Solved

configuring PSAD

Posted on 2004-08-31
2
339 Views
Last Modified: 2013-12-04
Hi can anyone help me with PSAD which is at http://www.cipherdyne.com/psad/

What i am trying to do is block ip addresses which try to log into my linux firewall via SSH, and also if someone scans my IP address with let say portscanner or NMAP. i would like these automatcally put in the hosts.deny file but its not working when i get someone to scan my IP address from the web PSAD is not blocking it the next time its scanned
0
Comment
Question by:jaxxman
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 

Accepted Solution

by:
michaelrash earned 50 total points
ID: 12040673
To enable auto blocking of IP addresses, you need to set the ENABLE_AUTO_IDS variable in /etc/psad/psad.conf to "Y".  You will also need to choose an appropriate danger level for the AUTO_IDS_DANGER_LEVEL variable (the default is 5, which scans almost never reach).  Also, psad supports the use of both iptables and tcpwrappers to accomplish auto blocking, but the default method is to only use iptables (see the IPTABLES_BLOCK_METHOD variable).  If you want psad to use tcpwrappers, then you will need to set TCPWRAPPERS_BLOCK_METHOD to "Y".  Note that the best way to maintain security is to use iptables instead of tcpwrappers since iptables intercepts packets in the kernel before they can even talk to the IP stack, let alone the daemon itself.
0
 

Author Comment

by:jaxxman
ID: 13416367
ok thanks for that.
On the bigger picture do you have any step by step handy tips on how to get the best out of PSAD or PDF and website may be
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, a new law in my state forced us to get a top-to-bottom analysis of all of our contract client's networks. While we have documentation, it was spotty at best for some - and in any event it needed to be checked against reality. That was m…
In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
In an interesting question (https://www.experts-exchange.com/questions/29008360/) here at Experts Exchange, a member asked how to split a single image into multiple images. The primary usage for this is to place many photographs on a flatbed scanner…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question