Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For PSAD to work, I need to add the following iptables rules and enable packet logging :

iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG
ip6tables -A INPUT -j LOG
ip6tables -A FORWARD -j LOG

I use UFW on my system. So, how can I add these rules with UFW?

share|improve this question
up vote 2 down vote accepted

You just enable logging.

sudo ufw logging on
share|improve this answer
    
I did that, but when reloading psad, it sends an email to me giving this error : [-] You may just need to add a default logging rule to the /sbin/iptables 'filter' 'INPUT' chain on sinha. For more information, see the file "FW_HELP" in the psad sources directory or visit: cipherdyne.org/psad/docs/fwconfig.html [-] You may just need to add a default logging rule to the /sbin/ip6tables 'filter' 'INPUT' chain on sinha. For more information, see the file "FW_HELP" in the psad sources directory or visit: cipherdyne.org/psad/docs/fwconfig.html – THpubs Aug 25 '12 at 10:33

As the poster above says, you will need to enable logging with the command

 sudo ufw logging on

But I found that I still needed to add the iptables rules. To do this run each of the commands below (note that you must have sudo in front)

 sudo iptables -A INPUT -j LOG
 sudo iptables -A FORWARD -j LOG
 sudo ip6tables -A INPUT -j LOG
 sudo ip6tables -A FORWARD -j LOG
share|improve this answer

You need to add extra rules to ufw to satisfy psad. Edit following two files:

sudo vi /etc/ufw/before.rules

sudo vi /etc/ufw/before6.rules

To both files listed above, add following lines for psad, at the very end, but before COMMIT

# custom logging directives for psad
-A INPUT -j LOG
-A FORWARD -j LOG

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT

Next restart ufw

sudo ufw disable
sudo ufw enable

and then check if it worked with

sudo psad --fw-analyze

[+] Parsing /sbin/iptables INPUT chain rules.
[+] Parsing /sbin/ip6tables INPUT chain rules.
[+] Firewall config looks good.
[+] Completed check of firewall ruleset.
[+] Results in /var/log/psad/fw_check
[+] Exiting.

That's it. Read more tips and tricks on how to configure PSAD with UFW

share|improve this answer

Like darronz mentioned you still have to add iptable rules. As you are using ufw the easiest way to create persistent rules would be to edit /etc/ufw/before.rules and /etc/ufw/before6.rules and add the following lines

-A INPUT -j LOG
-A FORWARD -j LOG

at the end, but before the COMMIT.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.