1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
Installation notes:
QUICK AND EASY INSTALLATION INSTRUCTIONS:
Just run the psad installation script "install.pl" from the psad
sources directory:
# ./install.pl
This will result in a functional installation of psad on your system. It is
safe to run the install.pl script even if you already have psad installed on
your system. The configuration can (optionally) be preserved from the
previous installation (you will be prompted for this if an existing psad
installation is detected). For more information, read on:
==============================================================================
IMPORTANT:
psad makes use of log messages that are generated by iptables as it logs
(and drops) packets. Hence if your firewall is not configured to log packets,
then psad will NOT detect port scans or anything else. Usually the best and
most secure way to configure your firewall is to first put the minimal rules
needed to allow only necessary traffic to and from your machine, and then have
default LOG and DROP rules toward the end of the firewall ruleset. Some
example firewall rulesets that are compatible with psad are contained within
the file FW_EXAMPLE_RULES, and the "iptables.sh" script available at the
following link contains a script to build a compatible iptables policy:
http://www.cipherdyne.org/LinuxFirewalls/ch01/iptables.sh.tar.gz
Note that psad is only compatible (as of version 2.1.3) with iptables
firewalls, but support for other firewall logging formats (such as logs
generated by ipfw and pf) is coming soon.
DEPENDENCIES:
psad requires several perl modules that may or may not already be
installed on your Linux system. These modules are included in the deps/
directory in the psad sources, and the list of modules is:
Bit::Vector
Date::Calc
IPTables::ChainMgr
IPTables::Parse
NetAddr::IP
Storable
Unix::Syslog
psad also includes a whois client written by Marco d'Itri (see the deps/whois
directory). This client does better than others at collecting the correct
whois information for a given IP address.
CONNECTION TRACKING:
As of kernel version 2.4.13, there is a bug in the connection tracking
code that can drop packets that are part of legitimate TCP connections that
have entered into the CLOSE_WAIT state depending on how late they arrive.
Since these packets are drop whenever the iptables policy is configured in
a default drop stance, psad interprets them as potentially belonging to a
scan. The source of the problem is an inappropriately low timeout value, and
fortunately this problem is mostly fixed (or at least minimized) by the
trivial kernel patch "conntrack_patch" included with the psad source code.
If you start noticing lots of ACK/FIN, ACK, and even RST packets being denied
by iptables from legtimate sessions, then you may want to apply this patch.
This will of course require the kernel to be recompiled. For more information
on how to do this, see the Kernel-HOWTO available at:
http://www.digitalhermit.com/linux/Kernel-Build-HOWTO.html
UPGRADES:
You can install a new version of psad over an existing one; just run
install.pl. The installation script will preserve any old configuration
parameters when installing the new versions of psad, psadwatchd, and kmsgsd.
UN-INSTALLING:
psad can be completely removed from the system by executing
install.pl with the --uninstall option.
|
