diff options
Diffstat (limited to 'network/psad/README')
| -rw-r--r-- | network/psad/README | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/network/psad/README b/network/psad/README new file mode 100644 index 0000000000000..524336af61456 --- /dev/null +++ b/network/psad/README @@ -0,0 +1,27 @@ +psad (Intrusion Detection and Log Analysis with iptables) + +psad is a collection of three lightweight system daemons (two main +daemons and one helper daemon) that run on Linux machines and analyze +iptables log messages to detect port scans and other suspicious traffic. +A typical deployment is to run psad on the iptables firewall where it has +the fastest access to log data. + +You can set email for alerts by setting ALERTSEMAIL: + +ALERTSEMAIL=alerts@example.com ./psad.SlackBuild + +You need at least these rules: + +iptables -A INPUT -j LOG +iptables -A FORWARD -j LOG + +but more usefull will be something like this: + +iptables -A INPUT -i lo -j ACCEPT +iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT +iptables -A INPUT -p tcp --dport 22 -j ACCEPT +iptables -A INPUT -p tcp --dport 80 -j ACCEPT +iptables -A INPUT -j LOG +iptables -A INPUT -j DROP + +please see documentation for more information. |