Skip to content

allow to disable/enable ids logs#98

Closed
GrigoriyMikhalkin wants to merge 3 commits into
masterfrom
suricata-ids-config
Closed

allow to disable/enable ids logs#98
GrigoriyMikhalkin wants to merge 3 commits into
masterfrom
suricata-ids-config

Conversation

@GrigoriyMikhalkin
Copy link
Copy Markdown
Contributor

@GrigoriyMikhalkin GrigoriyMikhalkin commented Jun 28, 2021

Changes to allow enabling/disabling IDS logs via firewall resource. By default logs are disabled. Depends on metal-stack/metal-networker#59

@GrigoriyMikhalkin
Copy link
Copy Markdown
Contributor Author

GrigoriyMikhalkin commented Jun 29, 2021 •
edited
Loading

@majst01 One question is left, how should enableIDS flag and resource field work together? At the moment flag is considered as default value(true) and overwritten by resource field(called DisableSuricataIDS) value if it differs.

majst01
majst01 reviewed Jun 30, 2021
View reviewed changes
Comment thread api/v1/firewall_types.go Outdated
// FirewallNetworks holds the networks known at the metal-api for this firewall machine
FirewallNetworks []FirewallNetwork `json:"firewallNetworks,omitempty"`
// DisableSuricataIDS specifies if we need to enable IDS on the firewall machine
DisableSuricataIDS bool `json:"disableSuricataIDS,omitempty"`
Copy link
Copy Markdown
Contributor

@majst01 majst01 Jun 30, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would not put any product names into the firewall resources, also it should be disabled by default if nothing was set, so EnableIDS would be more approriate, WDYT ?

Copy link
Copy Markdown
Contributor Author

@GrigoriyMikhalkin GrigoriyMikhalkin Jun 30, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, i also thought so initially. But currently we have a flag enable-IDS that is set to true by default. It's used for writing IDS stats to Firewall resource. Should we rid of this flag or change it's default value?(potentially, breaking backwards compatibility)

Copy link
Copy Markdown
Contributor

@majst01 majst01 Jun 30, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should remove the flag from main.go, and only rely on the Flag set in the firewall resource. The service will be started by systemd even if a unknown flag is given (needs to be tested).

Copy link
Copy Markdown
Contributor Author

@GrigoriyMikhalkin GrigoriyMikhalkin Jun 30, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@GrigoriyMikhalkin GrigoriyMikhalkin mentioned this pull request Jul 2, 2021
Closed
@GrigoriyMikhalkin GrigoriyMikhalkin force-pushed the suricata-ids-config branch 4 times, most recently from 487b872 to c9db9c1 Compare July 22, 2021 12:06
@github-project-automation github-project-automation Bot moved this to Review in Development Jun 5, 2025
@vknabel
Copy link
Copy Markdown
Contributor

vknabel commented Jun 27, 2025

Stale, closing

@vknabel vknabel closed this Jun 27, 2025
@github-project-automation github-project-automation Bot moved this from Review to Done in Development Jun 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@majst01 majst01 majst01 left review comments

Assignees

No one assigned

Labels

None yet

Projects

Development
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@GrigoriyMikhalkin @vknabel @majst01