ANN: sys-ips

Hi there.

I just tested and it is working on my PC without problem.
I encourage everybody to try and report bugs.
https://github.com/control-owl/suriGUI

Idea is to integrate Suricata IPS in Qubes 4.1 and be able to still use Qubes Firewall.

This is short process of my Salt:

  1. Download debian-11-minimal (if not exist)
  2. Clone debian-11-minimal as sys-ips-template
  3. Install suriGUI in sys-ips-template
  4. Create new Qube: sys-ips
  5. Start sys-ips

After starting sys-ips you will see a new icon in Sys-Tray
Screenshot_2021-12-21_22-59-41

You can Start and Stop Suricata IPS.
For now there are not so much settings, progress will be done.

To start exploring, check my repo:
https://github.com/control-owl/suriGUI

and my Salt:
https://github.com/control-owl/suriGUI/tree/main/salt

7 Likes

After reviewing code, i’ll help testing.
Good project!

Looks interesting, thanks for sharing!

Is sys-ips -when it’s working- replacing sys-firewall ? Or can/should I still use it via

sys-net > sys-ips > sys-firewall > …qubes…

?

Nice addition for anyone who is brave enough to run Windows stuff – at least now we can see what happens there!

See how I did this before without the GUI:
http://zrubi.hu/en/2017/traffic-analysis-qubes/

3 Likes

Meanwhile we are using selinux who created by NSA, could be a long discussion but let’s forget it.

hi.
you do not need sys-firewall.
at least I do not see any use of if after installing sys-ips.
traffic will go to suricata, and there it will be processed.
If you want to block access to hosts, you can do it in firewall in qube, or globally in sys-ips

I based my GUI on your idea @Zrubi

I read it many times.

Tnx man

1 Like