network/psad: Added (Intrusion Detection and Log Analysis).

Signed-off-by: Willy Sudiarto Raharjo <willysr@slackbuilds.org>

1 files changed, 27 insertions, 0 deletions

diff --git a/network/psad/README b/network/psad/README
new file mode 100644
index 000000000000..524336af6145
--- /dev/null
+++ b/network/psad/README
@@ -0,0 +1,27 @@
+psad (Intrusion Detection and Log Analysis with iptables)
+
+psad is a collection of three lightweight system daemons (two main
+daemons and one helper daemon) that run on Linux machines and analyze
+iptables log messages to detect port scans and other suspicious traffic.
+A typical deployment is to run psad on the iptables firewall where it has
+the fastest access to log data.
+
+You can set email for alerts by setting ALERTSEMAIL:
+
+ALERTSEMAIL=alerts@example.com ./psad.SlackBuild
+
+You need at least these rules:
+
+iptables -A INPUT -j LOG
+iptables -A FORWARD -j LOG
+
+but more usefull will be something like this:
+
+iptables -A INPUT -i lo -j ACCEPT
+iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A INPUT -p tcp --dport 80 -j ACCEPT
+iptables -A INPUT -j LOG
+iptables -A INPUT -j DROP
+
+please see documentation for more information.