netson

PSAD and UFW

Table of Contents

• What are we doing here?
• What is PSAD?
• What is UFW?
• Using PSAD and UFW
• Configure UFW logging rules
• Log prefix

dannysheehan

#!/bin/bash
grep "Accepted .* for " /var/log/messages | awk '{print $9, $11}' | egrep -v "nagios|bb|172\.|10\.|192\.168\."  | sort | uniq | while read u
do
  AUSER=`echo $u | awk '{print $1}'`
  AIP=`echo $u | awk '{print $2}'`
  COUNTRY=`geoip-lookup $AIP`
  #echo $AUSER $COUNTRY $AIP
  echo $AUSER $COUNTRY
done | sort  | uniq -c | sort -n

tollmanz

# Install dependencies
# 
# * checkinstall: package the .deb
# * libpcre3, libpcre3-dev: required for HTTP rewrite module
# * zlib1g zlib1g-dbg zlib1g-dev: required for HTTP gzip module
apt-get install checkinstall libpcre3 libpcre3-dev zlib1g zlib1g-dbg zlib1g-dev && \

mkdir -p ~/sources/ && \

# Compile against OpenSSL to enable NPN