Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am new to this and just installed psad. I ran nmap several times on a server but psad didn't log this psad --Status.

I configured it like this: http://www.thefanclub.co.za/how-to/how-install-psad-intrusion-detection-ubuntu-1204-lts-server

My aim is to prevent port checking attacks.

share|improve this question

closed as off topic by mdpc, Jenny D, Scott Pack, Ward, dunxd Apr 10 '13 at 10:44

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

up vote 2 down vote accepted

Psad does not prevent from being scanned, it will only help detect it. Moreover, you cannot really prevent it (unless you can set a closed whitelist of IPs), and the best you can do is react on psad messages using something like fail2ban filters. An example of a such filter being:


[Definition]
failregex = psad: scan detected: .*
ignoreregex = 

Define the DANGER_LEVEL_? thresholds in /etc/psad/psad.conf to something that suits your needs.

share|improve this answer
    
Thanks. So is it possible to detect a port check and start a script that bans the IP or other client info from accessing the server? How could it be done? –  Mike Pretzlaw Apr 9 '13 at 9:17
    
As I outlined above, using fail2ban and adding that filter. Also review the psad.conf to define sensible thresholds. –  dawud Apr 9 '13 at 9:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.