gru/routeros-suricata-tzsp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

worked poc

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-08-14 11:33:01 +02:00
parent adfdb0b86c
commit fc3a2944b2
94 changed files with 2931 additions and 3412 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+29 -3
View File
@@ -14,12 +14,21 @@ RUN printf '%s\n' \
&& apt-get install -y --no-install-recommends \
ca-certificates \
iproute2 \
passwd \
python3 \
suricata \
suricata-update \
tini \
&& if ! getent group suricata >/dev/null 2>&1; then groupadd --system suricata; fi \
&& if ! id -u suricata >/dev/null 2>&1; then useradd --system --gid suricata --home-dir /var/lib/suricata --no-create-home --shell /usr/sbin/nologin suricata; fi \
&& getent passwd suricata >/dev/null \
&& getent group suricata >/dev/null \
&& suricata --build-info >/dev/null \
&& suricata-update -V \
&& suricata-update update-sources \
&& suricata-update \
&& mkdir -p /opt/ids/vendor-rules-seed \
&& cp -a /var/lib/suricata/. /opt/ids/vendor-rules-seed/ \
&& apt-get clean \
&& rm -rf \
/var/lib/apt/lists/* \
@@ -33,10 +42,17 @@ WORKDIR /opt/ids
COPY app /opt/ids/app
COPY scripts /opt/ids/scripts
COPY suricata/local.rules /opt/ids/suricata/local.rules
COPY suricata /opt/ids/suricata
RUN chmod +x /opt/ids/scripts/*.sh \
&& mkdir -p /data /var/log/suricata /var/lib/suricata/rules /run/suricata
&& mkdir -p /data /var/log/suricata /var/lib/suricata/rules /run/suricata /tmp/suricata-build-test \
&& suricata -T \
-c /etc/suricata/suricata.yaml \
-l /tmp/suricata-build-test \
-s /opt/ids/suricata/local.rules \
--set 'vars.address-groups.HOME_NET=[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]' \
&& rm -rf /tmp/suricata-build-test \
&& chown -R suricata:suricata /var/log/suricata /var/lib/suricata /run/suricata
ENV PYTHONUNBUFFERED=1 \
TZSP_BIND=0.0.0.0 \
@@ -47,9 +63,19 @@ ENV PYTHONUNBUFFERED=1 \
WEB_PORT=8080 \
DB_PATH=/data/ids.db \
EVE_PATH=/var/log/suricata/eve.json \
SURICATA_LOCAL_RULES=/data/suricata/local.rules \
SURICATA_EXTRA_RULES_GLOB=/data/suricata/*.rules \
SURICATA_CUSTOM_RULES=/data/suricata/custom.rules \
SURICATA_THRESHOLD_CONFIG=/data/suricata/threshold.config \
ALERT_MAX_SEVERITY=2 \
ALERT_DEDUP_WINDOW_SECONDS=300 \
ALERT_IGNORE_SIDS=1000001 \
AUTO_BLOCK=false \
UPDATE_RULES_ON_START=false
UPDATE_RULES_ON_START=false \
RULE_UPDATE_INTERVAL_HOURS=24
EXPOSE 37008/udp 8080/tcp
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD ["python3", "/opt/ids/scripts/healthcheck.py"]
ENTRYPOINT ["/usr/bin/tini", "--", "/opt/ids/scripts/entrypoint.sh"]