Port Scan Attack Detector is an intrusion detection system which reads Linux iptables log entries. It can send email alerts and generate CSV reports for later analysis.

learn more… | top users | synonyms

0
votes
0answers
7 views

PSAD / removed iptables block

I'm pretty new to PSAD but eagerly getting into it to have a safer installation. But some understanding is missing I've had yesterday the following notification : [psad-status] removed iptables ...
0
votes
1answer
43 views

PSAD IPTables logging error

I installed PSAD on my Ubuntu server and then set the IPTables accordingly. But I still get this error by email: You may just need to add a default logging rule to the /sbin/iptables 'filter' ...
2
votes
1answer
229 views

Allow port scans for specific addresses in psad

How to enable port scans for specific address (or range) in psad? By default I get a lot of logs coming from my own monitoring service. How can I tell psad to treat my addresses or domains as trusted ...
-1
votes
1answer
184 views

psad does not detect nmap [closed]

I am new to this and just installed psad. I ran nmap several times on a server but psad didn't log this psad --Status. I configured it like this: ...
1
vote
1answer
433 views

Do we need PSAD if we already have Fail2Ban?

I already have installed Fail2Ban on my server. I planned to install PSAD on it. Are they equal? Isn't it a good idea to keep them both?
1
vote
2answers
2k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
1
vote
1answer
221 views

PSAD Firewall/ UDP flood?

Well I'm actually trying to block a UDP Flood on the Application port because the string "getstatus" is causing my application to make large output due to a small input to the attacker's IP. I ...