Страница 1 из 1
psad
Добавлено: 2009-10-29 14:48:45
JoyStick
Привет всем. Есть слака, поставил туда psad. Зделал всё по мануалу на офф сайте, но почему то не чего не блокирует, вообще нечего не делает.
Как сказано на сайте, добавил. Подскажете что не так сделал?
Код: Выделить всё
# iptables -A INPUT -j LOG
# iptables -A FORWARD -j LOG
Добавить в syslog такой параметр
Вот лог самого psad
Код: Выделить всё
psad --Status
[+] psadwatchd (pid: 12629) %CPU: 0.0 %MEM: 0.0
Running since: Thu Oct 29 12:40:13 2009
[+] psad (pid: 12627) %CPU: 0.0 %MEM: 1.8
Running since: Thu Oct 29 12:40:13 2009
Command line arguments: [none specified]
Alert email address(es): postmaster@mail.domain
[+] Version: psad v2.1.5
[+] Top 50 signature matches:
[NONE]
[+] Top 25 attackers:
[NONE]
[+] Top 20 scanned ports:
[NONE]
[+] iptables log prefix counters:
[NONE]
DShield stats:
total emails: 0
total packets: 0
Total packet counters: tcp: 0, udp: 0, icmp: 0
[+] IP Status Detail:
[NONE]
Total scan sources: 0
Total scan destinations: 0
[+] These results are available in: /var/log/psad/status.out
Логи пишет
Код: Выделить всё
Oct 29 12:37:25 router kernel: Inbound:IN=vlan9 OUT= MAC=00:0e:2e:65:c3:1b:00:15:17:11:bf:2c:08:00:45:00:00:28 SRC=83.27.144.25 DST=193.78.254.14 LEN=40 TOS=0x00 PREC=0x00 TTL=121 ID=37580 DF PROTO=TCP SPT=4362 DPT=22 WINDOW=65039 RES=0x00 ACK URGP=0
Oct 29 12:37:25 router kernel: Inbound:IN=vlan9 OUT= MAC=00:0e:2e:65:c3:1b:00:15:17:11:bf:2c:08:00:45:00:00:5c SRC=83.27.144.25 DST=193.78.254.14 LEN=92 TOS=0x00 PREC=0x00 TTL=121 ID=37581 DF PROTO=TCP SPT=4362 DPT=22 WINDOW=65039 RES=0x00 ACK PSH URGP=0
Oct 29 12:37:26 router kernel: Inbound:IN=vlan9 OUT= MAC=00:0e:2e:65:c3:1b:00:15:17:11:bf:2c:08:00:45:00:00:5c SRC=83.27.144.25 DST=193.78.254.14 LEN=92 TOS=0x00 PREC=0x00 TTL=121 ID=37582 DF PROTO=TCP SPT=4362 DPT=22 WINDOW=64987 RES=0x00 ACK PSH URGP=0
Oct 29 12:37:26 router kernel: Inbound:IN=vlan9 OUT= MAC=00:0e:2e:65:c3:1b:00:15:17:11:bf:2c:08:00:45:00:00:28 SRC=83.27.144.25 DST=193.78.254.14 LEN=40 TOS=0x00 PREC=0x00 TTL=121 ID=37583 DF PROTO=TCP SPT=4362 DPT=22 WINDOW=64903 RES=0x00 ACK URGP=0
Re: psad
Добавлено: 2009-10-29 15:19:51
Alex_hha
# lsof | grep psadfifo
?
Re: psad
Добавлено: 2009-10-29 15:31:38
JoyStick
Alex_hha писал(а):# lsof | grep psadfifo
?
молчит не показывает нефига
Re: psad
Добавлено: 2009-10-29 15:42:44
Alex_hha
Re: psad
Добавлено: 2009-10-29 15:55:55
JoyStick
Извиняюсь, но не могу понять в чём проблемам
? Всё это стоит то что указанно в ссылки
Re: psad
Добавлено: 2009-10-29 16:04:11
Alex_hha
Кстати у меня тоже пусто, но в логах есть инфа
# psad --Status
[+] psadwatchd (pid: 25030) %CPU: 0.0 %MEM: 0.0
Running since: Thu Oct 29 15:01:00 2009
[+] psad (pid: 25027) %CPU: 0.1 %MEM: 4.1
Running since: Thu Oct 29 15:01:00 2009
Command line arguments: [none specified]
Alert email address(es): root@localhost
[+] Version: psad v2.1.5
[+] Top 50 signature matches:
[NONE]
[+] Top 25 attackers:
127.0.0.1 DL: 2, Packets: 24, Sig count: 0
[+] Top 20 scanned ports:
tcp 3003 22 packets
udp 137 25 packets
udp 138 16 packets
udp 67 7 packets
udp 1947 4 packets
udp 2055 2 packets
udp 5353 1 packets
[+] iptables log prefix counters:
"Inbound": 11
Total packet counters: tcp: 22, udp: 55, icmp: 0
[+] IP Status Detail:
SRC: 127.0.0.1, DL: 2, Dsts: 1, Pkts: 24, Unique sigs: 0, Email alerts: 2
DST: 127.0.0.1
Scanned ports: UDP 2055, Pkts: 2, Chain: INPUT, Intf: lo
Scanned ports: TCP 3003, Pkts: 22, Chain: INPUT, Intf: lo
Total scan sources: 1
Total scan destinations: 1
[+] These results are available in: /var/log/psad/status.out
# cat /var/log/psad/psad.log
Oct 29 15:00:59 centos5 psad: imported valid icmp types and codes
Oct 29 15:00:59 centos5 psad: imported p0f-based passive OS fingerprinting signatures
Oct 29 15:00:59 centos5 psad: imported TOS-based passive OS fingerprinting signatures
Oct 29 15:01:00 centos5 psad: imported Snort classification.config
Oct 29 15:01:00 centos5 psad: imported original Snort rules in /etc/psad/snort_rules/ for reference info
Oct 29 15:01:00 centos5 psad: imported 205 psad Snort signatures from /etc/psad/signatures
Oct 29 15:01:30 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 1 DL: 2
Oct 29 15:02:10 centos5 last message repeated 2 times
Oct 29 15:03:06 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 1 DL: 2
Oct 29 15:03:26 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 1 DL: 2
Re: psad
Добавлено: 2009-10-29 16:09:17
Alex_hha
А вот я запустил сканировани nmap с машины 10.0.0.1
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "MISC HP Web JetAdmin communication attempt" (sid: 100084) tcp port: 8000
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "MISC Radmin Default install options attempt" (sid: 100204) tcp port: 4899
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "MISC Microsoft PPTP communication attempt" (sid: 100082) tcp port: 1723
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "DOS Real Audio Server communication attempt" (sid: 100112) tcp port: 7070
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "BACKDOOR QAZ Worm Client Login access" (sid: 108) tcp port: 7597
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "P2P BitTorrent communication attempt" (sid: 2181) tcp port: 6881
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "P2P Fastrack kazaa/morpheus communication attempt" (sid: 1383) tcp port: 1214
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "BACKDOOR Subseven connection attempt" (sid: 100207) tcp port: 27374
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "DOS MSDTC communication attempt" (sid: 1408) tcp port: 3372
Oct 29 15:05:38 centos5 psad: src: 10.0.0.1 signature match: "MISC MS Terminal Server communication attempt" (sid: 100077) tcp port: 3389
Oct 29 15:05:38 centos5 psad: scan detected: 10.0.0.1 -> 10.0.0.190 udp: [43347] tcp pkts: 722 udp pkts: 1 DL: 3
Oct 29 15:05:43 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 1 DL: 2
Oct 29 15:05:48 centos5 psad: src: 10.0.0.1 signature match: "SCAN nmap XMAS" (sid: 1228) tcp port: 1
Oct 29 15:05:48 centos5 psad: scan detected: 10.0.0.1 -> 10.0.0.190 udp: [1] tcp pkts: 18 udp pkts: 1 DL: 3
Oct 29 15:05:54 centos5 psad: scan detected: 10.0.0.25 -> 10.0.0.255 udp: [137] udp pkts: 3 DL: 1
Oct 29 15:05:54 centos5 psad: scan detected: 10.0.0.19 -> 255.255.255.255 udp: [1947] udp pkts: 1 DL: 1
Oct 29 15:05:59 centos5 psad: scan detected: 10.0.0.1 -> 10.0.0.190 udp: [35337-44706] udp pkts: 3 DL: 3
Oct 29 15:05:59 centos5 psad: scan detected: 10.0.0.19 -> 10.0.0.255 udp: [1947] udp pkts: 1 DL: 1
Oct 29 15:06:04 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 112 DL: 2
Oct 29 15:06:09 centos5 psad: scan detected: 127.0.0.1 -> 127.0.0.1 udp: [2055] udp pkts: 1 DL: 2
Я исправил в syslog
local6.* /var/log/psad/psad.log
ну и в psad.conf
SYSLOG_FACILITY LOG_LOCAL6;
Так как по дефолту стоит 7, а у меня 7ка уже использовалась
# Save boot messages also to boot.log
local7.* /var/log/boot.log