alright.... made a dockerfile for "suricata-indev".

[da_667@infosec.exchange]

Canonical DDOS is affecting my dockerfiles for Dalton. They use ubuntu as the base for installing and compiling Suricata containers.

Looks like I'm pioneering debian:latest containers today.

Trixie removed libpcre3 from the package list, so that means I have to acuire and compile pcre8.45 from sourceforge in order to compile successfully. Feels grody, but whatever.

[cr0w@infosec.exchange]

@da_667 Sourceforge? Wear gloves.

[huronbikes@cyberplace.social]

@da_667 oh jeez, pcre is a build dependency for Suricata?

[da_667@infosec.exchange]

@huronbikes technically no, but it is a dependency for hyperscan, which is a library that improves PCRE performance for Suricata greatly. And also, I think pcre is required for snort 2.9.x, which I am still required to support.

[huronbikes@cyberplace.social]

@da_667 yowza.

[astraleureka@social.treehouse.systems]

@cR0w @da_667 does sf still dump all of the projects into the same filesystem and fail to prevent different project accounts from touching each others files? project account homedirs being 777 by default was certainly an amusing choice

[cr0w@infosec.exchange]

@astraleureka @da_667 No idea but that's hilarious.

[astraleureka@social.treehouse.systems]

@cR0w @da_667 I may or may not have used it to snag some database dumps from a certain game project when I was a kid, and I may or may not have cracked those hashes to get an admins account and unban myself from their forums

[cr0w@infosec.exchange]

@astraleureka @da_667

[huronbikes@cyberplace.social]

@da_667 I don't know if it would be of interest to you but I am trying to set up a Suricata build docker container using Alpine.

[da_667@infosec.exchange]

@huronbikes interesting

[huronbikes@cyberplace.social]

@da_667 https://codeberg.org/huronbikes/suricata-docker/src/branch/main/build/Dockerfile

It's a start, so far it builds on my local machine. To be truly useful, I would need to figure out packaging the build artifacts and creating a target image to actually run Suricata.

[huronbikes@cyberplace.social]

@da_667 I'll have to do some work getting hyperscan going for that too. I did the initial cut on my m3 mac so I'll have to deal with processor-architecture specific things since hyperscan appears to be amd64 only.

[da_667@infosec.exchange]

@huronbikes you want to look into vectorscan. That's multi-arch.