Suricata-IDS on CentOS 7.2 running, but show me some errors

Help
1

Hello,
I installed Suricata-IDS in IPS mode on CentOS 7.2 and I have some questions:
1- I’m using a VPS and when I use “ifconfig” command then it just show me my web server IP:

# ifconfig
ens160: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet X.X.X.X  netmask 255.255.255.0  broadcast X.X.X.X
        inet6 2a05:9a00:1:16:250:56ff:fe85:99db  prefixlen 64  scopeid 0x0<global>
        inet6 2a05:9a00:1:14:250:56ff:fe85:99db  prefixlen 64  scopeid 0x0<global>
        inet6 2a05:9a00:1:a:250:56ff:fe85:99db  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::250:56ff:fe85:99db  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:85:99:db  txqueuelen 1000  (Ethernet)
        RX packets 15568442  bytes 1226226617 (1.1 GiB)
        RX errors 0  dropped 24656  overruns 0  frame 0
        TX packets 1876925  bytes 4480593897 (4.1 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 13454  bytes 43398584 (41.3 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 13454  bytes 43398584 (41.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

To configure Suricata-IDS, what are the values of HOME_NET and EXTERNAL_NET ? Both are same?

2- My direct.xml file has below contents, can it make any conflict?

# cat /etc/firewalld/direct.xml
<?xml version="1.0" encoding="utf-8"?>
<direct>
<rule priority="0" table="filter" ipv="ipv4" chain="INPUT_direct">-p tcp --dport 80 -m state --state NEW -m recent --set</rule>
<rule priority="1" table="filter" ipv="ipv4" chain="INPUT_direct">-p tcp --dport 80 -m state --state NEW -m recent --update --seconds 60 --hitcount 30 -j REJECT --reject-with tcp-reset</rule>
</direct>

3- Suricata service is running, but show me some errors:

# systemctl status suricata
● suricata.service - Suricata Intrusion Detection Service
   Loaded: loaded (/usr/lib/systemd/system/suricata.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2021-01-13 01:02:40 +0330; 9s ago
     Docs: man:suricata(1)
  Process: 5921 ExecStartPre=/bin/rm -f /var/run/suricata.pid (code=exited, status=0/SUCCESS)
 Main PID: 5922 (Suricata-Main)
   CGroup: /system.slice/suricata.service
           └─5922 /sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid -q 0

Jan 13 01:02:41 MyServer.com suricata[5922]: 13/1/2021 -- 01:02:41 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing sign...t|127\.0
Jan 13 01:02:41 MyServer.com suricata[5922]: 13/1/2021 -- 01:02:41 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - no addresses left ...ddresses
Jan 13 01:02:41 MyServer.com suricata[5922]: 13/1/2021 -- 01:02:41 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing sign...tent:"/n
Jan 13 01:02:41 MyServer.com suricata[5922]: 13/1/2021 -- 01:02:41 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - no addresses left ...ddresses
Jan 13 01:02:41 MyServer.com suricata[5922]: 13/1/2021 -- 01:02:41 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing sign...p_uri; f
Jan 13 01:02:41 MyServer.com suricata[5922]: 13/1/2021 -- 01:02:41 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - no addresses left ...ddresses
Jan 13 01:02:41 MyServer.com suricata[5922]: 13/1/2021 -- 01:02:41 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing sign...ttp_meth
Jan 13 01:02:41 MyServer.com suricata[5922]: 13/1/2021 -- 01:02:41 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - no addresses left ...ddresses
Jan 13 01:02:41 MyServer.com suricata[5922]: 13/1/2021 -- 01:02:41 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing sign...method; 
Jan 13 01:02:46 MyServer.com suricata[5922]: 13/1/2021 -- 01:02:46 - <Notice> - all 6 packet processing threads, 4 management threads initi...started.
Hint: Some lines were ellipsized, use -l to show in full.

And:
https://paste.ubuntu.com/p/GBhZ8Vdczw/
Why?

4- I changed configuration as below and after it, I can’t connect to server:

vars:
  # more specific is better for alert accuracy and performance
  address-groups:
    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
    #HOME_NET: "[192.168.0.0/16]"
    #HOME_NET: "[10.0.0.0/8]"
    #HOME_NET: "[172.16.0.0/12]"
    #HOME_NET: "any"

    EXTERNAL_NET: "!$HOME_NET"
    #EXTERNAL_NET: "any"

    HTTP_SERVERS: "!$HOME_NET"

Thank you.

2

Your issue is the line with HTTP_SERVERS: "!$HOME_NET.
There are several rules in the ET ruleset that start with alert http any any -> [$HTTP_SERVERS,$HOME_NET] .......
That will not work when HTTP_SERVERS are set to be not HOME_NET.
I would recommend just setting HTTP_SERVERS to HOME_NET or removing all rules using HTTP_SERVERS.

1 Like
3

How about the values of HOME_NET and EXTERNAL_NET ? As I said, it is a VPS and I just have public IP.