Suricata: Konfigurasi Dasar - Revision history

Onnowpurbo: /* Interface */

2023-07-09T09:13:57Z

Interface

Onnowpurbo: /* Interface */

2023-07-09T09:10:25Z

Interface

Onnowpurbo: /* Interface */

2023-07-09T09:10:10Z

Interface

Onnowpurbo at 07:26, 7 July 2023

2023-07-07T07:26:11Z

Onnowpurbo: /* Referensi */

2020-03-30T03:41:53Z

Referensi

Onnowpurbo: /* Auto setup */

2015-06-03T07:54:29Z

Auto setup

Onnowpurbo at 07:52, 3 June 2015

2015-06-03T07:52:12Z

Onnowpurbo at 07:50, 3 June 2015

2015-06-03T07:50:19Z

Onnowpurbo at 07:09, 3 June 2015

2015-06-03T07:09:57Z

Onnowpurbo at 07:03, 3 June 2015

2015-06-03T07:03:57Z

@@ Line 83: / Line 83: @@
 Untuk melihat apakah mesin bekerja dengan benar dan menerima serta memeriksa lalu lintas, masukkan:
-   cd /var/log/surikata
+   cd /var/log/suricata
 Diikuti oleh:

@@ Line 79: / Line 79: @@
   sudo suricata -c /etc/suricata/suricata.yaml -i enp0s3 --init-errors-fatal
-Kita bisa mengganti wlan0, dengan nama interface yang kita inginkan.
+Kita bisa mengganti wlan0, dengan nama interface yang kita inginkan seperti enp0s3
 Untuk melihat apakah mesin bekerja dengan benar dan menerima serta memeriksa lalu lintas, masukkan:

@@ Line 76: / Line 76: @@
 Tes untuk cek kesalahan sangat disarankan --init-errors-fatal
-  sudo suricata -c /etc/suricata/suricata.yaml -i wlan0 --init-errors-fatal
+ sudo suricata -c /etc/suricata/suricata.yaml -i wlan0 --init-errors-fatal
 Kita bisa mengganti wlan0, dengan nama interface yang kita inginkan.
@@ Line 95: / Line 96: @@
   tail -f http.log stats.log
 ==Referensi==

@@ Line 25: / Line 25: @@
   ./configure && make && make install-rules
-The make install-rules option will do the regular "make install" and it automatically downloads and sets up the latest ruleset from Emerging Threats available for Suricata.
+Opsi make install-rules akan melakukan "make install" biasa dan secara otomatis mengunduh dan mengatur set aturan terbaru dari Emerging Threats yang tersedia untuk Suricata.
   ./configure && make && make install-full
-The make install-full option combines everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata
+Opsi make install-full menggabungkan semua yang disebutkan di atas (install-conf dan install-rules) - dan akan memberi Anda Suricata yang siap dijalankan (dikonfigurasi dan diatur)
-==Setting variables==
+==Setting variable==
-Make sure every variable of the vars, address-groups and port-groups in the yaml file is set correctly for your needs. A full explanation is available in the Rule vars section of the yaml. You need to set the ip-address(es) of your local network at HOME_NET. It is recommended to set EXTERNAL_NET to !$HOME_NET. This way, every ip-address but the one set at HOME_NET will be treated as external. It is also possible to set EXTERNAL_NET to 'any', only the recommended setting is more precise and lowers the chance that false positives will be generated. HTTP_SERVERS, SMTP_SERVERS, SQL_SERVERS, DNS_SERVERS and TELNET_SERVERS are by default set to HOME_NET. AIM_SERVERS is by default set at 'any'. These variables have to be set for servers on your network. All settings have to be set to let it have a more accurate effect.
+Pastikan setiap variabel vars, grup alamat, dan grup port dalam file yaml diatur dengan benar untuk kebutuhan Anda. Penjelasan lengkap tersedia di bagian Rule vars dari yaml. Anda perlu menset alamat ip jaringan lokal Anda di HOME_NET. Disarankan untuk mengatur EXTERNAL_NET ke !$HOME_NET. Dengan cara ini, setiap alamat ip kecuali yang ditetapkan di HOME_NET akan diperlakukan sebagai eksternal. Dimungkinkan juga untuk mengatur EXTERNAL_NET ke 'any', hanya pengaturan yang disarankan lebih tepat dan menurunkan kemungkinan false positive akan dihasilkan. HTTP_SERVERS, SMTP_SERVERS, SQL_SERVERS, DNS_SERVERS dan TELNET_SERVERS secara default disetel ke HOME_NET. AIM_SERVERS secara default ditetapkan pada 'any'. Variabel ini harus diset untuk server di jaringan Anda. Semua pengaturan harus diatur agar memiliki efek yang lebih akurat.
-Next, make sure the following ports are set to your needs: HTTP_PORTS, SHELLCODE_PORTS, ORACLE_PORTS and SSH_PORTS.
+Selanjutnya, pastikan port berikut sudah diatur sesuai kebutuhan Anda: HTTP_PORTS, SHELLCODE_PORTS, ORACLE_PORTS, dan SSH_PORTS.
-Finally, set the host-os-policy to your needs. See Host OS Policy in the yaml for a full explanation.
+Terakhir, atur kebijakan host-os sesuai kebutuhan Anda. Lihat Kebijakan Host OS di yaml untuk penjelasan lengkap.
   windows:[]
@@ Line 53: / Line 53: @@
   windows2k3: []
-or just download and untar the ruleset in a directory of your choosing (or yaml config setting) from here:
+==Rule Management dengan Oinkmaster==
 http://rules.emergingthreats.net/open/suricata/
-or if you prefer you can download and use a VRT ruleset.
+atau jika mau, Anda dapat mengunduh dan menggunakan kumpulan aturan VRT.
-It is recommended to update your rules frequently. Emerging Threats is modified daily, VRT is updated weekly or multiple times a week.
+Disarankan untuk sering memperbarui aturan Anda. Ancaman yang Muncul diubah setiap hari, VRT diperbarui setiap minggu atau beberapa kali seminggu.
-To check the available interface cards, enter:
+==Interface==
- ifconfig
+Untuk memeriksa interface yang tersedia, masukkan:
-Now you can see which one you would like Suricata to use.
+  ifconfig
-To start the engine and include the interface card of your preference, enter:
+Sekarang Anda dapat melihat Suricata mana yang ingin Anda gunakan.
- sudo suricata -c /etc/suricata/suricata.yaml -i wlan0 --init-errors-fatal
+Untuk menyalakan mesin dan menyertakan interface pilihan Anda, masukkan:
-Instead of wlan0, you can enter the interface card of your preference.
+  sudo suricata -c /etc/suricata/suricata.yaml -i wlan0 --init-errors-fatal
-To see if the engine is working correctly and receives and inspects traffic, enter:
+Kita bisa mengganti wlan0, dengan nama interface yang kita inginkan.
- cd /var/log/suricata
+Untuk melihat apakah mesin bekerja dengan benar dan menerima serta memeriksa lalu lintas, masukkan:
-Followed by:
+  cd /var/log/surikata
   tail http.log
-And:
+Dan:
   tail -n 50 stats.log
-To make sure the information displayed is up-dated in real time, use the -f option before http.log and stats.log:
+Untuk memastikan informasi yang ditampilkan diperbarui secara real time, gunakan opsi -f sebelum http.log dan stats.log:
   tail -f http.log stats.log

← Older revision		Revision as of 03:41, 30 March 2020
Line 103:		Line 103:

	* https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Basic_Setup		* https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Basic_Setup
		+
		+	==Pranala Menarik==
		+
		+	* [[Suricata]]
		+	* [[Suricata (software)]]
		+	* [[Suricata: Instalasi di Ubuntu]]
		+	* [[Suricata: Instalasi di Ubuntu 18.04]]
		+	* [[Suricata: Konfigurasi Minimal Ubuntu 18.04]]
		+	* [[Suricata: Test DDoS Attack]]
		+	* [[Suricata: Konfigurasi Dasar]]
		+	* [[Suricata: Manajemen Rule dengan Oinkmaster]]
		+	* [[Suricata: Instalasi Snorby & barnyard2]]

@@ Line 17: / Line 17: @@
 ==Auto setup==
-You can also use the available auto setup features of Suricata:
+Kita juga dapat menggunakan fitur auto setup Suricata:
   ./configure && make && make install-conf
-The make install-conf option will do the regular "make install" and then automatically create/setup all the necessary directories and suricata.yaml.
+Ini akan install-conf membuat "make install" regular dan secara automatis create/setup semua directory dan suricata.yaml yang dibutuhkan.
 ./configure && make && make install-rules

@@ Line 1: / Line 1: @@
-When using Debian or FreeBSD, make sure you enter all commands as root/super-user because for these operating systems it is not possible to use 'sudo' without installing and configuring it first.
+Buat directory log Suricata
   sudo mkdir /var/log/suricata
+Untuk menyiapkan sistem sebelum menggunakannya, tulis
   sudo mkdir /etc/suricata
-The next step is to copy classification.config, reference.config and suricata.yaml from the base build/installation directory (ex. from git it will be the oisf directory) to the /etc/suricata directory. Do so by entering the following:
+Selanjutnya copy classification.config, reference.config dan suricata.yaml dari directory build/installation ke directory /etc/suricata . Lakukan hal berikut ini.
   sudo cp classification.config /etc/suricata
@@ Line 16: / Line 13: @@
   sudo cp suricata.yaml /etc/suricata
-Note: if you have experience with Snort or have an existing Snort setup, check out the Snort.conf to Suricata.yaml guide.
+Catatan: jika anda mempunyai pengalaman dengan Snort dan mempunyai setup Snort, bandingkan Snort.conf ke Suricata.yaml .
 ==Auto setup==
 You can also use the available auto setup features of Suricata:
   ./configure && make && make install-conf

@@ Line 5: / Line 5: @@
 Start with creating a directory for Suricata's log information.
-sudo mkdir /var/log/suricata
+ sudo mkdir /var/log/suricata
 To prepare the system for using it, enter:
-sudo mkdir /etc/suricata
+ sudo mkdir /etc/suricata
 The next step is to copy classification.config, reference.config and suricata.yaml from the base build/installation directory (ex. from git it will be the oisf directory) to the /etc/suricata directory. Do so by entering the following:
-sudo cp classification.config /etc/suricata
+ sudo cp classification.config /etc/suricata
-sudo cp reference.config /etc/suricata
+ sudo cp reference.config /etc/suricata
-sudo cp suricata.yaml /etc/suricata
+ sudo cp suricata.yaml /etc/suricata
 Note: if you have experience with Snort or have an existing Snort setup, check out the Snort.conf to Suricata.yaml guide.
@@ Line 36: / Line 36: @@
 The make install-full option combines everything mentioned above (install-conf and install-rules) - and will present you with a ready to run (configured and set up) Suricata
 Setting variables
@@ Line 44: / Line 45: @@
 Finally, set the host-os-policy to your needs. See Host OS Policy in the yaml for a full explanation.
-  windows:[]
+ windows:[]
-  bsd: []
+ bsd: []
-  bsd-right: []
+ bsd-right: []
-  old-linux: []
+ old-linux: []
-  linux: [10.0.0.0/8, 192.168.1.100, "8762:2352:6241:7245:E000:0000:0000:0000"]
+ linux: [10.0.0.0/8, 192.168.1.100, "8762:2352:6241:7245:E000:0000:0000:0000"]
-  old-solaris: []
+ old-solaris: []
-  solaris: ["::1"]
+ solaris: ["::1"]
-  hpux10: []
+ hpux10: []
-  hpux11: []
+ hpux11: []
-  irix: []
+ irix: []
-  macos: []
+ macos: []
-  vista: []
+ vista: []
-  windows2k3: []
+ windows2k3: []
 Note that bug #499 may prevent you from setting old-linux, bsd-right and old-solaris right now.
@@ Line 73: / Line 74: @@
 To check the available interface cards, enter:
-ifconfig
+ ifconfig
 Now you can see which one you would like Suricata to use.
@@ Line 80: / Line 81: @@
 Tests for errors rule Very recommended --init-errors-fatal
-sudo suricata -c /etc/suricata/suricata.yaml -i wlan0 --init-errors-fatal
+ sudo suricata -c /etc/suricata/suricata.yaml -i wlan0 --init-errors-fatal
 Instead of wlan0, you can enter the interface card of your preference.
@@ Line 86: / Line 87: @@
 To see if the engine is working correctly and receives and inspects traffic, enter:
-cd /var/log/suricata
+ cd /var/log/suricata
 Followed by:
-tail http.log
+ tail http.log
 And:
-tail -n 50 stats.log
+ tail -n 50 stats.log
 To make sure the information displayed is up-dated in real time, use the -f option before http.log and stats.log:
-tail -f http.log stats.log
+ tail -f http.log stats.log