Psad: Instalasi

Install

apt-get update
apt-get install psad

Edit File Konfigurasi

vi /etc/psad/psad.conf

Edit

EMAIL_ADDRESSES
HOSTNAME
ENABLE_AUTO_IDS - set ke Y jika anda ingin PSAD men-set firewall automatis.
ENABLE_AUTO_IDS_EMAILS - set ke Y jika anda ingin menerima email notifikasi.

Tambahkan LOG rules ke iptables

iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG
ip6tables -A INPUT -j LOG
ip6tables -A FORWARD -j LOG

Reload & update PSAD

psad -R
psad --sig-update
psad -H

Cek status

psad --Status

Referensi

• https://www.digitalocean.com/community/tutorials/how-to-use-psad-to-detect-network-intrusion-attempts-on-an-ubuntu-vps
• https://www.thefanclub.co.za/how-to/how-install-psad-intrusion-detection-ubuntu-1204-lts-server