v0.43.0 — optional Suricata IDS

Update both sides: Huginn, and the honeypot (update-honeypot.sh). Suricata itself is optional and stays off until you turn it on.

New

• Optional Suricata IDS on the honeypot. One command installs and starts it: ./update-honeypot.sh --suricata-on (or install-honeypot.sh --suricata). It matches the traffic to the honeypot against the free Emerging Threats Open rules (about 52,000) and Huginn names known attacks by rule and CVE.
  • Nothing to set up in your router. Suricata runs on the honeypot and only listens on its own network card: no mirror port, never blocks anything. Your admin SSH is left out (this machine's address and port, in each direction).
  • Where it shows: a card IDS alerts on each attacker page, Campaigns › IDS alerts with a page per rule and the addresses that tripped it, and Settings › Honeypot (on, running, age of the rules, last 7 days). A severity 1 rule (an attack) adds 3 to the score and tags the attacker ids-alert; scans and information are shown but not scored.
  • Locked down: only alerts on traffic to the honeypot are exported, as a few fixed fields (no payloads). Suricata drops root to its own user after opening the network card, runs in a systemd sandbox that cannot see /home, and is capped at 900 MB of memory. Its log folder stays root's.
  • Rules: updated daily when the honeypot has internet. Without internet, download emerging.rules.tar.gz elsewhere and load it with --suricata-rules FILE. New rules are always tested with the installed Suricata first and swapped in as a whole; the previous set is kept and comes back if Suricata does not start.
  • Needs about 500 MB of memory: give the honeypot 2 GB. See Suricata IDS (optional) in the README.
• Help has a section on IDS alerts; the JSON export of an attacker includes its IDS alerts.

Reviewed twice by a second AI (Codex) before release; the findings, including a capture filter that an attacker could have dodged by connecting from the admin port number, are fixed.

Update

On Huginn: cd Huginn && git pull && sudo ./update-huginn.sh (or the new huginn_all.deb / Docker image).
On the honeypot: cd Huginn && git pull && sudo ./update-honeypot.sh, then optionally sudo ./update-honeypot.sh --suricata-on.