Eclectic Security

Few days ago the OISF development team has announced the Suricata 1.0.4 release, a large number of (potential) issues have been fixed along with the update of LibHTP to version 0.2.6.

Fixes

- LibHTP updated to 0.2.6
- Large number of (potential) issues fixed after a source code scan with Coverity generously contributed by RedHat.
- Large number of (potential) issues fixed after source code scans with the Clang static analyzer.

In this post, I’m gonna explain how to upgrade  Suricata to version 1.0.4 on Smooth-Sec, you can choose to compile Suricata by your own, or to pull the precompiled debian package from my Gitorius repository.

1) Download and install Suricata (Easy way)

#/etc/init.d/suricata stop
#cd /root/
Make a backup of the existing configuration.
#cp -a /etc/suricata /etc/suricata-1.1beta2
#git clone git://gitorious.org/smooth-sec/suricata_104.git
#cd suricata_104/
#cp suricata.yaml /etc/suricata
#dpkg -i suricata_1.0.4-1_i386.deb

Check the the CurrentVersion

#suricata -V
[8360] 26/6/2011 -- 15:04:20 - (suricata.c:429)  (main) -- This is Suricata version 1.0.4 (rev )

This is Suricata version 1.0.4 (rev )

start suricata

#/etc/init.d/suricata start &

or better reboot the machine.

#reboot

2) Compile Suricata (Complicated way).

#wget http://www.openinfosecfoundation.org/download/suricata-1.0.4.tar.gz
#tar xvfz suricata-1.0.4.tar.gz
#cd suricata-1.0.4/
#./configure --enable-nfqueue

Suricata Configuration:
  NFQueue support:          yes
  IPFW support:             no
  PF_RING support:          no
  Prelude support:          no
  Unit tests enabled:       no
  Debug output enabled:     no
  Debug validation enabled: no
  CUDA enabled:             no
  DAG enabled:              no
  Profiling enabled:        no
  GCC Protect enabled:      no
  GCC march native enabled: yes
  GCC Profile enabled:      no
  Unified native time:      no
  Non-bundled htp:          no

#make
#checkinstall
#cp -a /etc/suricata /etc/suricata-1.1beta2
#cp cp suricata.yaml /etc/suricata
Please edit the /etc/suricata/suricata.yaml according with your own environmet.
#dpkg -i suricata_1.0.4-1_i386.deb

Start suricata
#/etc/init.d/suricata start &
or better, reboot the machine.
#reboot