Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've installed psad on an Ubuntu server, and set up corresponding iptables rules:

iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG

However by running psad --Status, psad doesn't seems to be working. See the logs:

[+] Version: psad v2.1.7

[+] Top 50 signature matches:
        [NONE]

[+] Top 25 attackers:
        [NONE]

[+] Top 20 scanned ports:
        [NONE]

[+] iptables log prefix counters:
        [NONE]

    Total packet counters: tcp: 0, udp: 0, icmp: 0

[+] IP Status Detail:
        [NONE]

    Total scan sources: 0
    Total scan destinations: 0

I also received this email:

[-] You may just need to add a default logging rule to the INPUT chain on
    transportecabo.  For more information, see the file "FW_HELP" in
    the psad sources directory or visit:

    http://www.cipherdyne.org/psad/docs/fwconfig.html

As you can see, iptables rules are OK:

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            LOG level warning 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            LOG level warning 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination       

Why is it not capturing anything?

I copied my entire psad.conf at pastebin: http://pastebin.com/JQzj9NhB

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.