Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ubuntu 24.04 containers for Suricata (4.x and newer) and Snort (2.9.16.x and newer) #234

Merged
merged 3 commits into from
Nov 27, 2024
Merged

Ubuntu 24.04 containers for Suricata (4.x and newer) and Snort (2.9.16.x and newer) #234

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4f04e78
Update Dockerfile_snort
da667 Nov 25, 2024
d8a34b3
Update Dockerfile_suricata
da667 Nov 25, 2024
7541351
Update Dockerfile_suricata
da667 Nov 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 12 additions & 11 deletions dalton-agent/Dockerfiles/Dockerfile_snort
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,26 +1,25 @@
# Builds Snort 2.9.x.x Dalton agent using Snort source
# Works for Snort 2.9.1.1 and later; previous versions are more
# nuanced with libraries and compile dependencies so if you need
# a previous version, just build your own.

# Works for Snort 2.9.16.x and later
# hadolint global ignore=DL3003,SC2046

FROM ubuntu:18.04
FROM ubuntu:24.04

ARG SNORT_VERSION
ARG DAQ_VERSION

# tcpdump is for pcap analysis; not *required* for
# the agent but nice to have....
# changed python3.8 to python3 python3-dev python3-pip
# other additional packages: libtool libtirpc-dev
# hadolint ignore=DL3008
RUN apt-get update -y && \
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
python3.8 \
python3 python3-dev python3-pip \
tcpdump \
automake autoconf \
automake libtool autoconf \
build-essential make flex bison \
libpcap-dev libpcre3-dev \
libcap-ng-dev libdumbnet-dev \
libcap-ng-dev libdumbnet-dev libtirpc-dev \
zlib1g-dev liblzma-dev openssl libssl-dev \
libnghttp2-dev libluajit-5.1-dev && \
ldconfig && \
Expand All @@ -34,12 +33,14 @@ RUN apt-get update -y && \
RUN mkdir -p /src/snort-${SNORT_VERSION} && mkdir -p /etc/snort
WORKDIR /src
# DAQ. Apparently DAQ will sometime fail building with multiple make jobs.
# Discovered that autoreconf is necessary to avoid failures compiling DAQ on 24.04
ADD https://www.snort.org/downloads/archive/snort/daq-${DAQ_VERSION}.tar.gz daq-${DAQ_VERSION}.tar.gz
RUN tar -zxf daq-${DAQ_VERSION}.tar.gz && cd daq-${DAQ_VERSION} && ./configure && make && make install
RUN tar -zxf daq-${DAQ_VERSION}.tar.gz && cd daq-${DAQ_VERSION} && autoreconf -f -i && ./configure && make && make install
# Snort
# Necessary to add CFLAGS="-I/usr/include/tirpc" to point snort to the correctly location for the RPC headers it needs
ADD https://www.snort.org/downloads/archive/snort/snort-${SNORT_VERSION}.tar.gz snort-${SNORT_VERSION}.tar.gz
RUN tar -zxf snort-${SNORT_VERSION}.tar.gz -C snort-${SNORT_VERSION} --strip-components=1 && \
cd /src/snort-${SNORT_VERSION} && ./configure --enable-sourcefire --enable-debug --enable-buffer-dump && make -j $(nproc) && make install && \
cd /src/snort-${SNORT_VERSION} && ./configure --enable-sourcefire --enable-debug --enable-buffer-dump CFLAGS="-I/usr/include/tirpc" && make -j $(nproc) && make install && \
mkdir /usr/local/lib/snort_dynamicrules && ldconfig

RUN cp -t /etc/snort/ /src/snort-${SNORT_VERSION}/etc/classification.config /src/snort-${SNORT_VERSION}/etc/file_magic.conf \
Expand All @@ -51,4 +52,4 @@ WORKDIR /opt/dalton-agent
COPY dalton-agent.py /opt/dalton-agent/dalton-agent.py
COPY dalton-agent.conf /opt/dalton-agent/dalton-agent.conf

CMD ["python3.8", "/opt/dalton-agent/dalton-agent.py", "-c", "/opt/dalton-agent/dalton-agent.conf"]
CMD ["python3", "/opt/dalton-agent/dalton-agent.py", "-c", "/opt/dalton-agent/dalton-agent.conf"]
7 changes: 4 additions & 3 deletions dalton-agent/Dockerfiles/Dockerfile_suricata
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,16 @@
# Builds Suricata Dalton agent using Suricata source tarball
FROM ubuntu:18.04
FROM ubuntu:24.04

ARG SURI_VERSION
ARG ENABLE_RUST

# tcpdump is for pcap analysis; not *required* for
# the agent but nice to have....
# hadolint ignore=DL3008
# changing the python3.8 package to python3 python3-dev and python3-pip
RUN apt-get update -y && \
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
python3.8 \
python3 python3-dev python3-pip \
tcpdump \
libpcre3 libpcre3-dbg libpcre3-dev libnss3-dev \
build-essential autoconf automake libtool libpcap-dev libnet1-dev \
Expand Down Expand Up @@ -52,4 +53,4 @@ COPY tls.lua /opt/dalton-agent/tls.lua

RUN sed -i 's/REPLACE_AT_DOCKER_BUILD-VERSION/'"${SURI_VERSION}"'/' /opt/dalton-agent/dalton-agent.conf

CMD ["python3.8", "/opt/dalton-agent/dalton-agent.py", "-c", "/opt/dalton-agent/dalton-agent.conf"]
CMD ["python3", "/opt/dalton-agent/dalton-agent.py", "-c", "/opt/dalton-agent/dalton-agent.conf"]
Loading