| 1 |
Installation notes: |
|---|
| 2 |
|
|---|
| 3 |
QUICK AND EASY INSTALLATION INSTRUCTIONS: |
|---|
| 4 |
|
|---|
| 5 |
Just run the psad installation script "install.pl" from the psad |
|---|
| 6 |
sources directory: |
|---|
| 7 |
|
|---|
| 8 |
|
|---|
| 9 |
# ./install.pl |
|---|
| 10 |
|
|---|
| 11 |
|
|---|
| 12 |
Done. Enough said. :) This will result in a functional installation |
|---|
| 13 |
of psad on your system. It is safe to run the install.pl script even |
|---|
| 14 |
if you already have psad installed on your system. The configuration |
|---|
| 15 |
can (optionally) be preserved from the previous installation (you will |
|---|
| 16 |
be prompted for this if an existing psad installation is detected). |
|---|
| 17 |
For more information, read on: |
|---|
| 18 |
|
|---|
| 19 |
======================================================================= |
|---|
| 20 |
|
|---|
| 21 |
|
|---|
| 22 |
IMPORTANT: |
|---|
| 23 |
psad makes use of log messages that are generated by iptables as it |
|---|
| 24 |
logs (and drops) packets. Hence if your firewall is not configured to |
|---|
| 25 |
log packets, then psad will NOT detect port scans or anything else. |
|---|
| 26 |
Usually the best and most secure way to configure your firewall is to |
|---|
| 27 |
first put the minimal rules needed to allow only necessary traffic to |
|---|
| 28 |
and from your machine, and then have default drop-and-log rules toward |
|---|
| 29 |
the end of the firewall ruleset. Some example firewall rulesets that |
|---|
| 30 |
are compatible with psad are contained within the file FW_EXAMPLE_RULES. |
|---|
| 31 |
Note that psad is not compatible with the ipchains or ipfw firewalls |
|---|
| 32 |
that are included within pre-2.4.x Linux kernels. |
|---|
| 33 |
|
|---|
| 34 |
A note on iptables: As of kernel version 2.4.13, there is a bug in the |
|---|
| 35 |
connection tracking code that denies packets that are part of legitimate |
|---|
| 36 |
tcp sessions. Since these packets are denied, psad interprets them as |
|---|
| 37 |
potentially belonging to a scan. The source of the problem is an |
|---|
| 38 |
inappropriately low timeout value, and fortunately this problem is easily |
|---|
| 39 |
fixed by the trivial kernel patch "conntrack_patch" included with the |
|---|
| 40 |
psad source code. If you start noticing lots of ACK/FIN, ACK, and even |
|---|
| 41 |
RST packets being denied by iptables from ips that are part of legtimate |
|---|
| 42 |
sessions, then you may want to apply the patch. This will of course |
|---|
| 43 |
require that the patch be applied and then the kernel to be recompiled. |
|---|
| 44 |
For more information on how to do this, see the Kernel-HOWTO available |
|---|
| 45 |
at: http://www.linuxdoc.org/HOWTO/Kernel-HOWTO.html. |
|---|
| 46 |
|
|---|
| 47 |
Before executing the install.pl script, edit the config section |
|---|
| 48 |
at the beginning. Sensible defaults are provided so hopefully |
|---|
| 49 |
there will be a minimal number of things to change to get psad to work |
|---|
| 50 |
on your system, but if system binaries are in places the scripts don't |
|---|
| 51 |
know about then you will need to provide the correct paths. After the |
|---|
| 52 |
config section is the way you want it, just run 'install.pl', and |
|---|
| 53 |
then run '/etc/init.d/psad-init start' to start psad, kmsgsd, |
|---|
| 54 |
and psadwatchd, or just run them from the command line. The install.pl |
|---|
| 55 |
script installs psad, kmsgsd, and psadwatchd in /usr/sbin/ by |
|---|
| 56 |
default. |
|---|
| 57 |
|
|---|
| 58 |
You can install a new version of psad over an existing one; just |
|---|
| 59 |
run install.pl. The installation script will preserve any old |
|---|
| 60 |
configuration parameters when installing the new versions of psad, |
|---|
| 61 |
psadwatchd, and kmsgsd. If you don't need or want any old |
|---|
| 62 |
configurations to be preserved, just execute "./install.pl -n". |
|---|
| 63 |
|
|---|
| 64 |
Even though it is a good idea to edit the config sections |
|---|
| 65 |
of each of the programs included with psad, both install.pl and psad |
|---|
| 66 |
attempt to use the correct system binaries even if an incorrect path |
|---|
| 67 |
is given. This is accomplished by simply using the path provided by |
|---|
| 68 |
'which <system binary>' if the binary is not found in the place |
|---|
| 69 |
specified in the config section. |
|---|
| 70 |
|
|---|
| 71 |
psad can be completely removed from the system by executing |
|---|
| 72 |
install.pl with the --uninstall option. |
|---|
| 73 |
|
|---|
| 74 |
$Id$ |
|---|
