Sign inSign up

cifranix/suricata

By cifranix

•Updated over 7 years ago

An image contianing suricata version 4.1.2

Image
0

260

cifranix/suricata repository overview

⁠Suricata 4.1.2 Docker Image

https://gitlab.com/Cifranic/docker_suricata⁠

⁠Directions for centos7

⁠declare what interface will be monitoring traffic; for me it is ens37

export interface=ens37

⁠First configure Host interface to run in promiscuous mode. Enter your host password if using vmware fusion.

ip link set ${interface} promisc on

Then make it permanent

touch /etc/sysconfig/network-scripts/ifcfg-${interface}

echo TYPE=Ethernet > /etc/sysconfig/network-scripts/ifcfg-${interface}
echo DEVICE=${interface} >> /etc/sysconfig/network-scripts/ifcfg-${interface}
echo IPADDR=none >> /etc/sysconfig/network-scripts/ifcfg-${interface}
echo PROMISC=yes >> /etc/sysconfig/network-scripts/ifcfg-${interface}
echo BOOTPROTO=none >> /etc/sysconfig/network-scripts/ifcfg-${interface}
echo ONBOOT=yes >> /etc/sysconfig/network-scripts/ifcfg-${interface}

systemctl restart network

Create folders to be shared with the container on host mkdir -p /mnt/docker-share/suricata/{etc,logs}

If running selinux on the host, to ensure that the shared volume is accessible by the container

chcon  -R -t svirt_sandbox_file_t /mnt/docker-share/suricata/etc
chcon  -R -t svirt_sandbox_file_t /mnt/docker-share/suricata/logs

⁠How to run the container

docker run --name suricata -d --net=host 
-v /mnt/docker-share/suricata/logs/:/var/log/suricata/ 
-v /mnt/docker-share/suricata/etc/:/etc/suricata/ 
docker.io/cifranix/suricata:4.1.2 
bash -c "/usr/bin/suricata -c /etc/suricata/suricata.yaml -i ens37 --init-errors-fatal"

... Where ens37 is your PROMISCUOUS interface on the host

Tag summary

Content type

Image

Digest

Size

396.9 MB

Last updated

over 7 years ago

docker pull cifranix/suricata:4.1.2-rules