Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've installed psad on an Ubuntu server, and set up corresponding iptables rules:

iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG

However by running psad --Status, psad doesn't seems to be working. See the logs:

[+] Version: psad v2.1.7

[+] Top 50 signature matches:
        [NONE]

[+] Top 25 attackers:
        [NONE]

[+] Top 20 scanned ports:
        [NONE]

[+] iptables log prefix counters:
        [NONE]

    Total packet counters: tcp: 0, udp: 0, icmp: 0

[+] IP Status Detail:
        [NONE]

    Total scan sources: 0
    Total scan destinations: 0

I also received this email:

[-] You may just need to add a default logging rule to the INPUT chain on
    transportecabo.  For more information, see the file "FW_HELP" in
    the psad sources directory or visit:

    http://www.cipherdyne.org/psad/docs/fwconfig.html

As you can see, iptables rules are OK:

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            LOG level warning 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            LOG level warning 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination       

Why is it not capturing anything?

I copied my entire psad.conf at pastebin: http://pastebin.com/JQzj9NhB

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.