Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

For PSAD to work, I need to add the following iptables rules and enable packet logging :

iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG
ip6tables -A INPUT -j LOG
ip6tables -A FORWARD -j LOG

I use UFW on my system. So, how can I add these rules with UFW?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

You just enable logging.

sudo ufw logging on
share|improve this answer
    
I did that, but when reloading psad, it sends an email to me giving this error : [-] You may just need to add a default logging rule to the /sbin/iptables 'filter' 'INPUT' chain on sinha. For more information, see the file "FW_HELP" in the psad sources directory or visit: cipherdyne.org/psad/docs/fwconfig.html [-] You may just need to add a default logging rule to the /sbin/ip6tables 'filter' 'INPUT' chain on sinha. For more information, see the file "FW_HELP" in the psad sources directory or visit: cipherdyne.org/psad/docs/fwconfig.html –  EApubs Aug 25 '12 at 10:33

As the poster above says, you will need to enable logging with the command

 sudo ufw logging on

But I found that I still needed to add the iptables rules. To do this run each of the commands below (note that you must have sudo in front)

 sudo iptables -A INPUT -j LOG
 sudo iptables -A FORWARD -j LOG
 sudo ip6tables -A INPUT -j LOG
 sudo ip6tables -A FORWARD -j LOG
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.