Questions tagged [psad]

psad is a collection of three lightweight system daemons that runs on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic.

Filter by
Sorted by
Tagged with
1
vote
1answer
72 views

What is scanning udp ports 8610-8612 on Debian Buster?

I've got several computers with Debian Buster (Gnome) installed. Thanks to psad tool I realized that all of them frequently (at least several times a day) scan udp ports 8610-8612 in the local network....
2
votes
1answer
616 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
4
votes
1answer
6k views

SELinux - allowing rsyslog open/read access to some files

So I've got three files I need rsyslog to open in order to forward the entries to another server. SELinux is preventing this with the following error: type=AVC msg=audit(1371186588.768:1324460): avc:...
0
votes
1answer
101 views

What to make of system scans reported by psad

My system logs show that psad detects scans like this every minute. psad: scan detected: 192.168.1.10 -> 192.168.1.1 udp: [53] udp pkts: 2 DL: 2 If the first address is mine, and the second ...
0
votes
2answers
1k views

Turning off mailing in psad

The psad monitoring tool keeps on sending lots of mail to my localhost admin account. I use my ubuntu server as a NAT router, and psad warned me to enable logging in iptables. After I did so, it ...