random936/dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated suricata to now work with port mirroring

Browse Source
This commit is contained in:
Random936 2025-02-26 15:47:27 -08:00
parent b4ec2af71d
commit 3a3303e822
3 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
config/assets/suricata.yaml
View File

@ -42,7 +42,7 @@ stats:
enabled: yes enabled: yes
af-packet: af-packet:
- interface: enp6s18 - interface: enp6s19
use-mmap: yes use-mmap: yes
tpacket-v3: yes tpacket-v3: yes
cluster-id: 99 cluster-id: 99

4
config/logging.nix
View File

@ -11,6 +11,8 @@
}) })
]; ];
networking.firewall.enable = false;
users.users.logging = import ./user.nix; users.users.logging = import ./user.nix;
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
@ -193,7 +195,7 @@
serviceConfig = { serviceConfig = {
type = "simple"; type = "simple";
User = "logging"; User = "logging";
ExecStart = "${pkgs.suricata}/bin/suricata -c /etc/suricata.yaml -i enp6s18"; ExecStart = "${pkgs.suricata}/bin/suricata -c /etc/suricata.yaml -i enp6s19";
Restart = "on-failure"; Restart = "on-failure";
CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN"; CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN";
AmbientCapabilities = "CAP_NET_RAW CAP_NET_ADMIN"; AmbientCapabilities = "CAP_NET_RAW CAP_NET_ADMIN";

2
hardware/logging.nix
View File

@ -31,7 +31,7 @@
# still possible to use this option, but it's recommended to use it in conjunction # still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`. # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true; networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp6s18.useDHCP = lib.mkDefault true; #networking.interfaces.enp6s19.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
} }