Turning off mailing in psad

Question

The psad monitoring tool keeps on sending lots of mail to my localhost admin account. I use my ubuntu server as a NAT router, and psad warned me to enable logging in iptables. After I did so, it sarted filling my mailbox with loads of messages. Within few days the size of mail box has grown to 3.4 GB.

How can I completely turn off mailing on psad?

Answer 1

Please see the documentation: http://cipherdyne.org/psad/docs/config.html

You could set 'EMAIL_ADDRESSES' to a blackhole address (eg a receive address that just discards what it gets), or consider tuning the following:

'EMAIL_ALERT_DANGER_LEVEL' 'PSAD_EMAIL_LIMIT' 'EMAIL_LIMIT_STATUS_MSG'

Those are described in the URL I provided above. There are further email alerts for DShield as well, if you have that enabled - if so, they are also described in that URL.