Alex-Devera/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-05-14 12:18:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

drop root privileges for suricata

Browse source
This commit is contained in:
t3chn0m4g3 2022-03-08 17:29:03 +00:00
parent 02d4d79a60
commit 22904d402a
2 changed files with 11 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
docker/suricata/Dockerfile
View file

@ -1,7 +1,7 @@
FROM alpine:3.15 FROM alpine:edge
# #
# Include dist # Include dist
ADD dist/ /root/dist/ COPY dist/ /root/dist/
# #
# Install packages # Install packages
RUN apk -U --no-cache add \ RUN apk -U --no-cache add \
@ -16,16 +16,18 @@ RUN apk -U --no-cache add \
# Setup user, groups and configs # Setup user, groups and configs
addgroup -g 2000 suri && \ addgroup -g 2000 suri && \
adduser -S -H -u 2000 -D -g 2000 suri && \ adduser -S -H -u 2000 -D -g 2000 suri && \
chmod 644 /etc/suricata/*.config && \
cp /root/dist/*.yaml /etc/suricata/ && \ cp /root/dist/*.yaml /etc/suricata/ && \
cp /root/dist/*.conf /etc/suricata/ && \ cp /root/dist/*.conf /etc/suricata/ && \
cp /root/dist/*.bpf /etc/suricata/ && \ cp /root/dist/*.bpf /etc/suricata/ && \
cp /root/dist/update.sh /usr/bin/ && \
chmod 644 /etc/suricata/*.config && \
chmod 755 -R /var/lib/suricata && \
chmod 755 /usr/bin/update.sh && \
chown -R root:suri /tmp /run && \
# #
# Download the latest EmergingThreats OPEN ruleset # Download the latest EmergingThreats OPEN ruleset
cp /root/dist/update.sh /usr/bin/ && \
chmod 755 /usr/bin/update.sh && \
suricata-update update-sources && \ suricata-update update-sources && \
suricata-update --no-reload && \ suricata-update --no-test --no-reload && \
# #
# Clean up # Clean up
rm -rf /root/* && \ rm -rf /root/* && \

6
docker/suricata/dist/suricata.yaml vendored
View file

@ -988,9 +988,9 @@ asn1-max-frames: 256
## ##
# Run Suricata with a specific user-id and group-id: # Run Suricata with a specific user-id and group-id:
#run-as: run-as:
# user: suri user: suri
# group: suri group: suri
# Some logging modules will use that name in event as identifier. The default # Some logging modules will use that name in event as identifier. The default
# value is the hostname # value is the hostname