psad

JoyStick

Привет всем. Есть слака, поставил туда psad. Зделал всё по мануалу на офф сайте, но почему то не чего не блокирует, вообще нечего не делает.
Как сказано на сайте, добавил. Подскажете что не так сделал?

Код: Выделить всё

# iptables -A INPUT -j LOG
# iptables -A FORWARD -j LOG

Добавить в syslog такой параметр

Код: Выделить всё

kern.info  /var/lib/psad/psadfifo

Вот лог самого psad

Код: Выделить всё

psad --Status
[+] psadwatchd (pid: 12629)  %CPU: 0.0  %MEM: 0.0
    Running since: Thu Oct 29 12:40:13 2009

[+] psad (pid: 12627)  %CPU: 0.0  %MEM: 1.8
    Running since: Thu Oct 29 12:40:13 2009
    Command line arguments: [none specified]
    Alert email address(es): postmaster@mail.domain

[+] Version: psad v2.1.5

[+] Top 50 signature matches:
        [NONE]

[+] Top 25 attackers:
        [NONE]

[+] Top 20 scanned ports:
        [NONE]

[+] iptables log prefix counters:
        [NONE]

    DShield stats:
      total emails: 0
      total packets: 0

    Total packet counters: tcp: 0, udp: 0, icmp: 0

[+] IP Status Detail:
        [NONE]

    Total scan sources: 0
    Total scan destinations: 0

[+] These results are available in: /var/log/psad/status.out

Логи пишет

Код: Выделить всё

Oct 29 12:37:25 router kernel: Inbound:IN=vlan9 OUT= MAC=00:0e:2e:65:c3:1b:00:15:17:11:bf:2c:08:00:45:00:00:28 SRC=83.27.144.25  DST=193.78.254.14 LEN=40 TOS=0x00 PREC=0x00 TTL=121 ID=37580 DF PROTO=TCP SPT=4362 DPT=22 WINDOW=65039 RES=0x00 ACK URGP=0

Oct 29 12:37:25 router kernel: Inbound:IN=vlan9 OUT= MAC=00:0e:2e:65:c3:1b:00:15:17:11:bf:2c:08:00:45:00:00:5c SRC=83.27.144.25 DST=193.78.254.14 LEN=92 TOS=0x00 PREC=0x00 TTL=121 ID=37581 DF PROTO=TCP SPT=4362 DPT=22 WINDOW=65039 RES=0x00 ACK PSH URGP=0

Oct 29 12:37:26 router kernel: Inbound:IN=vlan9 OUT= MAC=00:0e:2e:65:c3:1b:00:15:17:11:bf:2c:08:00:45:00:00:5c SRC=83.27.144.25 DST=193.78.254.14 LEN=92 TOS=0x00 PREC=0x00 TTL=121 ID=37582 DF PROTO=TCP SPT=4362 DPT=22 WINDOW=64987 RES=0x00 ACK PSH URGP=0

Oct 29 12:37:26 router kernel: Inbound:IN=vlan9 OUT= MAC=00:0e:2e:65:c3:1b:00:15:17:11:bf:2c:08:00:45:00:00:28 SRC=83.27.144.25 DST=193.78.254.14 LEN=40 TOS=0x00 PREC=0x00 TTL=121 ID=37583 DF PROTO=TCP SPT=4362 DPT=22 WINDOW=64903 RES=0x00 ACK URGP=0

Хостинг HostFood.ru · **Хостинг HostFood.ru**

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

Alex_hha

# lsof | grep psadfifo

?

JoyStick

Alex_hha писал(а):# lsof | grep psadfifo

?

молчит не показывает нефига

Alex_hha

http://cipherdyne.org/psad/docs/syslog.html

JoyStick

Alex_hha писал(а):http://cipherdyne.org/psad/docs/syslog.html

Извиняюсь, но не могу понять в чём проблемам

? Всё это стоит то что указанно в ссылки

Alex_hha

Кстати у меня тоже пусто, но в логах есть инфа

# psad --Status
[+] psadwatchd (pid: 25030) %CPU: 0.0 %MEM: 0.0
Running since: Thu Oct 29 15:01:00 2009

[+] psad (pid: 25027) %CPU: 0.1 %MEM: 4.1
Running since: Thu Oct 29 15:01:00 2009
Command line arguments: [none specified]
Alert email address(es): root@localhost

[+] Version: psad v2.1.5

[+] Top 50 signature matches:
[NONE]

[+] Top 25 attackers:
127.0.0.1 DL: 2, Packets: 24, Sig count: 0

[+] Top 20 scanned ports:
tcp 3003 22 packets

udp 137 25 packets
udp 138 16 packets
udp 67 7 packets
udp 1947 4 packets
udp 2055 2 packets
udp 5353 1 packets

[+] iptables log prefix counters:
"Inbound": 11

Total packet counters: tcp: 22, udp: 55, icmp: 0

[+] IP Status Detail:

SRC: 127.0.0.1, DL: 2, Dsts: 1, Pkts: 24, Unique sigs: 0, Email alerts: 2

DST: 127.0.0.1
Scanned ports: UDP 2055, Pkts: 2, Chain: INPUT, Intf: lo
Scanned ports: TCP 3003, Pkts: 22, Chain: INPUT, Intf: lo

Total scan sources: 1
Total scan destinations: 1

[+] These results are available in: /var/log/psad/status.out

# cat /var/log/psad/psad.log
Oct 29 15:00:59 centos5 psad: imported valid icmp types and codes
Oct 29 15:00:59 centos5 psad: imported p0f-based passive OS fingerprinting signatures
Oct 29 15:00:59 centos5 psad: imported TOS-based passive OS fingerprinting signatures
Oct 29 15:01:00 centos5 psad: imported Snort classification.config
Oct 29 15:01:00 centos5 psad: imported original Snort rules in /etc/psad/snort_rules/ for reference info
Oct 29 15:01:00 centos5 psad: imported 205 psad Snort signatures from /etc/psad/signatures
Oct 29 15:01:30 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 1 DL: 2
Oct 29 15:02:10 centos5 last message repeated 2 times
Oct 29 15:03:06 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 1 DL: 2
Oct 29 15:03:26 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 1 DL: 2

Alex_hha

А вот я запустил сканировани nmap с машины 10.0.0.1

Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "MISC HP Web JetAdmin communication attempt" (sid: 100084) tcp port: 8000
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "MISC Radmin Default install options attempt" (sid: 100204) tcp port: 4899
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "MISC Microsoft PPTP communication attempt" (sid: 100082) tcp port: 1723
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "DOS Real Audio Server communication attempt" (sid: 100112) tcp port: 7070
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "BACKDOOR QAZ Worm Client Login access" (sid: 108) tcp port: 7597
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "P2P BitTorrent communication attempt" (sid: 2181) tcp port: 6881
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "P2P Fastrack kazaa/morpheus communication attempt" (sid: 1383) tcp port: 1214
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "BACKDOOR Subseven connection attempt" (sid: 100207) tcp port: 27374
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "DOS MSDTC communication attempt" (sid: 1408) tcp port: 3372
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "MISC MS Terminal Server communication attempt" (sid: 100077) tcp port: 3389
Oct 29 15:05:38 centos5 psad: scan detected: 10.0.0.1 -> 10.0.0.190 udp: [43347] tcp pkts: 722 udp pkts: 1 DL: 3
Oct 29 15:05:43 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 1 DL: 2
Oct 29 15:05:48 centos5 psad: src: 10.0.0.1 signature match: "SCAN nmap XMAS" (sid: 1228) tcp port: 1
Oct 29 15:05:48 centos5 psad: scan detected: 10.0.0.1 -> 10.0.0.190 udp: [1] tcp pkts: 18 udp pkts: 1 DL: 3
Oct 29 15:05:54 centos5 psad: scan detected: 10.0.0.25 -> 10.0.0.255 udp: [137] udp pkts: 3 DL: 1
Oct 29 15:05:54 centos5 psad: scan detected: 10.0.0.19 -> 255.255.255.255 udp: [1947] udp pkts: 1 DL: 1
Oct 29 15:05:59 centos5 psad: scan detected: 10.0.0.1 -> 10.0.0.190 udp: [35337-44706] udp pkts: 3 DL: 3
Oct 29 15:05:59 centos5 psad: scan detected: 10.0.0.19 -> 10.0.0.255 udp: [1947] udp pkts: 1 DL: 1
Oct 29 15:06:04 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 112 DL: 2
Oct 29 15:06:09 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 1 DL: 2

Я исправил в syslog
local6.* /var/log/psad/psad.log

ну и в psad.conf
SYSLOG_FACILITY LOG_LOCAL6;

Так как по дефолту стоит 7, а у меня 7ка уже использовалась
# Save boot messages also to boot.log
local7.* /var/log/boot.log

forum.lissyara.su

psad

psad

Услуги хостинговой компании Host-Food.ru

Re: psad

Re: psad

Re: psad

Re: psad

Re: psad

Re: psad