How to start suricata service in NFQ-mode at boot time (Debian/Linux)

Help
1
  • Suricata version: 7.0.5
  • Operating system and/or Linux distribution: Debian 12.5 (Bookworm)
  • Installed via apt (bookworm-backports)

I am setting up Suricata on a fresh Debian 12 install and I am configuring it in IPS mode with NFQ.

What config-file do I have to edit to make it start in NFQ mode?

(it runs fine if initiated manually from CLI directly with -q 0 flags, but I am looking for a way to accomplish this when the service starts at boot time).

I have already made sure /etc/default/suricata contains line LISTENMODE=nfqueue and is set to yes as suggested here.

I am unable to decipher the script in /etc/init.d/suricata to solve this.

2

Unfortunately these variables in /etc/default have been made obsolete in 2016. AF_PACKET is now the preselected (and hardcoded) mode in the Suricata package’s systemd unit file. The init.d scripts are no longer used in recent Debian versions, AFAIK. Systemd is the way to go.

It’s not a good idea to directly edit the package systemd unit file (/lib/systemd/system/suricata.service) though, since it will be overwritten with each package update.
If you want, you can override the command line in the packaged systemd unit file using systemd’s drop-in feature. Just create a file /etc/systemd/system/suricata.service.d/override.conf with the following content:

[Service]
ExecStart=
ExecStart=/usr/bin/suricata -D -q 0 -c /etc/suricata/suricata.yaml --pidfile /run/suricata.pid

This overrides the default AF_PACKET start by first clearing the previous ExecStart directive and then sets a new one, which you can now tailor as you wish.
Then run

sudo systemctl daemon-reload

and then

sudo systemctl restart suricata

which will then use the overridden command line (note the Drop-In field):

$ sudo systemctl status suricata
* suricata.service - Suricata IDS/IDP daemon
     Loaded: loaded (/lib/systemd/system/suricata.service; enabled; preset: enabled)
    Drop-In: /etc/systemd/system/suricata.service.d
             `-override.conf
     Active: active (running) since Mon 2024-05-13 21:39:15 CEST; 2min 27s ago
       Docs: man:suricata(8)
             man:suricatasc(8)
             https://suricata.io/documentation/
   Main PID: 1748 (Suricata-Main)
      Tasks: 16 (limit: 1595)
        CPU: 38.062s
     CGroup: /system.slice/suricata.service
             `-1748 /usr/bin/suricata -D -q 0 -c /etc/suricata/suricata.yaml --pidfile /run/suricata.pid

This is expected to be upgrade-safe since it does not touch the original packaged unit file.

3

I’ll also take this as an incentive to remove these from the packaging at some point to avoid further confusion.

4

This seems to work. Thank you very much!