mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-10-26 18:24:45 +00:00
620a909657
PROBLEM (see #487) - ET rule files start with the "emerging-*" prefix; - ETPRO rule files do not start with that prefix. SOLUTION Concatenate all rule files, with the exception of "*disabled.rules", into a single rule file at "/etc/suricata/rules/tpotce.rules" I have left as-is the "sed" command that enables all commented-out rules. Since that is usually done for performance reasons, maybe it could be turned into a configuration option like the OINKCODE. Another thing worth considering is to use "suricata-update" instead: https://suricata-update.readthedocs.io/en/latest/quickstart.html
35 lines
1 KiB
Docker
35 lines
1 KiB
Docker
FROM alpine:edge
|
|
#
|
|
# Include dist
|
|
ADD dist/ /root/dist/
|
|
#
|
|
# Install packages
|
|
RUN apk -U --no-cache add \
|
|
ca-certificates \
|
|
curl \
|
|
file \
|
|
hiredis \
|
|
libcap \
|
|
wget \
|
|
suricata && \
|
|
#
|
|
# Setup user, groups and configs
|
|
addgroup -g 2000 suri && \
|
|
adduser -S -H -u 2000 -D -g 2000 suri && \
|
|
chmod 644 /etc/suricata/*.config && \
|
|
cp /root/dist/suricata.yaml /etc/suricata/suricata.yaml && \
|
|
cp /root/dist/*.bpf /etc/suricata/ && \
|
|
#
|
|
# Download the latest EmergingThreats ruleset, replace rulebase and enable all rules except disabled ones
|
|
cp /root/dist/update.sh /usr/bin/ && \
|
|
chmod 755 /usr/bin/update.sh && \
|
|
update.sh OPEN && \
|
|
#
|
|
# Clean up
|
|
rm -rf /root/* && \
|
|
rm -rf /tmp/* && \
|
|
rm -rf /var/cache/apk/*
|
|
#
|
|
# Start suricata
|
|
STOPSIGNAL SIGINT
|
|
CMD SURICATA_CAPTURE_FILTER=$(update.sh $OINKCODE) && exec suricata -v -F $SURICATA_CAPTURE_FILTER -i $(/sbin/ip address | grep '^2: ' | awk '{ print $2 }' | tr -d [:punct:])
|