Suricata Suricata - IDS on AsusWRT Merlin

[QuikSilver]

suricata is not compatible with adaptiveqos/flexqos. it is compatible with cake/skynet.

i use: skynet/diversion/cake/unbound/suricata.
are you positively sure that you need flexqos and that cake is not enough?
i can stream 4k/webex/upload/download/zoom with cake without issues

I'm sure I could get by with cakeQOS but I feel like flexqos gives me more flexability and insight into my network.

 

[SuperDuke]

There are two possibilities, either your WAN is configured incorrectly or your device does not support it.

Quite bizarre as I'm on a AC3100 which I would think is supported. And given that I am able to access the internet, I can only presume my WAN is configured just fine....I did enter eth0 in the .yaml file line as directed. That's too bad!

 

[JGrana]

I have an unusual situation... I have a Raspberry Pi with an attached GPS board and I use this as a high precision (Stratum 1) NTP server. Being a good Open Source citizen, my Pi is part of the ntp.pool.org (I port forward UDP port 123).
As a result, my fast.log gets loaded with this message:

ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x03 [**] [Classification: Attempted Denial of Service] [Priority: 2]

This is a widely known issue - but harmless.

So my question is, is there a way to filter this message?

 

[jata]

you can check for threats detected in /opt/var/log/suricata/fast.log

also if you read through the thread there are instructions on out to get the logs going with syslog/logrotate so you can see it on the router's webgui

Hi - I am trying to follow the post/info in there thread to get the logs integrated with syslog and scribe but I'm struggling. Can you repost instructions in a simplistic way please?

 

[jata]

I have had Suricata running for 24hrs with cake, diversion and Skynet - everything seems to be working but I have no entries in fast.log.

The stats.log and http.log are both updating so I think it is all working but no threats detected as I think skynet is picking them up first. Is this a reasonable assumption?

I will temporarily disable Skynet to test my theory...

 

[rgnldo]

So my question is, is there a way to filter this message?

It is not being blocked. It is a suspected activity. It's like a flip. It is recommended to leave it. Suricata is doing its job.
You can configure Suricata for DROP fins only.

 

[rgnldo]

I have had Suricata running for 24hrs with cake, diversion and Skynet - everything seems to be working but I have no entries in fast.log.

The stats.log and http.log are both updating so I think it is all working but no threats detected as I think skynet is picking them up first. Is this a reasonable assumption?

I will temporarily disable Skynet to test my theory...

There is no need to do any procedure. There is no detection to display fast.log. Suricata is working well.

 

[Smokey613]

I ran FreshJR then FlexQoS, both do a good job. IMHO, if you can live without the colorful graphs, Cake is the way to go. I dumped all the TM stuff and now run the scripts listed in my signature. I could not be more satisfied with the results.

 

[ugandy]

I have had Suricata running for 24hrs with cake, diversion and Skynet - everything seems to be working but I have no entries in fast.log.

The stats.log and http.log are both updating so I think it is all working but no threats detected as I think skynet is picking them up first. Is this a reasonable assumption?

I will temporarily disable Skynet to test my theory...

skynet/diversion catch a lot of stuff

 

[jata]

skynet/diversion catch a lot of stuff

Thanks. looks like it is all working well so thanks everybody contributing - much appreciated.

My last setup/config task is to include suricata log entries in the webUI / scribe...

 

[ttgapers]

@rgnldo think it's time to start building out an installer for this bad boy?

 

[ugandy]

@rgnldo think it's time to start building out an installer for this bad boy?

@Martineau already did a basic one. check the thread.

 

[Smokey613]

mkdir /jffs/addons 2>/dev/null;mkdir /jffs/addons/suricata 2>/dev/null; curl -kL https://pastebin.com/raw.php?i=XhNumLMU -o /jffs/addons/suricata/suricata_manager.sh  && chmod 755 "/jffs/addons/suricata/suricata_manager.sh" && dos2unix /jffs/addons/suricata/suricata_manager.sh;/jffs/addons/suricata/suricata_manager.sh

After install run this command to see your options.

suricata_manager -h

 

[ttgapers]

@Martineau already did a basic one. check the thread.

mkdir /jffs/addons 2>/dev/null;mkdir /jffs/addons/suricata 2>/dev/null; curl -kL https://pastebin.com/raw.php?i=XhNumLMU -o /jffs/addons/suricata/suricata_manager.sh  && chmod 755 "/jffs/addons/suricata/suricata_manager.sh" && dos2unix /jffs/addons/suricata/suricata_manager.sh;/jffs/addons/suricata/suricata_manager.sh

After install run this command to see your options.

suricata_manager -h

Catching up...still had my manual install instructions!

 

[rgnldo]

@Martineau already did a basic one. check the thread.

I'm running out of time right now. Feel free to organize a fork or release.

 

[JGrana]

It is not being blocked. It is a suspected activity. It's like a flip. It is recommended to leave it. Suricata is doing its job.
You can configure Suricata for DROP fins only.

Thanks @rgnldo I will write a sed script to filter them periodically...
If only people would move to chrony ;-)

 

[New2This]

I have set my WAN to ppp0.( do I need to put in any numbers or just ppp0) Its still not able to start any ideas?

admin@RT-AX88U-E960:/tmp/home/root# suricata_manager check

v1.03 Suricata IDS/IPS Manager.....

30/6/2020 -- 10:54:22 - <Info> - Running suricata under test mode
30/6/2020 -- 10:54:22 - <Info> - Configuration node 'defrag' redefined.
Warning: Output_interface not supplied by user.  Falling back on default_output_interface "Console"
30/6/2020 -- 10:54:22 - <Notice> - This is Suricata version 4.1.8 RELEASE
30/6/2020 -- 10:54:22 - <Info> - CPUs/cores online: 4
30/6/2020 -- 10:54:22 - <Warning> - [ERRCODE: SC_WARN_DEFAULT_WILL_CHANGE(317)] - in 5.0 the default for decoder event stats will go from 'decoder.<proto>.<event>' to 'decoder.event.<proto>.<event>'. See ticket #2225. To suppress this message, set stats.decoder-events-prefix in the yaml.
30/6/2020 -- 10:54:22 - <Info> - fast output device (regular) initialized: fast.log
30/6/2020 -- 10:54:22 - <Info> - stats output device (regular) initialized: stats.log
30/6/2020 -- 10:54:22 - <Info> - Syslog output initialized
30/6/2020 -- 10:54:22 - <Info> - 17 rule files processed. 2329 rules successfully loaded, 0 rules failed
30/6/2020 -- 10:54:22 - <Info> - Threshold config parsed: 0 rule(s) found
30/6/2020 -- 10:54:22 - <Info> - 2329 signatures processed. 204 are IP-only rules, 443 are inspecting packet payload, 1761 inspect application layer, 0 are decoder event only
30/6/2020 -- 10:54:24 - <Notice> - Configuration provided was successfully loaded. Exiting.
30/6/2020 -- 10:54:24 - <Info> - cleaning up signature grouping structure... complete

admin@RT-AX88U-E960:/tmp/home/root# suricata_manager start

v1.03 Suricata IDS/IPS Manager.....

Starting suricata... already running.

 

[ttgapers]

I'm running out of time right now. Feel free to organize a fork or release.

Same here, once I get the time assuming @Martineau is game on "where" we host it, I can get it going on Github. Seems like Cake-QOS is on it's own path now!

 

[ugandy]

Same here, once I get the time assuming @Martineau is game on "where" we host it, I can get it going on Github. Seems like Cake-QOS is on it's own path now!

i did a manual install, so i've not tested @Martineau script yet. does it handle setup of syslog/logrotate, etc?

 

[ttgapers]

i did a manual install, so i've not tested @Martineau script yet. does it handle setup of syslog/logrotate, etc?

Not sure. I also install manually as well for said reasons above, as i've been playing with Suricata since @rgnldo started posting about. So real early adopter here...so lots more customizations under the hood like syslog/logrotate files that I posted here...

Cheers!