020 -- 20:26:05 - <Info> - http-log output device (regular) initialized: http.log
18/5/2020 -- 20:26:05 - <Info> - stats output device (regular) initialized: stats.log
18/5/2020 -- 20:26:05 - <Info> - Syslog output initialized
18/5/2020 -- 20:26:05 - <Info> - eve-log output device (regular) initialized: eve-%Y-%m-%d-%H:%M.json
18/5/2020 -- 20:26:05 - <Info> - 12 rule files processed. 2676 rules successfully loaded, 0 rules failed
18/5/2020 -- 20:26:05 - <Info> - Threshold config parsed: 0 rule(s) found
18/5/2020 -- 20:26:05 - <Info> - 2676 signatures processed. 113 are IP-only rules, 297 are inspecting packet payload, 2378 inspect application layer, 0 are decoder event only
18/5/2020 -- 20:26:06 - <Notice> - AFL mode starting
18/5/2020 -- 20:26:06 - <Notice> - AFL mode starting
18/5/2020 -- 20:26:06 - <Notice> - all 2 packet processing threads, 0 management threads initialized, engine started.
18/5/2020 -- 20:26:07 - <Info> - All AFP capture threads are running.
_____________________________________________________________________
with this setting, the vpn data transfer power is slightly reduced because the suricata is visibly working. I can't test yet if the IPS actually works, but it writes that in the log.
# Runmode the engine should use.
runmode: workers
# Specifies the kind of flow load balancer used by the flow pinned autofp mode.
autofp-scheduler: active-packets
# If set to auto, the variable is internally switched to 'router' in IPS
# mode and 'sniffer-only' in IDS mode.
host-mode: router
# Linux high speed capture support
af-packet:
- interface: eth0
threads: auto
defrag: yes
cluster-type: cluster_flow
cluster-id: 98
copy-mode: ips
copy-iface: br0
buffer-size: 64535
use-mmap: yes
- interface: br0
threads: auto
cluster-id: 97
defrag: yes
cluster-type: cluster_flow
copy-mode: ips
copy-iface: eth0
buffer-size: 64535
use-mmap: yes
18/5/2020 -- 20:44:53 - <Notice> - This is Suricata version 4.1.7 RELEASE
18/5/2020 -- 20:44:53 - <Info> - CPUs/cores online: 2
18/5/2020 -- 20:44:53 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:44:53 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:44:53 - <Info> - Found an MTU of 1500 for 'br0'
18/5/2020 -- 20:44:53 - <Info> - Found an MTU of 1500 for 'br0'
18/5/2020 -- 20:44:53 - <Notice> - using flow hash instead of active packets
18/5/2020 -- 20:44:53 - <Info> - AF_PACKET: Setting IPS mode
18/5/2020 -- 20:44:53 - <Info> - fast output device (regular) initialized: fast.log
18/5/2020 -- 20:44:53 - <Info> - Unified2-alert initialized: filename unified2.alert, limit 32 MB
18/5/2020 -- 20:44:53 - <Info> - http-log output device (regular) initialized: http.log
18/5/2020 -- 20:44:53 - <Info> - stats output device (regular) initialized: stats.log
18/5/2020 -- 20:44:53 - <Info> - Syslog output initialized
18/5/2020 -- 20:44:53 - <Info> - eve-log output device (regular) initialized: eve-%Y-%m-%d-%H:%M.json
18/5/2020 -- 20:44:53 - <Info> - 12 rule files processed. 2676 rules successfully loaded, 0 rules failed
18/5/2020 -- 20:44:53 - <Info> - Threshold config parsed: 0 rule(s) found
18/5/2020 -- 20:44:53 - <Info> - 2676 signatures processed. 113 are IP-only rules, 297 are inspecting packet payload, 2378 inspect application layer, 0 are decoder event only
18/5/2020 -- 20:44:54 - <Info> - AF_PACKET IPS mode activated eth0->br0
18/5/2020 -- 20:44:54 - <Info> - Going to use 2 thread(s)
18/5/2020 -- 20:44:54 - <Notice> - AFL mode starting
18/5/2020 -- 20:44:54 - <Notice> - AFL mode starting
18/5/2020 -- 20:44:54 - <Info> - AF_PACKET IPS mode activated br0->eth0
18/5/2020 -- 20:44:55 - <Info> - Going to use 2 thread(s)
18/5/2020 -- 20:44:55 - <Notice> - AFL mode starting
18/5/2020 -- 20:44:55 - <Info> - Found an MTU of 1500 for 'br0'
18/5/2020 -- 20:44:55 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:44:55 - <Notice> - AFL mode starting
18/5/2020 -- 20:44:55 - <Info> - Found an MTU of 1500 for 'br0'
18/5/2020 -- 20:44:55 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:44:55 - <Notice> - all 4 packet processing threads, 0 management threads initialized, engine started.
18/5/2020 -- 20:44:55 - <Info> - All AFP capture threads are running.
18/5/2020 -- 20:26:05 - <Notice> - This is Suricata version 4.1.7 RELEASE
18/5/2020 -- 20:26:05 - <Info> - CPUs/cores online: 2
18/5/2020 -- 20:26:05 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:26:05 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:26:05 - <Info> - fast output device (regular) initialized: fast.log
18/5/2020 -- 20:26:05 - <Info> - Unified2-alert initialized: filename unified2.alert, limit 32 MB
18/5/2020 -- 20:26:05 - <Info> - http-log output device (regular) initialized: http.log
18/5/2020 -- 20:26:05 - <Info> - stats output device (regular) initialized: stats.log
18/5/2020 -- 20:26:05 - <Info> - Syslog output initialized
18/5/2020 -- 20:26:05 - <Info> - eve-log output device (regular) initialized: eve-%Y-%m-%d-%H:%M.json
18/5/2020 -- 20:26:05 - <Info> - 12 rule files processed. 2676 rules successfully loaded, 0 rules failed
18/5/2020 -- 20:26:05 - <Info> - Threshold config parsed: 0 rule(s) found
18/5/2020 -- 20:26:05 - <Info> - 2676 signatures processed. 113 are IP-only rules, 297 are inspecting packet payload, 2378 inspect application layer, 0 are decoder event only
18/5/2020 -- 20:26:06 - <Notice> - AFL mode starting
18/5/2020 -- 20:26:06 - <Notice> - AFL mode starting
18/5/2020 -- 20:26:06 - <Notice> - all 2 packet processing threads, 0 management threads initialized, engine started.
18/5/2020 -- 20:26:07 - <Info> - All AFP capture threads are running.
_____________________________________________________________________
with this setting, the vpn data transfer power is slightly reduced because the suricata is visibly working. I can't test yet if the IPS actually works, but it writes that in the log.
# Runmode the engine should use.
runmode: workers
# Specifies the kind of flow load balancer used by the flow pinned autofp mode.
autofp-scheduler: active-packets
# If set to auto, the variable is internally switched to 'router' in IPS
# mode and 'sniffer-only' in IDS mode.
host-mode: router
# Linux high speed capture support
af-packet:
- interface: eth0
threads: auto
defrag: yes
cluster-type: cluster_flow
cluster-id: 98
copy-mode: ips
copy-iface: br0
buffer-size: 64535
use-mmap: yes
- interface: br0
threads: auto
cluster-id: 97
defrag: yes
cluster-type: cluster_flow
copy-mode: ips
copy-iface: eth0
buffer-size: 64535
use-mmap: yes
18/5/2020 -- 20:44:53 - <Notice> - This is Suricata version 4.1.7 RELEASE
18/5/2020 -- 20:44:53 - <Info> - CPUs/cores online: 2
18/5/2020 -- 20:44:53 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:44:53 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:44:53 - <Info> - Found an MTU of 1500 for 'br0'
18/5/2020 -- 20:44:53 - <Info> - Found an MTU of 1500 for 'br0'
18/5/2020 -- 20:44:53 - <Notice> - using flow hash instead of active packets
18/5/2020 -- 20:44:53 - <Info> - AF_PACKET: Setting IPS mode
18/5/2020 -- 20:44:53 - <Info> - fast output device (regular) initialized: fast.log
18/5/2020 -- 20:44:53 - <Info> - Unified2-alert initialized: filename unified2.alert, limit 32 MB
18/5/2020 -- 20:44:53 - <Info> - http-log output device (regular) initialized: http.log
18/5/2020 -- 20:44:53 - <Info> - stats output device (regular) initialized: stats.log
18/5/2020 -- 20:44:53 - <Info> - Syslog output initialized
18/5/2020 -- 20:44:53 - <Info> - eve-log output device (regular) initialized: eve-%Y-%m-%d-%H:%M.json
18/5/2020 -- 20:44:53 - <Info> - 12 rule files processed. 2676 rules successfully loaded, 0 rules failed
18/5/2020 -- 20:44:53 - <Info> - Threshold config parsed: 0 rule(s) found
18/5/2020 -- 20:44:53 - <Info> - 2676 signatures processed. 113 are IP-only rules, 297 are inspecting packet payload, 2378 inspect application layer, 0 are decoder event only
18/5/2020 -- 20:44:54 - <Info> - AF_PACKET IPS mode activated eth0->br0
18/5/2020 -- 20:44:54 - <Info> - Going to use 2 thread(s)
18/5/2020 -- 20:44:54 - <Notice> - AFL mode starting
18/5/2020 -- 20:44:54 - <Notice> - AFL mode starting
18/5/2020 -- 20:44:54 - <Info> - AF_PACKET IPS mode activated br0->eth0
18/5/2020 -- 20:44:55 - <Info> - Going to use 2 thread(s)
18/5/2020 -- 20:44:55 - <Notice> - AFL mode starting
18/5/2020 -- 20:44:55 - <Info> - Found an MTU of 1500 for 'br0'
18/5/2020 -- 20:44:55 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:44:55 - <Notice> - AFL mode starting
18/5/2020 -- 20:44:55 - <Info> - Found an MTU of 1500 for 'br0'
18/5/2020 -- 20:44:55 - <Info> - Found an MTU of 1500 for 'eth0'
18/5/2020 -- 20:44:55 - <Notice> - all 4 packet processing threads, 0 management threads initialized, engine started.
18/5/2020 -- 20:44:55 - <Info> - All AFP capture threads are running.
i put the http.log and fast.log files in the syslog-ng conf file to check easily. For now, these two are in one but can be separated if needed. i configured the suricata config myself to delete the contents of http.log when it restarts because it already exists in another location. fast.log may remain as it has few events.
this changed the date format to suit me
syslog-ng.conf
syslog-ng.d
logrotate.d
Code:
- http-log:
enabled: yes
filename: http.log
custom: yes # enable the custom logging format (defined by custom format)
customformat: "%{%Y-%m-%d-%H:%M:%S}t %h[**]%{X-Forwarded-For}i[**]%{User-agent}i[**]%H[**]%m[**]%u[**]%s[**]%B byte[**]%a:%p -> %A:%P"
append: no
extended: no
filetype: regularsyslog-ng.conf
Code:
source src {
unix-dgram("/dev/log" so_rcvbuf(65536) flags(syslog-protocol));
file("/proc/kmsg" program_override("kernel") flags(kernel));
internal();file("/opt/var/log/suricata/http.log" follow-freq(60));
file("/opt/var/log/suricata/fast.log" follow-freq(60));
};syslog-ng.d
Code:
# put messages with 'Suricata IDS/IPS' into /opt/var/log/suricata.log
destination d_suricata {
file("/opt/var/log/suricata.log");
};
filter f_suricata {
message("->");
};
log {
source(src);
filter(f_suricata);
destination(d_suricata);
flags(final);
};
#eoflogrotate.d
Code:
/opt/var/log/suricata.log {
postrotate
/usr/bin/killall -HUP syslog-ng
endscript
}
rgnldo
Very Senior Member
runmode is not like autofp.
you may ignore it yourself if another runmode is set. just a tip.
rgnldo
Very Senior Member
Excellent contribution.
I am trying to port the Oinkmaster, rule Management for Suricata. I'm counting on you.
I am trying to port the Oinkmaster, rule Management for Suricata. I'm counting on you.
tarassippo
Regular Contributor
I do get the same errors and I had a read at https://suricata.readthedocs.io/en/latest/rules/flow-keywords.html but it's too technical for me...
Is it something to be concerned or I can just ignore it ? Does it mean those rules are not working ?
Tia.
heysoundude
Part of the Furniture
while I don't disagree with you, my cursory attention to this thread indicates it's not yet "ready for prime time"...there seems to still be some heavy lifting happening in the background on the part of the people who are working on it for Merlin users. I just put unbound on and am still wrapping my head around that for the time being...if this works as wonderfully (I ran into problems with SkyNet), I'll be a convert.it would be nice to have suricata included in the amtm offerings
rgnldo
Very Senior Member
It is not an error, it has to do with some rule of Suricata, not all, with the verification engine. Nothing serious.
I agree. Initiative came after requests from some members of this forum. I adapted what was possible for an ARM router. It took a while to reach this level.
And for this we are VERY grateful!!
Rgnldo, I have an observation and suggestion(s):
There are a number of suggested tweaks to the yaml floating about - it is hard for us (and you) to know "which" yaml file is being discussed. May I STRONGLY suggest/request that you:
1. update your current yaml file and rename it in the repsitory with "IDS" and a version number as part of the naming convention.
2. upload a second yaml file with the name "IPS" and a version number as part of the naming convention.
Doing this will provide consistent configurations for discussion, and avoid user editing mistakes.
- Users commenting on problems should provide the name of the yaml file (which includes "IPS" or "IDS" and ver. number)
- Get your Merlin box working to your satisfaction, and actually test it. For IPS testing, a "test rule" that blocks outgoing and incoming to/from an http address would be easy for you and users to confirm using both a browser and a ping. Use whatever Merlin configuration you have - though a "plain jane" (no vpns, qos, etc.) configuration would be best.
- Users could learn about suricata while getting the IDS configuration to work (it seems to work now), and then be more useful to you in getting the IPS to work.
- I'm guessing that network interfaces will be a topic of interest on the IPS configuration; perhaps you could include the interface configuration that worked for your plain jane box, along with your ifconfig, followed by a comment to the user to consider changing it.
TIA (Thanks in Advance)
Last edited:
so the current yaml file on github is not set for IPS? only IDS?
For Me, the answer is Yes.
In order to get it to function as IPS, rgnldo suggested the following https://www.snbforums.com/threads/suricata-ids-ips-on-asuswrt-merlin.63280/page-12#post-585513
I applied those changes to my week-old yaml and found that the IDS performance was improved, but IPS still didn't work for me. I downloaded a "fresh" copy of the yaml today, and this time the changes did not work.
FWICT IPS is a work in progress; too many moving parts, IMHO.
New edit. Well dang!..... tested again and while the IPS still doesn't work, the improved IDS did work. I'll post my json file.
Last edited:
So here are the alerts - outgoing and incoming:
{"timestamp":"1969-12-31T19:00:00.939232-0500","flow_id":1025513636254944,"in_iface":"eth0","event_type":"alert","vlan":1,"src_ip":"192.168.1.66","src_port":50437,"dest_ip":"192.0.78.25","dest_port":443,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2500000,"rev":5441,"signature":"ET COMPROMISED Known Compromised or Hostile Host Traffic group 1","category":"Misc Attack","severity":2,"metadata":{"updated_at":["2020_05_22"],"created_at":["2011_04_28"],"signature_severity":["Major"],"tag":["COMPROMISED"],"deployment":["Perimeter"],"attack_target":["Any"],"affected_product":["Any"]}},"flow":{"pkts_toserver":1,"pkts_toclient":0,"bytes_toserver":78,"bytes_toclient":0,"start":"1969-12-31T19:00:00.939232-0500"}}
{"timestamp":"2020-05-24T15:23:29.705370-0400","flow_id":1025513636254944,"in_iface":"eth0","event_type":"alert","vlan":1,"src_ip":"192.0.78.25","src_port":443,"dest_ip":"192.168.1.66","dest_port":50437,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2500000,"rev":5441,"signature":"ET COMPROMISED Known Compromised or Hostile Host Traffic group 1","category":"Misc Attack","severity":2,"metadata":{"updated_at":["2020_05_22"],"created_at":["2011_04_28"],"signature_severity":["Major"],"tag":["COMPROMISED"],"deployment":["Perimeter"],"attack_target":["Any"],"affected_product":["Any"]}},"flow":{"pkts_toserver":1,"pkts_toclient":1,"bytes_toserver":78,"bytes_toclient":70,"start":"1969-12-31T19:00:00.939232-0500"}}
And here is the rule that called for a drop, not an alert (it is on a single line; <> means drop outgoing and/or incoming):
drop ip [103.124.96.14,103.133.111.128,103.138.109.68,103.139.44.159,103.143.208.250,103.214.112.196,103.233.1.218,103.49.133.82,103.79.141.156,103.79.141.158,103.99.1.31,104.131.85.167,104.140.245.39,104.168.44.166,104.197.230.188,104.210.219.82,104.210.222.135,104.214.72.28,104.214.79.240,104.215.144.185,104.236.30.107,104.244.72.115,104.244.73.193,104.244.76.189,104.248.174.224,104.248.243.129,104.248.33.221,104.248.51.123,104.44.135.128,105.235.122.218,192.0.78.25] any <> $HOME_NET any (msg:"ET COMPROMISED Known Compromised or Hostile Host Traffic group 1"; reference:url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts; threshold: type limit, track by_src, seconds 60, count 1; classtype:misc-attack; sid:2500000; rev:5441; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag COMPROMISED, signature_severity Major, created_at 2011_04_28, updated_at 2020_05_22
192.0.78.25 is the address that I tested in the browser.
So in my case rgnldo's latest tweak improved the IDS......, but the "drop" was changed to "alert". (and these tweaks are not in the current yaml file.)
Important to test, IMHO.
Last edited:
Slawek P
Senior Member
Hi, followed the instruction, appears to be starting ok, but I have no /opt/var/log/suricata/suricata.log
Where to enable it in yaml please? Tried syslog: enabled, but that did not do trick.
Slawek P
Senior Member
It runs 4 processes on my machine too totalling 360M - a bit excessive. A stop resulted in core dump.
It is a charming start.
rgnldo
Very Senior Member
I can not. Lack of time. But if you want to fork on github, let me know that I publish with all the credits
Last edited:
rgnldo
Very Senior Member
edit for yes
Code:
- file:
enabled: no
filename: /opt/var/log/suricata/suricata.logwhen I want to test Suricata, I run
Code:
suricata -c /opt/etc/suricata/suricata.yaml --af-packetRan your Test sequence and got this:
<Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] - Unable to find type for iface "": No such device
ruh roh.. where does it pull the interface id? Or is this a variable I need to hardcode?
edit: yes, hardcode. found it, fixed it.
<Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] - Unable to find type for iface "": No such device
ruh roh.. where does it pull the interface id? Or is this a variable I need to hardcode?
edit: yes, hardcode. found it, fixed it.
Last edited:
rgnldo
Very Senior Member
Define the wan interface
err....... nah! I'm old and over the hill. Something like this should be spearheaded by an energetic, young guy - preferably from Brazil - with a powerful, developer's computer.
Similar threads
- Locked
Similar threads
Similar threads
-
amtm amtm 5.0 - the Asuswrt-Merlin Terminal Menu, November 17, 2024- Started by thelonelycoder
- Replies: 61
-
Entware Possible to install jdownloader on asuswrt-merlin router with entware??
- Started by JeyJ
- Replies: 9
-
Skynet SOLVED: Scrollbar Disappears on Skynet Tab on Asuswrt-Merlin 386.14
- Started by WRobertE
- Replies: 10
-
scMerlin scMerlin 2.5.8 - Service and script control menu for Asuswrt-Merlin, October 20, 2024
- Started by thelonelycoder
- Replies: 85
-
uKasa uKasa - A utility script that manages Kasa smart outlets and switches with Asuswrt-Merlin routers- Started by JGrana
- Replies: 29
-
Updated Hue Utility - huetil Control and manage your Hue system from Asuswrt-Merlin or Raspbian
- Started by JGrana
- Replies: 1