$OpenBSD: README,v 1.5 2018/09/04 12:46:21 espie Exp $

+-----------------------------------------------------------------------
| Running suricata on OpenBSD
+-----------------------------------------------------------------------

Starting suricata
=================

For normal use, you need to set first your interface and enable the
daemon:

# rcctl enable suricata
# rcctl set suricata flags -i em0

And you need the rules, these rules are expected to be present in the
/etc/suricata/rules directory as defined in
/etc/suricata/suricata.yaml.

Rule management
===============

It is possible to download and install rules manually, but there is a
much easier and quicker way to do so. There are special programs which
you can use for downloading and installing rules.

After installing the new rulesets described below, restart suricata to
pick up the new rules:

# rcctl restart suricata

Note that the installed rules have to be updated regularly by the program
used to fetch them initially. For example use cron to update the rules
every 24h.

suricata-update
---------------

The recommended new way of updating rules is with suricata-update which
is installed with:

# pkg_add suricata-update

Run `suricata-update` to download and install the new rules into
${VARBASE}/suricata/rules/ . Next update the suricata configuration
in ${SYSCONFIDR}/suricata/suricata.yaml to use these rules instead:

default-rule-path: ${VARBASE}/suricata/rules/
rule-files:
    - suricata.rules

Oinkmaster
----------

The other common method is with Oinkmaster which can be installed with:

# pkg_add oinkmaster

There are several rulesets. There is for example Emerging Threats (ET)
Emerging Threats Pro and VRT. In this example we are using Emerging
Threats.

Oinkmaster has to know where the rules an be found. These rules can be
found at:

https://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz

And you can download as follow:

# cd /etc && oinkmaster -C /etc/oinkmaster.conf -o /etc/suricata/rules

Inline mode (IPS)
==================

In order to run suritcata "inline" in Intrusion Prevention mode, the following
needs to be added to `/etc/pf.conf`:

	pass out quick on egress inet proto tcp to port 80 divert-packet port 700

Adjust this to match what traffic suricata will need to inspect as well as the
port to divert to.

To enable inline ipfw mode of suricata on port 700:

# rcctl set suricata flags -d 700

Outbound packets don't have a correct checksum yet due to checksum offloading,
therefore suricata will log "SURICATA TCPv4 invalid checksum" and ignore these
packets. To workaround this set the following in suricata.yaml:

	stream:
	  checksum-validation: yes

Also adjust the configuration to drop packets:

	- drop:
	  enabled: yes

(Re)start suricata for the changes to take effect. Note that ipfw mode is
mutually exclusive with pcap live mode (-i).
