Psad: Instalasi

Install

apt-get update
apt-get install psad

Edit File Konfigurasi

vi /etc/psad/psad.conf

Edit

EMAIL_ADDRESSES
HOSTNAME
ENABLE_AUTO_IDS - set ke Y jika anda ingin PSAD men-set firewall automatis.
ENABLE_AUTO_IDS_EMAILS - set ke Y jika anda ingin menerima email notifikasi.

3. Add iptables LOG rules for both IPv4 and IPv6.

   For an explanation of this step click here.
   Add the following iptables policies :

iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG
ip6tables -A INPUT -j LOG
ip6tables -A FORWARD -j LOG

4. Reload and update PSAD.

   To restart, update the signature file and reload PSAD to complete the install open a Terminal Window and enter :

psad -R
psad --sig-update
psad -H

   To check the status of PSAD, open a Terminal Window and enter :

psad --Status

Referensi

• https://www.digitalocean.com/community/tutorials/how-to-use-psad-to-detect-network-intrusion-attempts-on-an-ubuntu-vps
• https://www.thefanclub.co.za/how-to/how-install-psad-intrusion-detection-ubuntu-1204-lts-server