allow to disable/enable ids logs #98
Conversation
|
@majst01 One question is left, how should |
GrigoriyMikhalkin
force-pushed
the
suricata-ids-config
branch
from
d27c7cf to
5974842
Compare
api/v1/firewall_types.go
Outdated
| @@ -79,6 +79,8 @@ type Data struct { | |||
| EgressRules []EgressRuleSNAT `json:"egressRules,omitempty"` | |||
| // FirewallNetworks holds the networks known at the metal-api for this firewall machine | |||
| FirewallNetworks []FirewallNetwork `json:"firewallNetworks,omitempty"` | |||
| // DisableSuricataIDS specifies if we need to enable IDS on the firewall machine | |||
| DisableSuricataIDS bool `json:"disableSuricataIDS,omitempty"` | |||
There was a problem hiding this comment.
I would not put any product names into the firewall resources, also it should be disabled by default if nothing was set, so EnableIDS would be more approriate, WDYT ?
There was a problem hiding this comment.
Yep, i also thought so initially. But currently we have a flag enable-IDS that is set to true by default. It's used for writing IDS stats to Firewall resource. Should we rid of this flag or change it's default value?(potentially, breaking backwards compatibility)
There was a problem hiding this comment.
We should remove the flag from main.go, and only rely on the Flag set in the firewall resource. The service will be started by systemd even if a unknown flag is given (needs to be tested).
GrigoriyMikhalkin
force-pushed
the
suricata-ids-config
branch
4 times, most recently
from
487b872 to
c9db9c1
Compare
GrigoriyMikhalkin
force-pushed
the
suricata-ids-config
branch
from
c9db9c1 to
7c9f627
Compare
Changes to allow enabling/disabling IDS logs via firewall resource. By default logs are disabled. Depends on metal-stack/metal-networker#59