psad

[Hendrikus Godvliet]

Anyone who know's a replacemant for psad?
Ore beter is there a psad pisi pakket ?

[PhiX]

What is "psad" ?

[Hendrikus Godvliet]

What is "psad" ?

What is "Google" ?
http://www.google.nl/search?q=psad+&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a


PSAD is a collection of four lightweight system daemons written in Perl and in C that is designed to work with Linux firewalling code (iptables in the 2.4.x kernels, and ipchains in the 2.2.x kernels) to detect port scans. It features a set of highly configurable danger thresholds (with sensible defaults provided), verbose alert messages that include the source, destination, scanned port range, begin and end times, tcp flags and corresponding nmap options (Linux 2.4.x kernels only), reverse DNS info, email alerting, and automatic blocking of offending ip addresses via dynamic configuration of ipchains/iptables firewall rulesets. In addition, for the 2.4.x kernels psad incorporates many of the tcp signatures included in Snort to detect highly suspect scans.

[atolboo]

After  unpacking psad-2.1.5.tar.bz2 I start the installation with

Code:

sudo ./install.pl

which ends with

========================================================

• psad has been installed.
• To start psad, run "/etc/init.d/psad start"

So as far as I am concerned there isn't an immediate need for a pisi package as I can install this without any problems.

[PhiX]

Hendrikus, I know how to use search website, but one should not have to open a web page just to understand what you are asking about. My question was meant to make you realize that.

[Hendrikus Godvliet]

Hendrikus, I know how to use search website, but one should not have to open a web page just to understand what you are asking about. My question was meant to make you realize that.

Dear Phix

but one should not have to open a web page just to understand what you are asking about.

You're right!

Greetings Hendrikus

[Hendrikus Godvliet]

After  unpacking psad-2.1.5.tar.bz2 I start the installation with

Code:

sudo ./install.pl

which ends with

========================================================

• psad has been installed.
• To start psad, run "/etc/init.d/psad start"

So as far as I am concerned there isn't an immediate need for a pisi package as I can install this without any problems.

This is what i get / got

Code:

hendrikus@linux-pardus psad-2.1.5 $ sudo ./install.pl
[+] Thu Apr  1 11:22:28 2010 Installing psad on hostname: linux-pardus
[+] Compiling Marco d'Itri's whois client
make: Entering directory `/home/hendrikus/psad/psad-2.1.5/deps/whois'
cc  -MM -MG *.c > Makefile.depend
/bin/sh: cc: command not found
make: *** No rule to make target `Makefile.depend', needed by `all'.  Stop.
make: Leaving directory `/home/hendrikus/psad/psad-2.1.5/deps/whois'
[*] Could not compile whois at ./install.pl line 353.
hendrikus@linux-pardus psad-2.1.5 $

whois

Code:

hendrikus@linux-pardus psad-2.1.5 $ whois                                  
Usage: whois [OPTION]... OBJECT...                                        

-l                     one level less specific lookup [RPSL only]
-L                     find all Less specific matches  

First off all i wil take a look in the config section:

Before executing the install.pl script, edit the config section at the beginning. Sensible defaults are provided so hopefully there will be a minimal number of things to change to get psad to work on your system, but if system binaries are in places the scripts don't know about then you will need to provide the correct paths.

After the config section is the way you want it, just run 'install.pl', and then run '/etc/init.d/psad-init start' to start psad, kmsgsd, and psadwatchd, or just run them from the command line. The install.pl script installs psad, kmsgsd, and psadwatchd in /usr/sbin/ by default.

[atolboo]

This is what i get / got

I suspect that you will get a better result after applying this Wiki page. 
(I have to test this on a new installation on P2009.1)

[Hendrikus Godvliet]

This is what i get / got

I suspect that you will get a better result after applying this Wiki page. 
(I have to test this on a new installation on P2009.1)

Code:

sudo pisi install -c system.devel

O.k  Thanks for that.

But it make is more worse!!!

Code:

hendrikus@linux-pardus psad-2.1.5 $ sudo ./install.pl

Wachtwoord:                                         

• Thu Apr  1 12:14:31 2010 Installing psad on hostname: linux-pardus
• Compiling Marco d'Itri's whois client

make: Entering directory `/home/hendrikus/psad/psad-2.1.5/deps/whois'
cc  -O2 -c whois.c
In file included from whois.c:36:
data.h:98:20: error: ip_del.h: No such file or directory
data.h:109:21: error: ip6_del.h: No such file or directory
data.h:120:20: error: as_del.h: No such file or directory
data.h:136:22: error: tld_serv.h: No such file or directory

*** 4 errors, 0 warnings
make: *** [whois.o] Error 1
make: Leaving directory `/home/hendrikus/psad/psad-2.1.5/deps/whois'

• Could not compile whois at ./install.pl line 353.

hendrikus@linux-pardus psad-2.1.5 $

[atolboo]

I suspect that you will get a better result after applying this Wiki page. 
(I have to test this on a new installation on P2009.1)

Result is in attachment.
Maybe your downloaded psad-2.1.5.tar.bz2 has an error

[Hendrikus Godvliet]

I suspect that you will get a better result after applying this Wiki page.  
(I have to test this on a new installation on P2009.1)

Result is in attachment.
Maybe your downloaded psad-2.1.5.tar.bz2 has an error

Maybe your downloaded psad-2.1.5.tar.bz2 has an error

Your were right!

Result is in attachment.

It was very handy to have your attachment.

In most cases I answered no (n)  I know you just can install it again and by that i will make a better  configuration.  It also did not go through the email notification. So I still need a few good things set!

Thanks for your helping hands