Psad: Instalasi
Install
apt-get update apt-get install psad
Edit File Konfigurasi
vi /etc/psad/psad.conf
Edit
EMAIL_ADDRESSES HOSTNAME ENABLE_AUTO_IDS - set ke Y jika anda ingin PSAD men-set firewall automatis. ENABLE_AUTO_IDS_EMAILS - set ke Y jika anda ingin menerima email notifikasi.
Tambahkan LOG rules ke iptables
iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG
Reload & update PSAD
psad -R psad --sig-update psad -H
Setelah psad --sig-update signature akan di letakan di
/etc/psad/signatures
Cek Status
psad --Status
Tampilan kira-kira
[+] psadwatchd (pid: 21150) %CPU: 0.0 %MEM: 0.0
Running since: Tue Jun 2 17:14:12 2015
[+] psad (pid: 21148) %CPU: 0.8 %MEM: 0.3
Running since: Tue Jun 2 17:14:12 2015
Command line arguments: [none specified]
Alert email address(es): onno@indo.net.id
[+] Version: psad v2.2.1
[+] Top 50 signature matches:
[NONE]
[+] Top 25 attackers:
[NONE]
[+] Top 20 scanned ports:
[NONE]
[+] iptables log prefix counters:
[NONE]
Total protocol packet counters:
[+] IP Status Detail:
[NONE]
Total scan sources: 0
Total scan destinations: 0
[+] These results are available in: /var/log/psad/status.out