Autogenerated on 2012-11-29
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Debian_Installation


Debian Installation


Pre-installation requirements

Before you can build Suricata for your system, run the following command to
ensure that you have everything you need for the installation.
Make sure you will enter all the following commands as root/super-user,
otherwise it will not work.

  apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \
  build-essential autoconf automake libtool libpcap-dev libnet1-dev \
  libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev \
  pkg-config

Depending on the current status of your system, it may take a while to complete
this process.

HTP

HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.

IPS

By default, Suricata works as an IDS. If you want to use it as a IDS and IPS
program, enter:

  apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-
  dev libnfnetlink0


Suricata

To download and build Suricata, enter the following:

  wget http://www.openinfosecfoundation.org/download/suricata-1.3.3.tar.gz
  tar -xvzf suricata-1.3.3.tar.gz
  cd suricata-1.3.3

Compile and install the program
If you plan to build Suricata with IPS capabilities, enter:

  ./configure --enable-nfqueue --prefix=/usr --sysconfdir=/etc --
  localstatedir=/var

instead of

  ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var

Continue with the next commands:

  ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
  make
  make install

To make sure the existing list with libraries will be updated with the new
library, enter:

  ldconfig


Auto setup

You can also use the available auto setup features of Suricata:
ex:

     ./configure && make && make install-conf

make install-conf
would do the regular "make install" and then it would automatically create/
setup all the necessary directories and suricata.yaml for you.

     ./configure && make && make install-rules

make install-rules
would do the regular "make install" and then it would automatically download
and set up the latest ruleset from Emerging Threats available for Suricata

     ./configure && make && make install-full

make install-full
would combine everything mentioned above (install-conf and install-rules) - and
will present you with a ready to run (configured and set up) Suricata
Please continue with the Basic_Setup.