There's no such thing as a stupid question, but they're the easiest to answer.
JoinTour
Login
Search
Linux and Unix
Tag Cloud
access acer asus bios bsod computer crash drive driver drivers error ethernet excel freeze games gaming graphics hard drive hardware hdmi internet laptop malware memory monitor motherboard netgear network printer problem ram random registry router slow software sound trojan usb video virus vista wifi windows windows 7 windows 7 32 bit windows 7 64 bit windows xp wireless xbox
Search
Search for:
Tech Support Guy Forums > Operating Systems > Linux and Unix >
PSAD: Intrusion Detection for iptables (firewall)

Reply  
Thread Tools
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
21-Feb-2008, 11:14 AM #1
PSAD: Intrusion Detection for iptables (firewall)
PSAD or Port Scan Attack Detector is a collection of three lightweight system daemons (two main daemons and one helper daemon) that run on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic. A typical deployment is to run psad on the iptables firewall where it has the fastest access to log data.

PSAD information is here including Download, Documentation, Features, Source Code, and Mailing List links.

PSAD is designed to work with ipchains Linux kernels 2.2.x, and iptables in Linux kernels 2.4.x and later to detect port scans.

PSAD features a set of highly configurable danger thresholds (with sensible defaults provided), verbose alert messages that include the source, destination, scanned port range, begin and end times, tcp flags and corresponding nmap options (Linux 2.4.x kernels only), reverse DNS info, email alerting, and automatic blocking of offending ip addresses via dynamic configuration of ipchains/iptables firewall rulesets. In addition, for the 2.4.x kernels psad incorporates many of the tcp signatures included in Snort to detect highly suspect scans.

Note the Linux Firewalls book here which can be purchased there at a 30% discount.

-- Tom

P.S. I highly recommend consulting the Widpedia Netfilter/iptables webpage here for more information about iptables, esp. diagrams at the bottom of the webpage.
__________________
The independence created by philosophical insight is - in my opinion - the mark of distinction
between a mere artisan or specialist and a real seeker after truth. - Einstein 1944
Imagination is more important than knowledge. - Einstein

Last edited by lotuseclat79; 21-Feb-2008 at 12:09 PM..
meox's Avatar
Computer Specs
Member with 53 posts.
 
Join Date: Jan 2008
Experience: Advanced
21-Feb-2008, 12:43 PM #2
hmm.. interesting a firewall for linux i thought linux was ok without anything.. but i was wrong i guessi will check it out later
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
21-Feb-2008, 12:50 PM #3
Hi meox,

Linux kernels have the firewall, yes, but if you do nothing to activate firewall rules, then you are truly running naked on the Internet. Depending on where you surf, and whether or not you are port scanned and subsequently compromised - which can happen within 20 seconds of connecting to the Internet - at least Linux is somewhat safer than Windows.

-- Tom
__________________
The independence created by philosophical insight is - in my opinion - the mark of distinction
between a mere artisan or specialist and a real seeker after truth. - Einstein 1944
Imagination is more important than knowledge. - Einstein
tomdkat's Avatar
Computer Specs
Distinguished Member with 7,127 posts.
 
Join Date: May 2006
Location: S.F. Bay Area, CA
Experience: Intermediate
21-Feb-2008, 01:54 PM #4
Quote:
Originally Posted by lotuseclat79 View Post
PSAD or Port Scan Attack Detector is a collection of three lightweight system daemons (two main daemons and one helper daemon) that run on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic. A typical deployment is to run psad on the iptables firewall where it has the fastest access to log data.

PSAD information is here including Download, Documentation, Features, Source Code, and Mailing List links.
Thanks for the info!

Peace...
WARnux's Avatar
Computer Specs
Member with 78 posts.
 
Join Date: Jun 2007
Experience: Advanced
23-Feb-2008, 02:49 PM #5
I checked my package manager and psad is there. I use Debian. Other distros probably have it as well.
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
23-Feb-2008, 03:34 PM #6
Quote:
Originally Posted by WARnux View Post
I checked my package manager and psad is there. I use Debian. Other distros probably have it as well.
Hi WARnux,

Yeah, I did also, but found out that the package manager one was not the latest version. This indicates that the repository is not-up-to-date re that package.

-- Tom
TeckniX's Avatar
Computer Specs
Junior Member with 1 posts.
 
Join Date: May 2008
Experience: Intermediate
27-May-2008, 01:37 PM #7
I keep getting an error about the following from psad:
[psad-error] Exceeded max disk utilization for /var/log/psad on localhost

I've got more than 5gigs left of space, yet the error is still showing -anyone knows why?
tomdkat's Avatar
Computer Specs
Distinguished Member with 7,127 posts.
 
Join Date: May 2006
Location: S.F. Bay Area, CA
Experience: Intermediate
27-May-2008, 02:36 PM #8
I'm not sure if it's a space issue or not. If it is, the "/var" filesystem might be full. Run this command in a terminal window to see how much free space your filesystems have:

$ df -h

Peace...
lotuseclat79's Avatar
Distinguished Member with 21,345 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
27-May-2008, 06:35 PM #9
Quote:
Originally Posted by TeckniX View Post
I keep getting an error about the following from psad:
[psad-error] Exceeded max disk utilization for /var/log/psad on localhost

I've got more than 5gigs left of space, yet the error is still showing -anyone knows why?
Hi TeckniX,

As I recall, there may be a configuration limit on the maximum allowed log size which you should be able to increase since you have more space. Look around or at psad's documentation on how to do that.

I think you will need to play with what size works best for you, and how much logging you need to actually turn on to detect problems.

I am not sure if you can get the logging to reuse its own space, like a circular queue, but that may be one question you can pose to the author at the CipherDyne web site.

-- Tom
__________________
The independence created by philosophical insight is - in my opinion - the mark of distinction
between a mere artisan or specialist and a real seeker after truth. - Einstein 1944
Imagination is more important than knowledge. - Einstein
Reply

THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
WELCOME TO TECH SUPPORT GUY! Are you looking for the solution to your computer problem? Join our site today to ask your question -- for free! Our site is run completely by volunteers who want to help you solve your computer problems. See our Welcome Guide to get started.
Thread Tools



Facebook Facebook Twitter Twitter TechGuy.tv TechGuy.tv Mobile TSG Mobile
You Are Using:
Server ID
Advertisements do not imply our endorsement of that product or service.
All times are GMT -4. The time now is 03:08 PM.
Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved.

Powered by Cermak Technologies, Inc.