Suricata Custom Ruleset will not Load into `suricata.rules`

Question

I am running Suricata in IDS (af-packet) mode on Ubuntu 20.04.5 LTS (Focal Fossa) and deployed as the root user:

NAME="Ubuntu"
VERSION="20.04.5 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.5 LTS"
VERSION_ID="20.04"

Following the Suricata "Adding your own Rules" Doc, I have added a very basic (for complexity ease when troubleshooting) alerting-rule with first available sid:1000000 from custom rules range:

########### Test Rules #############
alert ssh any any -> xxx.xxx.60.6 !22 (msg:"SSH TRAFFIC on non-SSH port"; flow:to_client, not_established; classtype: misc-attack; target: dest_ip; sid:1000000;)

The .rules file for the local rules has sufficient permissions and matches suricata.rules, owned by root:

ls -halt /var/lib/suricata/rules/
total 22M
-rw-r--r-- 1 root root 3.2K Oct 17 00:00 classification.config
drwxr-x--- 2 root root 4.0K Oct 17 00:00 .
-rw-r--r-- 1 root root  22M Oct 17 00:00 suricata.rules
-rw-r--r-- 1 root root  210 Oct 13 21:45 local.rules

Ensured that the rules are added to Suricata suricata.yaml config and processed is restarted:

cat /etc/suricata/suricata.yaml | grep "rule-files" -A 5 -B 5
##

#default-rule-path: /var/lib/suricata/rules

default-rule-path: /etc/suricata/rules
rule-files:
  - suricata.rules
  - /var/lib/suricata/rules/local.rules
  - /etc/suricata/rules/*.rules

AFAIK, the custom ruleset should be loaded into the suricata.rules file? Therefore, I am running the following verification subject to what I am reporting:

cat /var/lib/suricata/rules/suricata.rules | grep sid:1000000

I can test traffic and verify with tcpdump, matching the rule but never see a signature match in fast.log (which is logging other signature-matching traffic):

cat /var/log/suricata/fast.log | grep 1000000

I see no errors following statup of the service that would indicate an error present:

systemctl status suricata.service
● suricata.service - LSB: Next Generation IDS/IPS
     Loaded: loaded (/etc/init.d/suricata; generated)
     Active: active (running) since Mon 2022-10-17 13:11:39 UTC; 8h ago
       Docs: man:systemd-sysv-generator(8)
    Process: 2184275 ExecStart=/etc/init.d/suricata start (code=exited, status=0/SUCCESS)
      Tasks: 78 (limit: 618963)
     Memory: 25.2G
     CGroup: /system.slice/suricata.service
             └─2184295 /usr/bin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid --af-packet -D -v>

Oct 17 13:11:39 sec3 systemd[1]: Starting LSB: Next Generation IDS/IPS...
Oct 17 13:11:39 sec3 suricata[2184275]: Starting suricata in IDS (af-packet) mode... done.
Oct 17 13:11:39 sec3 systemd[1]: Started LSB: Next Generation IDS/IPS.

Can somebody help me with somewhere I may be silly here?

TYIA!

Answer 1

Suricata will not raise an error for the rules unless he detects that there is some errors in the rules themselves. I'd like also to mention that it can even work without rule files if we use it as a network monitoring solution.

For your question and according to my short experience with Suricata, the file 'Suricata.rules' is actually the concatenation of the rules files found under '/etc/suricata/rules/'. So, I suggest to reset the default-rule-path to '/var/lib/suricata/rules' and move the 'local.rules' file also to that location.

The updated suricata.yaml rules-files section will be:

default-rule-path: /var/lib/suricata/rules
rule-files:
  - suricata.rules
  - local.rules

PS: This question is not updated for more than 2 months. So if this problem is not solved for you, try this suggestion.Otherwise, if you have solved this problem, kindly post the solution so others can benefit of it.