From patchwork Fri Mar 1 01:28:05 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tremer X-Patchwork-Id: 2100 Return-Path: Received: from mail01.ipfire.org (mail01.i.ipfire.org [172.28.1.200]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail01.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web07.i.ipfire.org (Postfix) with ESMTPS id 83BE788B0B9 for ; Thu, 28 Feb 2019 14:28:41 +0000 (GMT) Received: from mail01.i.ipfire.org (localhost [IPv6:::1]) by mail01.ipfire.org (Postfix) with ESMTP id 449FKN2yBxz5KvHC; Thu, 28 Feb 2019 14:28:40 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201801; t=1551364120; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references:list-id: list-unsubscribe:list-subscribe:list-post; bh=WDfP3sE86GsPiGwqI3qC9BUN7ycXwy1F422WJvEOUq4=; b=z6yAuQEkf2LmhIQYg+Q82Ku0Swv15pBx0LWCttFIOEZzYWb2+g3BLu3Cg1ljyoHz0U8mDA JbhYIDGNEbxFr60BdO0LwONk4nDEE7inEgVzwv7SB0iKy5bWSmRAnpls97oQ0lmDIRR6Ja ZzsZjp9bWJrFQvYkvjczgizQDaFfHYnVfqzbR3XMO/j+qZibFGTGFn5T8eNwHeVv3qcQ7r Nes0whVSvK8xc3sEZPvEPlLGSrKzxWnFB9TrFcIikd5Lvfa+Wreo620j/l06NkcrTs5EOm 1o97FGJiVNGdDDRx1I4SF4NrVvaNF3Iw7iLI8mUeKoBs9GCsmCN7pWhUJUZpJA== Received: from ipfire.tremer.co.uk (unknown [88.215.19.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 449FKJ5pn1z5KvGj; Thu, 28 Feb 2019 14:28:36 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201801; t=1551364117; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=WDfP3sE86GsPiGwqI3qC9BUN7ycXwy1F422WJvEOUq4=; b=saJmHte7FpaILRDkhlKanQF9QvInXWRRNJZw01bSFZEdZ2O3KOqM3SXWQeZRU2YHwq6i1k F6WHLUnfIRyNUCvZe1MNSSPg9sdorWCPiNwVryoiI/K1NANbxm0oKdHMV0UQekpsQJlVXT W3mJqJrJaK3H5UKRnYi4w28N04qiFB1AQHUxipLydxIDWNeVOtjJzaYeUc8pX23n6MAZ2S XdcsXMfIp5AZe4VoDmKmatYrN5Kc6tIQuc/P042k6RnhW6DEWKwabuAt+xh9dtg6Ym44sQ XG715F8T5r9unwxbKbpmpMnaQzMaBuZG2ABYyYOutJmQGMo6+tJXctEypK9ZTg== From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 00/20] Suricata Configuration Updates Date: Thu, 28 Feb 2019 14:28:05 +0000 Message-Id: <20190228142825.5153-1-michael.tremer@ipfire.org> X-Mailer: git-send-email 2.12.2 Authentication-Results: mail01.ipfire.org; auth=pass smtp.auth=ms smtp.mailfrom=michael.tremer@ipfire.org X-Spamd-Result: default: False [-4.44 / 11.00]; TO_DN_SOME(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; RCVD_COUNT_ZERO(0.00)[0]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:31655, ipnet:88.215.0.0/18, country:GB]; BAYES_HAM(-3.00)[100.00%]; ARC_NA(0.00)[]; FROM_HAS_DN(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; DKIM_SIGNED(0.00)[]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM(-2.34)[-0.781,0]; RCVD_TLS_ALL(0.00)[] X-Spam-Status: No, score=-4.44 X-Rspamd-Server: mail01.i.ipfire.org Cc: Michael Tremer X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" I have worked on suricata's configuration. My objective was to use more system resources (because suricata did not use much RAM, etc.) to make it faster and to be able to have some deeper decoding and matching. Please review these changes and let me know what you think. All in all, suricata should not use more than 1G of RAM which I think is a very good amount. If your system is weaker than that, there is no point in running an IPS. On my system in my office, this runs with a hand full of rules enabled from the Emerging Threats Community set at around 110MB of RAM. Michael Tremer (20): Revert "Suricata: detect DNS events on port 853, too" suricata: Set max-pending-packets to 1024 suricata: Set default packet size to 1514 suricata: Set detection profile to high suricata: Drop profiling section from configuration suricata: Drop some commented stuff from configuration suricata: Drop sections that require Rust suricata: Configure HTTP decoder suricata: Allow 32MB of RAM for DNS decoding suricata: Drop parsers I have never heard of suricata: We do not use any IP reputation lists suricata: Log to syslog suricata: Use the correct path for the magic database suricata: Use 64MB of RAM for defragmentation suricata: Use up to 256MB of RAM for the flow cache suricata: Log to syslog like a normal process suricata: Increase memory size for the stream engine suricata: Disable decoding for Teredo suricata: Start capture first and then load rules suricata: Fix syntax error config/etc/syslog.conf | 2 +- config/suricata/suricata.yaml | 282 +++++------------------------------------- 2 files changed, 30 insertions(+), 254 deletions(-)