blob: 8353d5547d564c04c28cfbb6ed0a488732885c70 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
{ lib, pkgs, ... }:
{
name = "suricata";
meta.maintainers = with lib.maintainers; [ felbinger ];
nodes = {
ids = {
networking.interfaces.eth1 = {
useDHCP = false;
ipv4.addresses = [
{
address = "192.168.1.2";
prefixLength = 24;
}
];
};
# disable suricata-update because this requires an Internet connection
systemd.services.suricata-update.enable = false;
# install suricata package to make suricatasc program available
environment.systemPackages = with pkgs; [ suricata ];
services.suricata = {
enable = true;
reloadOnRulesetUpdate = true;
settings = {
vars.address-groups.HOME_NET = "192.168.1.0/24";
unix-command.enabled = true;
outputs = [ { fast.enabled = true; } ];
af-packet = [ { interface = "eth1"; } ];
classification-file = "${pkgs.suricata}/etc/suricata/classification.config";
};
};
# create suricata.rules with the rule to detect the output of the id command
systemd.tmpfiles.rules = [
''f /var/lib/suricata/rules/suricata.rules 644 suricata suricata 0 alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2019_07_26;)''
];
};
helper = {
imports = [ ../modules/profiles/minimal.nix ];
networking.interfaces.eth1 = {
useDHCP = false;
ipv4.addresses = [
{
address = "192.168.1.1";
prefixLength = 24;
}
];
};
services.nginx = {
enable = true;
virtualHosts."localhost".locations = {
"/id/".return = "200 'uid=0(root) gid=0(root) groups=0(root)'";
};
};
networking.firewall.allowedTCPPorts = [ 80 ];
};
};
testScript = ''
start_all()
# check that configuration has been applied correctly with suricatasc
with subtest("suricata configuration test"):
ids.wait_for_unit("suricata.service")
assert '1' in ids.wait_until_succeeds("suricatasc -c 'iface-list' | ${pkgs.jq}/bin/jq .message.count", 5)
# test detection of events based on a static ruleset (output of id command)
with subtest("suricata rule test"):
helper.wait_for_unit("nginx.service")
ids.wait_for_unit("suricata.service")
ids.succeed("curl http://192.168.1.1/id/")
assert "id check returned root [**] [Classification: Potentially Bad Traffic]" in ids.succeed("tail -n 1 /var/log/suricata/fast.log"), "Suricata didn't detect the output of id comment"
with subtest("suricata blocking reload test"):
ids.wait_for_unit("suricata.service")
assert ids.systemctl("start suricata-blocking-reload.service")[0] == 0
'';
}
|
