This gist will explain how to configure UFW and PSAD to play nice together. If you're using UFW as a frontend for iptables, you will need to ensure that the proper logging rules are present so that PSAD can parse these. PSAD will modify iptables rules directly and will create its own chains. Developed to ease iptables firewall configuration, ufw provides a user friendly way to create an IPv4 or IPv6 host-based firewall.
The default firewall configuration tool for Ubuntu is ufw.
A typical deployment is to run psad on the iptables firewall where it has the fastest access to log data. Psad is a collection of three lightweight system daemons (two main daemons and one helper daemon) that run on Linux machines and analyze iptables log messages to detect port scans and other suspicious traffic.
0 kommentar(er)
