/
ChangeLog
1246 lines (1156 loc) · 68.4 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
psad-3.0 (11//2018):
- Reputation feeds...
- Use File::Temp for temporary files in --sig-update and
--reputation-feeds-update modes. Use a dedicated directory for temporary
files controlled by the PSAD_TMP_DIR configuration variable. This also
applies to tmp files for iptables commands.
- Switch to use the 'pkill' command by default instead of the 'killall'
command to stop processes.
- Switch to use the 'ss' command by default instead of 'netstat' to detect
local servers.
- Switch to use the 'ip' command by default instead of 'ifconfig' to get
local IP/network information. This is configurable via the 'IFCFGTYPE'
variable in psad.conf.
- Remove syslog testing code from install.pl.
- Update the whois client to whois-5.3.2.
psad-2.4.6 (07/31/2018):
- Add EMAIL_APPEND_HEADER to allow psad alerts to have custom email headers
appended to outbound emails. This uses the '-a' command line argument
offered by the 'mail' command. An example usage would be to set the
'From' email header.
- Bug fix for ENABLE_OVERRIDE_FW_CMD feature to allow global option
settings to the underlying firewall command to be controlled via a new
variable FW_CMD_ARGS. This variable is only used when
ENABLE_OVERRIDE_FW_CMD is enabled, and is set to NONE by default.
Normally, on systems running firewalld, the command line arguments
'--direct --passthrough ipv4' are set provided, but FW_CMD_ARGS can be
used to control this.
- For iptables logs generated by fwsnort, include the contents of the
'metadata' Snort rule field in psad email alerts.
- Updated to bundle the latest Emerging Threats rule set in
deps/snort_rules.
psad-2.4.5 (06/13/2017):
- Added proper port sweep detection based on a single port being probed
across a configurable number of destination hosts. The number of
destinations is controlled by the following new configuration variables
(and associated defaults) in the psad.conf file:
DL1_UNIQUE_HOSTS 10;
DL2_UNIQUE_HOSTS 20;
DL3_UNIQUE_HOSTS 50;
DL4_UNIQUE_HOSTS 100;
DL5_UNIQUE_HOSTS 500;
PORT_RANGE_SWEEP_THRESHOLD 0;
The PORT_RANGE_SWEEP_THRESHOLD variable is set to zero by default to
denote a sweep for a single port. The comparison is made as an "equals"
test against this variable. So a scan that trips the
PORT_RANGE_SCAN_THRESHOLD can be changed to a sweep if
PORT_RANGE_SWEEP_THRESHOLD is changed to a value greater than
PORT_RANGE_SCAN_THRESHOLD and if at least DL1_UNIQUE_HOSTS are hit.
- Bug fix to apply syslog only ALERTING_METHOD properly when an email
throttle is also set. This issue was reported by @joshlinx on github as
issue #44.
- Bug fix to include top signature matches in 'psad --Status' output. This
issue was reported by @joshlinx on github as issue #41.
- In the psad.conf file, change the ENABLE_PERSISTENCE default to "N" in
order to (by default) limit psad's memory consumption. The trade off is
that really "low and slow" scans may be missed in exchange for a better
operational model. Note the MAX_SCAN_IP_PAIRS variable can also be used
to control memory consumption if ENABLE_PERSISTENCE is enabled.
- Added new variables ENABLE_OVERRIDE_FW_CMD and FW_CMD to force a path to
a firewall binary to be set instead of having psad search for standard
installation paths.
psad-2.4.4 (02/20/2017):
- Added detection for Mirai botnet default credentials scans. These scans
follow a well-defined pattern of 10 connections to TCP port 23 (telnet)
followed by a connection to TCP port 2323.
- Added installation support (install.pl and 'psad.service' file) for
systems running systemd.
- Bug fix to not remove auto-blocked IP's from a running psad instance
with 'psad --Status'.
- Updated to version 5.2.13 of the whois client.
- Updated to IPTables::ChainMgr 1.6.
psad-2.4.3 (12/19/2015):
- Bug fix in fwcheck_psad related to an uninitialized variable related to
firewalld deployments.
- Bug fix to add psad process into -K, -S, and -R handling if psad is
reading iptables logs via journalctl. This is necessary because psad
fork()'s an extra copy of itself when reading via journalctl.
- Updated to IPTables::ChainMgr 1.5.
psad-2.4.2 (11/29/2015):
- Bug fix to apply the EMAIL_ALERT_DANGER_LEVEL threshold to auto-blocking
emails (reported by itoffshore@github).
- Bug fix to include the META.yml file for the Unix::Syslog module. This
issue was reported by github user itvasile as issue #26.
- Updated IPTables::ChainMgr and IPTables::Parse to 1.4 and 1.6.1
respectively. The IPTables::Parse update is important because of a
security vulnerability fixed by Miloslav Trmač. This vulnerability was
an issue where temporary files used predictable names, and this could be
leveraged by a local attacker to overwrite any files to which the
attacker has write permissions.
- With the update to IPTables::Parse 1.6.1, the path to the
iptables/ip6tables/firewall-cmd binary is worked out by the module
directly instead of by psad.
psad-2.4.1 (05/13/2015):
- Bug fix to honor the IGNORE_PROTOCOLS configuration variable for
non-tcp/udp/icmp protocols. This bug was reported by Paul Versloot.
Also extended the IGNORE_PROTOCOLS feature to match on both protocol
name and number as well regardless of what iptables reports within log
messages. This is so the user does not have to know what iptables will
report (which can be inconsistent, e.g. 'TCP' vs. '2' for IGMP).
- Added two configuration variables ENABLE_WHOIS_LOOKUPS and
ENABLE_DNS_LOOKUPS (set to 'Y' by default) to allow whois and reverse
DNS lookups to be controlled from the command line.
- Bug fix for an uninitialized variable in 'psad -L' mode when auto
blocking is enabled. This bug was reported via github issue #19 by
gihub user 'itoffshore'.
psad-2.4.0 (03/18/2015):
- Added support for reading syslog messages from journalctl on systems
where syslog data is tied into systemd. psad detects journalctl by
default, but this can be disabled via the AUTO_DETECT_JOURNALCTL
variable. When enabled, by default the command executed by psad to
acquire syslog data is '/bin/journalctl -f -k', but both the command
path and the command args can be altered with the FW_MSG_READ_CMD and
FW_MSG_READ_CMD_ARGS variables respectively.
- Added support for systems with 'firewalld' by leveraging the
'firewall-cmd' binary. This is done via the updated IPTables::Parse and
IPTables::ChainMgr modules.
- Bug fix reported by Shlomit Afgin to handle the syslog time format that
looks like '2015-03-08T02:25:11.444012+02:00 servername kernel: ..'.
This fix has also been extended to allow psad to handle custom time
formats that are allowed by some syslog daemons. This is controlled via
two new config variables CUSTOM_SYSLOG_TS_RE and CUSTOM_SYSLOG_TS_RE.
- Updated all module dependencies in the deps/ directory.
- Bug fix reported by Brad Rubenstein to ensure exiting with a proper exit
status in 'psad --HUP' mode. This was also extended to ensure better
exit status returns in other modes as well such as --Status, and --USR1.
Fixes issue #11 on github.
psad-2.2.5 (02/09/2015):
- Added signature to detect fwknop Single Packet Authorization (SPA)
packets that are destined to the default UDP port 62201. More
information about fwknop can be found here:
https://www.cipherdyne.org/fwknop/
- (Rinck Sonnenberg): Spotted install.pl exit code bug when uninstalling
psad. Getting this fixed will enable a proper Puppet module to be
developed which Rinck is working on.
- (Rinck Sonnenberg) UFW and Logstash integration capabilities for psad
are now available:
Logstash: https://gist.github.com/netson/cc6ffa751aa4610c13c0
UFW: https://gist.github.com/netson/c45b2dc4e835761fbccc
psad-2.2.4 (01/16/2015):
- (Steve Murphy) Added the ability to run an external script whenever an
IP is blocked. Two new config variables were added to support this
feature, ENABLE_EXT_BLOCK_SCRIPT_EXEC and EXTERNAL_BLOCK_SCRIPT.
- Bug fix to not create zombie whois processes when whois lookups take too
long to complete for whatever reason (slow network, etc.). This fixes
issue #15 on Github. The bug was reported by "3Turtles" to the psad
mailing list, and Dan Dickey provided valuable input.
- Bug fix for uninitialized variable in --fw-block-ip handling reported by
Albert Whale (fixes issue #17).
- Bug fix in reverse DNS resolution for IP addresses that cannot be
properly resolved.
psad-2.2.3 (03/01/2014):
- Added compatibility with 'upstart' init daemons with assistance from Tim
Kramer. This change adds a new config variable 'ENABLE_PSADWATCHD' that
can be used to disable psadwatchd when deployed with upstart since it
has built-in process monitoring and restarting capabilities. By default
psadwatchd is not enabled anymore since this variable is set to "N". The
reason for this change is that psad is extremely stable and so almost
never needs to be restarted in practice, and process monitoring is
better provided via other solutions (like upstart) anyway. In addition,
a new init script located at init-scripts/upstart/psad.conf has been
added that is compatible with upstart - this script is meant to be copied
to the /etc/init/ directory.
- (Wolfgang Breyha) Bug fix to allow VLAN interfaces and interface aliases
in IGNORE_INTERFACES. This fixes issue #8 on github.
- Bug fix to not modify /etc/hosts.deny permissions when removing
tcpwrappers auto-block rules. This issue was reported as Debian bug
#724267 (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=724267) and
relayed via Franck Joncourt. Closes issue #7 on github.
psad-2.2.2 (01/13/2014):
- Added detection for Errata Security's "Masscan" port scanner that was
used in an Internet-wide scan for port 22 on Sept. 12, 2013 (see:
http://blog.erratasec.com/2013/09/we-scanned-internet-for-port-22.html).
The detection strategy used by psad relies on the fact that masscan does
not appear to set the options portion of the TCP header, and if the
iptables LOG rules that generate log data for psad are built with the
--log-tcp-options switch, then no options in a SYN scan can be seen.
This is not to say that other scanning software always sets TCP options -
Scapy seems to not set options by default when issuing a SYN scan like
this either: http://www.secdev.org/projects/scapy/doc/usage.html#syn-scans
There is a new psad.conf variable "EXPECT_TCP_OPTIONS" to assist with
Masscan detection as well. When looking for Masscan SYN scans, psad
requires at least one TCP options field to be populated within a LOG
message (so that it knows --log-tcp-options has been set for at least
some logged traffic), and after seeing this then SYN packets with no
options are attributed to Masscan traffic. All usual psad threshold
variables continue to apply however, so (by default) a single Masscan
SYN packet will not trigger a psad alert. Masscan detection can be
disabled altogether by setting EXPECT_TCP_OPTIONS to "N", and this will
not affect any other psad detection techniques such as passive OS
fingerprinting, etc.
- RPM bug fix to include the protocols file.
psad-2.2.1 (01/02/2013):
- Added IP protocol scan detection (nmap -sO). A new psad.conf variable
PROTOCOL_SCAN_THRESHOLD defines the minimum number of different IP
protocols (default = 5) that must be scanned before an alert is
triggered.
- Added detection for Topera IPv6 scans when --log-ip-options is used in
the ip6tables logging rule. When this option is not used, the previous
psad-2.2 release detected Topera scans. An example TCP SYN packet
generated by Topera when --log-ip-options is used looks like this (note
the series of empty IP options strings "OPT ( )":
Dec 20 20:10:40 rohan kernel: [ 488.495776] DROP IN=eth0 OUT=
MAC=00:1b:b9:76:9c:e4:00:13:46:3a:41:36:86:dd
SRC=2012:1234:1234:0000:0000:0000:0000:0001
DST=2012:1234:1234:0000:0000:0000:0000:0002 LEN=132 TC=0 HOPLIMIT=64
FLOWLBL=0 OPT ( ) OPT ( ) OPT ( ) OPT ( ) OPT ( ) OPT ( ) OPT ( )
OPT ( ) OPT ( ) PROTO=TCP SPT=61287 DPT=1 WINDOW=8192 RES=0x00 SYN
URGP=0
- Bug fix in --Analyze mode when IP fields are to be searched with the
--analysis-fields argument (such as --analysis-fields "SRC:1.2.3.4").
The bug was reported by Gregorio Narvaez, and looked like this:
Use of uninitialized value $_[0] in length at
../../blib/lib/NetAddr/IP/UtilPP.pm (autosplit into
../../blib/lib/auto/NetAddr/IP/UtilPP/hasbits.al) line 126.
Use of uninitialized value $_[0] in length at
../../blib/lib/NetAddr/IP/UtilPP.pm (autosplit into
../../blib/lib/auto/NetAddr/IP/UtilPP/hasbits.al) line 126.
Bad argument length for NetAddr::IP::UtilPP::hasbits, is 0, should be
128 at ../../blib/lib/NetAddr/IP/UtilPP.pm (autosplit into
../../blib/lib/auto/NetAddr/IP/UtilPP/_deadlen.al) line 122.
- Added --stdin argument to allow psad to collect iptables log data from
STDIN in --Analyze mode. This makes it easier to run an iptables logs
through psad from arbitrary files like so:
# grep "IN=.*OUT=" /var/log/kern.log | psad -A --stdin
- Added the ability to acquire Snort rule 'msg' fields from fwsnort if
it's also installed. A new variable FWSNORT_RULES_DIR tells psad where
to look for the fwsnort rule set. This fixes a problem reported by Pui
Edylie to the psad mailing list where fwsnort logged an attack that psad
could not map back to a descriptive 'msg' field.
- Added the ability to set per-danger level timeouts when psad is
configured to run in auto-blocking mode. These timeouts are implemented
with new AUTO_BLOCK_DL*_TIMEOUT variables - one for each of the five
possible danger levels that may be assigned to a scanning IP address.
- Added the ability to throttle emails generated by psad via a new
EMAIL_THROTTLE variable which is implemented as a per-IP threshold. That
is, if EMAIL_THROTTLE is set to "10", then psad will only send 1/10th as
many emails for each scanning IP as it would have normally.
psad-2.2 (02/20/2012):
- Added support for detection of malicious traffic that is delivered via
IPv6. This is accomplished by parsing ip6tables log messages - these are
in a slightly different format than the iptables log messages. Here is
an example:
Mar 17 13:39:13 linux kernel: [956932.483644] DROP IN=eth0 OUT=
MAC=00:13:46:3a:41:36:00:1b:b9:76:9c:e4:86:dd
SRC=2001:0db8:0000:f101:0000:0000:0000:0002
DST=2001:0db8:0000:f101:0000:0000:0000:0001 LEN=80 TC=0 HOPLIMIT=64
FLOWLBL=0 PROTO=TCP SPT=50326 DPT=993 WINDOW=5760 RES=0x00 SYN URGP=0
Detection of malicious IPv6 traffic can be disabled via a new
ENABLE_IPV6_DETECTION config variable.
- For ICMP6 traffic, added protocol validation for ICMP6 type/code
combinations.
- Replaced Net::IPv4Addr with the excellent NetAddr::IP module which has
comprehensive support for IPv6 address network parsing and comparisons.
- Added a new test suite in the test/ directory to validate psad run time
operations (scan detection, signature matching, and more). To support
this, a new '--install-test-dir' option was added to the install.pl
script. Once this is executed, the test suite can be run via the
test-psad.pl script in the test/ directory.
- Added a new MAX_SCAN_IP_PAIRS config variable to allow psad memory usage
to be constrained by restricting the number of unique IP pairs that psad
This is useful for when psad is deployed on systems with little memory,
and is best utilized in conjunction with disabling ENABLE_PERSISTENCE so
that old scans will also be deleted (and thereby making room for tracking
new scans under the MAX_SCAN_IP_PAIRS threshold).
- Bug fix for 'qw(...) usage as parenthesis' warnings for perl > 5.14
- Bug fix that caused psad to emit the following:
Undefined subroutine &main::LOG_DAEMON called at ./psad line 10071.
This problem was noticed by Robert and reported on the psad mailing list.
- Added --install-root to the install.pl script so that psad can be
installed in a directory specified by the user as opposed to the normal
system default. This was a suggestion from @pyllyukko.
- Added PERL5LIB env variable usage to the install.pl script so that module
installs can reference the current install path.
- Updated to the latest p0f signatures from OpenBSD.
- Altered the 'ET MALWARE Bundleware Spyware CHM Download' Snort rule in
the bundled Emerging Threats rule set to make sure that ClamAV does not
flag on the pattern "mhtml\:file\://" which is associated with the
following ClamAV signature:
$ grep Exploit.HTML.MHTRedir-8 main.ndb
Exploit.HTML.MHTRedir-8:3:*:6d68746d6c3a66696c653a2f2f{1-20}2168
An analysis of this issue was posted here:
http://www.cipherdyne.org/blog/2010/08/22.html
- Bug fix for ICMP packet handling where psad would incorrectly interpret
ICMP port unreachable messages as UDP packets because the UDP specifics
are included in the iptables log message. This bug was first reported by
Lukas Baxa to the Debian maintainers and was followed up by Franck
Joncourt:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596240
An example ICMP log message that exposed the bug is included below:
Sep 8 18:04:26 baxic kernel: [28241.572876] IN_DROP IN=wlan0
OUT= MAC=00:1a:9f:91:df:ae:00:21:27:e8:0a:a0:08:00
SRC=10.0.0.138 DST=192.168.1.103 LEN=96 TOS=0x00 PREC=0xC0 TTL=254
ID=63642 PROTO=ICMP TYPE=3 CODE=3
[SRC=192.168.1.103 DST=10.0.0.138 LEN=68 TOS=0x00 PREC=0x00 TTL=0
ID=22458 PROTO=UDP SPT=35080 DPT=33434 LEN=48 ]
- Updated the bundled whois client to 5.0.6.
- Removed the ExtUtils::MakeMaker RPM build requirement from the psad.spec
file. This is a compromise which will allow the psad RPM to be built
even if RPM dosen't or can't see that ExtUtils::MakeMaker is installed -
most likely it will build anyway. If it doesn't, there are bigger
problems since psad is written in perl. If you want to build the psad
RPM with a .spec file that requires ExtUtils::MakeMaker, then use the
"psad-require-makemaker.spec" file that is bundled in the psad sources.
- Switched to git from svn - comprehensive psad development history can
can acquired through gitweb:
http://www.cipherdyne.org/cgi-bin/gitweb.cgi?p=psad.git;a=summary
or through git itself:
$ git clone http://www.cipherdyne.org/git/psad psad.git
- Updated to IPTables::ChainMgr 1.2 and IPTables::Parse 1.1 in the deps/
directory.
- In the /var/log/psad/<ip>/ directories, whois information is stored in
the <IP>_whois files, the IP in the filename was included as a
destination IP under the psad -S output. This has been fixed. Here is
an example of the invalid output:
[+] IP Status Detail:
SRC: 123.123.123.221, DL: 2, Dsts: 2, Pkts: 1, Unique sigs: 1,
Email alerts: 1
DST: 1.2.3.4, Local IP
Scanned ports: TCP 1433, Pkts: 1, Chain: INPUT, Intf: eth0
Signature match: "MISC Microsoft SQL Server communication attempt"
TCP, Chain: INPUT, Count: 1, DP: 1433, SYN, Sid: 100205
DST: 123.123.123.221
- By default the install.pl script records user answers to installation
queries so they can be used to install psad in an automated fashion later.
A new option --Use-answers makes this possible. This feature was requests
by @pyllyukko.
psad-2.1.7 (07/14/2010):
- (Dan A. Dickey) Added the ability to use the "ip" command from the
iproute2 tools to acquire IP addresses from local interfaces. Dan's
description is as follows: "...A main reason for doing this is in the
case of multi-homed hosts. ifconfig sets these up on an interface using
aliases, iproute2 does not. So, for a multi-homed interface (eth0 with
multiple addresses), ifconfig -a only shows the first one configured and
not the rest. ip addr shows all of the configured addresses...".
- Added ENABLE_WHOIS_FORCE_ASCII to replace any non-ascii characters in
whois data (which is common with whois lookups against Chinese IP
addresses for example) with the string "NA". This option is disabled by
default, but can be useful if errors like the following are seen upon
receiving an email alert from psad:
<<< 554 5.6.1 Eight bit data not allowed
554 5.0.0 Service unavailable
- Updated psad to issue whois lookups against IP addresses that are not
directly connected to the local system. This is useful for example when
an internal system is scanning an external destination system, and the
scan is logged in the FORWARD chain. Issuing whois lookups on the
internal system (frequently on RFC 1918 address space) is not usually
very useful, but issuing the whois lookup against the destination system
gives much more interesting data. This feature can be disabled with the
new ENABLE_WHOIS_FORCE_SRC_IP variable.
psad-2.1.6 (07/09/2010):
- Bug fix for Decode_Month() calls used to handle date formats and ensure
proper month handling for iptables log message time stamps. This bug
caused psad to die in some cases, and the specific error on the console
in --debug mode was:
Date::Calc::Decode_Month(): argument is not a string at \
/usr/sbin/psad line 1103, <FWDATA> line 2.
- (Franck Joncourt) Added --Override-config feature so that alternate
configuration files can be specified on the command line to override
configuration variables in the standard /etc/psad/psad.conf file.
- (Franck Joncourt) Submitted patches to fix stderr redirection for the
usage of the mail binary, and to close stdout, stdin, and stderr when
running psad as a daemon.
psad-2.1.5 (02/20/2009):
- (Miroslav Grepl) Contributed policy files to make psad compatible with
SELinux. The files are located in a new "selinux" directory in the
psad sources.
- Bug fix for local server ports not reported correctly under netstat
parsing (Franck Joncourt).
- (Steve B) Submitted patch to fix a bug in the start() function in the
Gentoo init script which caused psad to not be started and the error
"* ERROR: psad failed to start" to be generated.
- Bug fix when ENABLE_SYSLOG_FILE is enabled to run a preliminary regex
match on each syslog message because kmsgsd is not running and therefore
has not gone through the kmsgsd tests for a properly structured iptables
message.
- Updated IPTables::Parse to 0.7.
- Updated IPTables::ChainMgr to 0.9.
psad-2.1.4 (08/21/2008):
- Restructured perl module paths to make it easy to introduce a "nodeps"
distribution of psad that does not contain any perl modules. This
allows better integration with systems that already have all necessary
modules installed (including the IPTables::ChainMgr and IPTables::Parse
modules). The main driver for this work is to make all cipherdyne.org
projects easily integrated with distributions based on Debian, and
Franck Joncourt has been instrumental in making this process a reality.
All perl modules are now placed within the "deps" directory, and the
install.pl script checks to see if this directory exists - a separate
psad-<ver>-nodeps tarball will be distributed without this directory.
The Debian package for psad can then reference the -nodeps tarball, and
a new "psad-nodeps.spec" file has been added to build an RPM from the
psad sources that does not install any perl modules.
- Updated to use the normal system whois client if the /usr/bin/whois_psad
path does not exist, and moved the whois/ directory into the deps/
directory. This removes /usr/bin/whois_psad as a strict dependency.
- Bugfix to honor the IPT_SYSLOG_FILE variable in --Analyze-msgs mode.
- Switched from the deprecated bleeding-all.rules file to the new
emerging-all.rules available from Matt Jonkman at Emerging Threats
(http://www.emergingthreats.net).
psad-2.1.3 (06/07/2008):
- Updated to enable IPT_SYSLOG_FILE by default. This is a relatively
important change since it changes the method of acquiring iptables log
data from reading it out of named pipe from syslog to just parsing the
/var/log/messages file. This implies that kmsgsd does not have to run,
and that it is much easier to ensure that psad actually receives
iptables log messages. The most complex and error prone aspect of psad
in the past has been the reconfiguration of the various syslog daemons
out there (which have very different configuration syntax and features)
to write kern.info messages to the /var/lib/psad/psadfifo named pipe.
- Updated to version 4.7.26 of the whois client from Marco d'Itri. This
allows whois records for some addresses (such as 116.125.35.98, which
which was scanning a system running psad but could not be identified
under the older whois client) to be properly queried.
- Updated to Bit::Vector 6.4 from 6.3.
- Updated to Date::Calc 5.4 from 5.3.
- Updated to Storable 2.18 from 2.16.
psad-2.1.2 (04/03/2008):
- Bugfix to not include kernel timestamps in iptables log prefixes that
contain spaces like "[ 65.026008] DROP" (bug reported by Erik Heidt).
- Bugfix to skip non-resolved IP addresses (bug reported by Albert Whale)
- Better p0f output in --debug mode to display when a passive OS
fingerprint cannot be calculated based on iptables log messages that
include tcp options (i.e., with --log-tcp-options when building a LOG
rule on the iptables command line).
psad-2.1.1 (01/25/2008):
- Added a new feature whereby psad can acquire iptables log data just by
parsing an existing file (/var/log/messages by default) that is written
to by syslog. By default, psad acquires iptables log data from the
/var/log/psad/fwdata file which is written to by kmsgsd, but on some
systems, having syslog communicate log data to kmsgsd can be problematic
since syslog configs and external factors such as Apparmor and SELinux
can play a role here. This new feature is controled by two new
configuration variables "ENABLE_SYSLOG_FILE" (to enable/disable the
feature) and "IPT_SYSLOG_FILE" to specifiy the path to the file to
parse.
- Better installation support for various Linux distributions including
Fedora 8 and Ubuntu. The current runlevel is now acquired via the
"runlevel" command instead of attempting to read /etc/inittab (which
does not even exist on Ubuntu 7.10), and there are new command line
arguments --init-dir, --init-name, and --runlevel to allow the init
directory, init script name, and the runlevel to be manually specified
on the install.pl command line.
- Updated psad to automatically handle situations where the either the
/var/log/psad/fwdata file or the /var/log/messages file (whichever
syslog is writing iptables log messages to) gets rotated. The
filehandle is closed and reopened if the file shrinks or if the inode
changes. This strategy is borrowed from how the fwknop project deals
with the filesystem packet capture file.
- Minor bugfix to generate syslog message when restarting a psad process.
- Updated install.pl to set the LC_ALL environmental variable to "C"
This should address some issues with installing psad on non-English
locale systems.
- Updated install.pl to be compatible with the rsyslog daemon, which is
commonly installed on Fedora 8 systems.
psad-2.1 (10/19/2007):
- Changed EMAIL_LIMIT model to apply to scanning source addresses only
instead of also factoring in the destination address. The original
src/dst email limit behavior can be restored by setting a new variable
"ENABLE_EMAIL_LIMIT_PER_DST" to "Y".
- Added the patches/iptables-1.3.8_LOG_prefix_space.patch file which can
be applied to the iptables-1.3.8 code to enforce a trailing space
character before any log prefix when a LOG rule is added. This ensures
that the user cannot break the iptables syslog format just by forgetting
to include a space at the end of a logging prefix.
- Bugfix to ensure that parsing TCP options does not descend into an
infinite loop in some some circumstances with obscure or maliciously
constructed options. Also added syslog reporting for broken options
lengths of zero or one byte (the minimum option length is two bytes to
accomodate the TLV encoding).
- Bugfix to enforce the usage of --CSV-fields in --gnuplot mode.
- Implemented --get-next-rule-id so that it is easy to assign a new rule
ID to a new signature in the /etc/psad/signatures file.
- Updated to just call die() if GetOpt fails; this allows erroneous usage
of the command line to display informative error messages more clearly.
psad-2.0.8 (07/27/2007):
- Added --gnuplot mode so that psad can output data that is suitable for
plotting with gnuplot. All output produced in this mode is integer data
with the exception of date stamps that are derived from iptables syslog
messages.
- Added the ability to negate match conditions on fields specified with
the --CSV-fields argument by prepending the string "not" (which plays
more nicely with shells like bash than a character like "!"). For
example, to graph all packet data in --gnuplot or --CSV modes that
originates from the 11.11.0.0/16 subnet and is not destined for port
80, the following argument does the trick:
--CSV-fields "src:11.11.0.0/16 dp:not80"
- In --gnuplot mode, added the ability to generate the count for a CSV
field instead of the field itself. Supported modes are an absolute
count (<field>:count) , and a unique count (<field>:uniqcount). This
is useful to plot graphs of source IP vs. the number unique ports for
example. Also added the ability to count iptables log fields over
various time scales (minutes, hours, and days) with the following
switches: <field>:countday, <field>:counthour, <field>:countmin.
- In --gnuplot mode, added the ability to specify the view coordinates
for 3D graph viewing with --gnuplot-view.
- Added the Storable-2.16 module along with the --use-store-file argument
so that in --gnuplot mode the Gnuplot data can be stored on disk and
retrieve quickly. This eliminates a large performance bottleneck when
Gnuplot configuration directives are tweaked while the same graph is
generated multiple times.
- Added --gnuplot-template so that a template file can be used for all
Gnuplot directives (usually psad creates the .gnu file based on the
--gnuplot command line arguments).
- Added --gnuplot-grayscale to generate graphs without the default red
color for graph points.
- Bugfix for regular expressions not being imported correctly from within
the --CSV-fields argument.
- Added --analysis-fields so the iptables log messages that are parsed in
-A mode can be restricted to those that meet certain criteria. For
example, to restrict the analyze mode to process packets with a source
address of 192.168.10.1, use this command:
psad -A --analysis-fields "src:192.168.10.1"
- Added --plot-separator to allow the format of plot data (either in
--gnuplot or --CSV modes) to be influenced by the user.
- Added the ability to configure the syslog facility and priority via the
psad.conf file (see the SYSLOG_FACILITY and SYSLOG_PRIORITY variables).
- Updated psad.spec file to respect the %_initrddir RPM macro.
psad-2.0.7 (05/28/2007):
- Bugfix to define a custom 'source' definition for syslog-ng daemons -
this fixes a problem on SuSE systems where the existing syslog-ng
reconfig caused the daemon to not start.
- Bugfix to allow specific signatures to be ignored by setting SID values
of zero in /etc/psad/snort_rule_dl.
- Added -X command line argument to allow the user to delete any psad
chains (in auto-response mode). This is a synonym for the iptables -X
command line argument.
psad-2.0.6 (03/24/2007):
- Better integration with fwsnort; psad signature match syslog messages
and email alerts now include the fwsnort rule number (for fwsnort
version 0.9.0 and greater) and chain information.
- Added the Snort bleeding-all.rules signature file from the Bleeding
Snort project (see http://www.bleedingsnort.com).
- Bugfix to allow interfaces that have IP aliases.
- Added uname, ifconfig, and syslog process information to --Dump-conf
output (this can help diagnose various runtime issues).
- Changed the --Lib-dir command line argument to --lib-dir, and added
--List (similar to iptables) to list the psad auto-blocking chain rules.
- Added psad.SlackBuild script contributed by pyllyukko for building psad
on Slackware systems. It uses the Cipherdyne cd_rpmbuilder script to
first build and RPM, and then uses it to build a Slackware package.
psad-2.0.5 (03/01/2007):
- Consolidated all configuration variables into the /etc/psad/psad.conf
file. The kmsgsd.conf, psadwatchd.conf, alert.conf, and fw_search.conf
files were all removed since the daemons just reference the psad.conf
now. Updated install.pl to archive and remove these files if they
exist from a previous psad installation.
- Bugfix to account for iptables -nL output where the protocol may be
reported as "0" instead of "all".
- Added a function safe_malloc() for kmsgsd.c and psadwatchd.c to ensure
that a single API is used to perform a NULL check on heap-allocated
memory.
- Bugfix to ensure that the psad_ip_len signature matching keyword is
checked withing match_snort_ip_keywords() so that it applies to all
protocol packets. This fixes a bug that would cause the "PSAD-CUSTOM
Nachi worm reconnaisannce" signature to fire on normal ICMP packet log
messages.
- Added version and Subversion file revision numbers to die and warn
messages that are written to /var/log/psad/errs/. This helps when
trying to track these messages down to a specific file revisions when
psad is being upgraded on the local system.
- Added version and Subversion file revision numbers to --Dump-conf
output.
- Minor update to allow --fw-dump to be used on the command line without
also having to use the -D argument.
- Updated the default_log() function in the IPTables::Parse module to
handle iptables policies that were dumped with -v, such as when
--Dump-conf is used.
psad-2.0.4 (01/27/2007):
- Added Snort rule matches to syslog alerts. Multiple matches can be
controlled with new configuration variables in psad.conf:
ENABLE_SIG_MSG_SYSLOG, SIG_MSG_SYSLOG_THRESHOLD, and
SIG_SID_SYSLOG_THRESHOLD.
- Bugfix to include scanned UDP port ranges in syslog alerts.
- Bugfix to parse SEQ and ACK iptables log message fields (requires
--log-tcp-sequence on the iptables command line). This allows the ipEye
signature to work.
- Added --debug-sid to allow a specific Snort rule to be debugged while
psad runs it through its detection engine. A consequence of this is
that the -d command line argument must be spelled out, i.e. "psad
--debug".
- Bugfix to allow logging prefixes to omit trailing spaces. This is a bug
in the iptables logging format to allow this in the first place, but
before this gets fixed psad needs to compensate.
- Bugfix for syslog-ng init script path in install.pl.
- Bugfix to include a "source" definition for /proc/kmsg if not already
defined for syslog-ng daemons.
- Minor memory handling bugfixes discovered by valgrind the excellent
Valgrind project: http://www.valgrind.org
psad-2.0.3 (12/31/2006):
- Removed Psad.pm perl module and kmsgsd.pl and psadwatchd.pl scripts.
This is a major change that allows psad to be more flexible and
completely derive its config from the psad.conf file and from the
command line. In the previous scheme, psad imported its config with a
function within Psad.pm, and this required that psad imported the Psad
perl module before reading its config. A consequence was that the
PSAD_LIBS_DIR var could not be specified usefully within the config
file.
- Added the ability to recursively resolve embedded variables from *.conf
files (with a limit of 20 resolution attempts).
- Added IGNORE_KERNEL_TIMESTAMP so that Linux distros that add a timestamp
to all kernel messages (Ubuntu for example) can be ignored.
- Consolidated code to import data out of /var/log/psad/<ip> directories
with code to display status and analysis output (-S and -A).
Essentially the %scan hash is built by the filesystem data import
routine and the remainder of the code references this single data
structure.
psad-2.0.2 (12/23/2006):
- Added the ability to download the latest signatures from cipherdyne.org
in install.pl.
- Added the cd_rpmbuilder script to make it easy to build RPM's out of
CipherDyne projects by automatically downloading the project .tar.gz and
.spec files from http://www.cipherdyne.org/.
- Added print statements for @INC array in debug mode so that the user can
see the additional /usr/lib/psad/* directories added by
import_psad_perl_modules().
- Changed Unix::Syslog import strategy from "use" to "require" since the
path is not known until import_psad_perl_modules() gets a chance to
run (psad ran fine without this, but it is more consistent this way).
- Bugfix for not properly including elements of the
@connected_subnets_cidr array.
- IP subnet bugfix to make sure to get the entire subnet in signature
import routine if it is not in CIDR format
- Bugfix to not print an IP addresses in the "top attackers" section that
do not have at least one packet or signature match (for any reason).
- Bugfix to not print more than TOP_IP_LOG_THRESHOLD IP addresses in thet
top attackers section.
- Updated install.pl to reference configuration paths directly from
psad.conf instead of defining them separately. This should fix Debian
bug #403566.
- Added -c argument to install.pl so that the path to a psad.conf file
can be altered from the command line.
- Bugfix to not import any IP from the top_attackers file from a previous
psad run that does not have a /var/log/psad/<ip> directory.
- Added MIN_DANGER_LEVEL to allow all alerts and /var/log/psad/<ip>
tracking to be disabled unless an attacker reaches at least this
danger level.
- Added text in install.pl to mention ifconfig parsing for HOME_NET
derivation.
psad-2.0.1 (12/12/2006):
- Added Nachi worm reconnaisannce icmp signature
- Added the psad_ip_len signature keyword to allow the length field in the
IP header to be explicitly tested.
- Bugfix for inappropriately removing some directories in @INC when
splicing in psad perl module paths.
- Switched nf2csv installation path in install.pl to /usr/bin/.
psad-2.0 (12/10/2006):
- Completely refactored the Snort rule matching support in psad. Added
many header field tests with full range matching support. These tests
include the following keywords from Snort: ttl, id, seq, ack, window,
icmp_id, icmp_seq, itype, icode, ip_proto, ipopts, and sameip.
- Refactored all signatures in /etc/psad/signatures to conform to new
signature matching support in this release. There are now about 190
signatures that psad can run directly against iptables logging
messages (i.e. without the help of fwsnort).
- Added the ability to download the latest signatures file from
http://www.cipherdyne.org/psad/signatures with the --sig-update command
line argument to psad.
- Added "MISC Windows popup spam" signature. This allows psad to detect
when attempts are made to send spam via the Windows Messenger service.
- Completely reworked --Status and --Analyze output, signature matches
are included now, along with a listing of top sig matches, top scanned
ports, and top attackers. Also, scan data is not written to
/var/log/psad/ipt_analysis/ before display analysis output in -A mode;
analysis results are displayed much faster this way.
- Added ipEye, Subversion, Kuang2, Microsoft SQL, Radmin, and Ghostsurf
signatures.
- Added 'data in TCP SYN packet' signature.
- Added --CSV mode so that psad can be used to generate comma-separated
value output suitable for the AfterGlow project (see
http://afterglow.sourceforge.net/index.html) for graphical
representations of iptables logs and associated scan data. Also added
nf2csv so that normal users can take advantage of this feature.
- Added emulation of the Snort "dsize" test through the use of the IP
length field for TCP/ICMP signatures, and the UDP length field for UDP
signatures. For SYN packets, TCP options are included so psad
automatically adds 44 bytes (the maximum length for TCP options) so the
dsize test corresponds to the estimated payload length.
- Added the psad_id, psad_dsize, and psad_derived_sids fields for the new
Snort rule support.
- Added the ability to decode IP options, which are included within Snort
rules as the "ipopts" keyword. This functionality requires that the
--log-ip-options command line argument is given to iptables when
building a rule that uses the LOG target.
- Added Snort rules (sids 475, 500, 501, and 502) that detect IP options
usage such as source routing and the traceroute IP option with the new
IP options decoder.
- Enhanced psad email alert output to include sid values that have been
derived from existing Snort rules.
- Added the ability to expand embedded variables within the psad
configuration files. For example, the path to the FW_DATA_FILE is
defined in psad.conf as "$PSAD_DIR/fwdata", which resolves to
/var/log/psad/fwdata when the PSAD_DIR variable is expanded. This
feature allows a consistent set of file paths to easily be defined
instead of using the full path for each file path.
- Better validation of IPT_AUTO_CHAIN{n} variables so that the from_chain
cannot be identical to the to_chain.
- Added dump_config() to psadwatchd.c and kmsgsd.c when compiled with
debugging support.
- Added ENABLE_INTF_LOCAL_NETS to have psad automatically treat all IP
addresses that are part of the local system as belonging to the HOME_NET
for signature matching.
- Added ENABLE_SNORT_SIG_STRICT to have psad exit if there are any
problems found with Snort rules in the /etc/psad/signatures file. If
this feature is disabled (this is the default), then psad generates
syslog warnings for improperly formatted signatures).
- Update to print the number of IP addresses at each danger level in -A
analysis mode. This is useful to get a sense for how long the disk IO
might take to write out all of the /var/log/psad/ipt_analysis/<IP>
directories.
- Added code to restart kmsgsd at psad start up if a previous kmsgsd
process is still running and TRUNCATE_FWDATA is set to 'Y' (this is the
default). This probably isn't strictly necessary because kmsgsd is
capable of writing to the fwdata file even if another process truncates
it.
- Added code to recreate the AUTO_IPT_SOCK (/var/run/psad/auto_ipt.sock)
file if some other process happens to delete it out of /var/run/psad/
- Bugfix to allow backwards compatibility with old NOT_USED value
for the HOME_NET variable.
- Bugfix to cleanup any lost blocking rules from the running psad
timeouts (a separate process might have deleted rules from the psad
chains).
- Bugfix to allow iptables log messages to include the PHYSDEV (i.e.
PHYSIN and PHYSOUT) interfaces.
- Updated to read architecture-dependent perl module installation
directory out of /usr/lib/psad (e.g. "/usr/lib/psad/x86_64-linux")
before importing psad perl modules such as IPTables::Parse, etc. These
modules are now imported via "require" after the appropriate
directories have been added to @INC. This allows the RPM files to be
built on one system that builds @INC differently than the system where
psad is actually installed since psad can now compensate for this.
- Added new code to populate the <dst>_signature file in each of the
/var/log/psad/<ip> directories with verbose information including the
signature time, sid, protocol, dst port, and packet count.
- Changed --interval to --Interval, and added --interface to allow
psad's detection to be limited to a specific IN interface for the INPUT
and FORWARD chains (or OUT interface for the OUTPUT chain).
- Replaced --status-brief with --status-summary, but changed it so that
only the detailed IP status information is omitted.
- Removed unnecessary --status-sort-dl option.
- Added STATUS_OUTPUT_FILE so the --Status and --Analyze output is
captured instead of just being lost if the output was not piped to
'less' or another similar program.
- Added --restrict-ip so that psad will restrict its attack detection
operations to a specific IP or network.
- Updated psadwatchd.c to parse EMAIL_ADDRESSES out of
/etc/psad/psad.conf to avoid duplication of variables.
- Bugfix to clear old @ipt_config array after receiving a HUP signal.
This bug broke the auto-blocking mode.
- Bugfix for syslog-ng config so that any custom source for /proc/kmsg is
used for the psadfifo path.
psad-1.4.8 (10/15/2006):
- Added the ability to get the auto-blocking status for a specific IP
address in --status-ip mode.
- Bugfix to use the IPT_OUTPUT_FILE and IPT_ERROR_FILE configuration
variables.
- Bugfix to restore "start" functionality in Gentoo init script.
- Added the ability to selectively disable psad auto-blocking emails.
- Added more rigorous IP matching regex from Sebastien J. (contributed
originally for fwknop).
psad-1.4.7 (09/10/2006):
- Completely re-worked IPTables::ChainMgr to support the return of
iptables error messages that are collected via stderr. This is critical
to fixing a bug where psad would sometimes die on an iptables command
but no information would be returned to the user.
- Added the ability to specify the position for both the jump rule into
the psad chains as well as the position for new rules within the psad
chains via the -I argument to iptables. This fixes a bug where the user
was given the impression that the IPTABLES_AUTO_RULENUM would accomplish
this.
- Populated the _debug option in the IPTables::ChainMgr module, and also
added a _verbose option so that the specific iptables commands can
actually be seen as IPTables::ChainMgr functions are called.
- Added code to install.pl to ask the user if a manual restart of syslog
is ok upon an unsuccessful test of the syslog reconfiguration. This
fixes a bug where some syslog daemons might not re-import their
configurations after receiving a HUP signal.
- Bugfix for incorrect config variable name that gated iptables
prerequisite checks.
- Added code to install.pl to update command paths in psad.conf and
psadwatchd.conf if any of the paths are broken (i.e. the local system
does not conform to the default paths). By default this only happens if
the user does not want old configs to be merged, but to override this
use the new --path-update command line argument to install.pl.
- Added the --Skip-mod-install command line argument to install.pl to
allow all perl module installs to be skipped.
- Added the --force-mod-regex command line argument to install.pl to allow
a regex match on perl module names to force matching modules to be
installed.
- Added the logrotate.psad file (contributed by Albert Whale).
psad-1.4.6 (06/13/2006):
- Added ENABLE_AUTO_IDS_REGEX and AUTO_BLOCK_REGEX to allow filtering on
logging prefixes.
- Added code to save DShield email to a file.
- Added IPTABLES_PREREQ_CHECK to allow the administrator to control the
frequency of iptables checks (for auto-block compatibility).
- Added IGNORE_LOG_PREFIXES to allow certain log prefixes to be completely
ignored by psad.
- Added classification.config file from Snort-2.3.3 so that psad can
assign danger levels based upon Snort rule class type. This is useful
when also running fwsnort.
- Added snort_rule_dl to allow specific psad to assign specific danger
level values to particular signatures. This is useful if you want to
do define certain Snort rules as being particularly evil (or not).
Running fwsnort is also necessary to take advantage of this feature.
- Added reference.config so that psad can include reference information in
email alerts that are derived from attacks detected by fwsnort.
- Updated to Snort-2.3.3 signatures.
- Updated to whois-4.7.13.
psad-1.4.5 (01/13/2006):
- Bugfix in IPTables::Parse to allow the limit target to apply to
logging rules.
- Made calls to chain creation and jump rule functions for only every
100 block calls in auto-IDS mode.
- Bugfix to make sure /var/run/psad directory exists at startup since
this directory is removed by some Linux distributions at boot time.
- Bugfix for zero masks in auto_dl; this allows a network of "0.0.0.0/0"
to be specified.
- Added ENABLE_FW_LOGGING_CHECK so that the iptables policy check can be
enabled/disabled easily via psad.conf.
- Enhanced -D output to include "uname -a" and "perl -V" output.
- Added ENABLE_RENEW_BLOCK_EMAILS to allow whether renew emails are sent
for auto-blocked addresses.
psad-1.4.4 (11/27/2005):
- Added MAC address reporting in psad email alerts. This feature is
enabled via a new config keyword "ENABLE_MAC_ADDR_REPORTING".
- Added --fw-rm-block-ip <ip> option to allow IP addresses to be removed
from the auto-blocking chains from the command line.
- Updated command line firewall arguments to write commands to the
AUTO_IPT_SOCK domain socket.
- Added the ability to specify ports and port ranges to auto_dl file.
- Added --force-mod-install command line argument to installer to force
perl modules used by psad to be installed within /usr/lib/psad
regardless of whether they already exist in the system perl tree.
- Bugfix in the installer to seek() to the end of the fwdata file
- Bugfix for psad repeatedly trying to remove the same IP address(es)
from the auto-blocking chains.
instead of reading the entire thing into memory.
- Added the ability to truncate the fwdata file via a new configuration
keyword "TRUNCATE_FWDATA" (this is enabled by default).
- Bugfix in auto-blocking mode for deleting AUTO_IPT_SOCK when a HUP
signal is received.
- Bugfix for parsing iptables policies that contain ULOG logging rules
instead of the standard LOG target.
- Removed the smtpdaemon requirement in the RPM because psad might be
configured to not send email alerts.
psad-1.4.3 (09/27/2005):
- Bugfixes for auto-blocking code. Timeouts should be handled
properly, including cached IP addresses in the auto_blocked_iptables
file that are referenced upon psad startup. Communication with the
running psad is performed over a Unix domain socket in --fw-block
mode.
- Bugfix to seek to the end of the fwdata file instead of reading the
entire thing into memory and then looking for newly written logging
messages. This drastically reduces the amount of memory required
by psad.
- Updated to only display psad chains if --verbose is set
- Updated to automatically flush the psad auto-response iptables chains
at start time (subject to a new config keyword "FLUSH_IPT_AT_INIT").
psad-1.4.2 (07/15/2005):
- Dependency bugfixes for mail binary.
- Bugfix for various IGNORE_* keywords not being honored.
- Bugfix for not timing out blocked IP addresses from a previous run.
- Updated to version 0.2 of the IPTables::ChainMgr module.
- Updated to not truncate the fwdata file upon psad startup.
- Added --fw-dump which produces a sanitized (i.e. no IP addresses)
version of the local iptables policy. Also added --fw-include-ips
to (optionally) not sanitize IPs/nets. Note that the 0.0.0.0 and
0.0.0.0/0 IPs/nets are not sanitized since they give no useful
information about specific IPs/nets.
- Added ulogd data collection mode.
- Bugfix for FW_MSG_SEARCH default (at least "DROP" is included now
even if FW_SEARCH_ALL is set to "N").
- Bugfix for non-network address for subnet specified with --fw-block.
- Bugfix for multiple --fw-block IPs/nets.
- Added README.SYSLOG (Francois Marier contributed the content).
- Made email alert prefixes (such as "[psad-alert]") customizable via
psad.conf.
psad-1.4.1 (03/12/2005):
- Updated to Snort-2.3 rules in the snort_rules directory.
- Re-worked syslog installation portion of install.pl. The user will
always be prompted to enter the syslog daemon now, and also added
the --syslog-conf arg to allow the config file path to be specified
on the install.pl command line.
- Bugfix in install.pl for using IP address instead of network address
of directly connected subnets.
- Updated to version 4.6.23 of the whois client.
- Bugfix for distinguishing OPT field associated with --log-tcp-options
vs. --log-ip-options.
- Bugfix for syslog format that may not include the "kernel:" tag.
- Applied patch to only install perl modules that are not already
installed (Blair Zajac).
- Bugfix for the psad version number that is sent in DShield alerts.
- Updated Psad module directory structure to be consistent with current
versions of perl (5.8.x).
- Added IPTables::ChainMgr module.
- Completely re-worked the iptables auto-blocking code to use
IPTables::ChainMgr functions so that auto-generated rules are placed
in chains created by psad.
- Added IPT_AUTO_CHAIN keyword in psad.conf which is used to define the
set of chains to which auto-generated iptables rules are added.
- Added --fw-list-auto to display the contents of psad iptables
chains.
- Added the ability to import an IP into the iptableiptablesocking
chains from the command line with --fw-block-ip. This allows psad to
apply its timeout mechanism against such IPs/nets.
- Added the ability to ignore packets based on input interface with
IGNORE_INTERFACES in psad.conf.
- Re-worked auto_dl code, better hash design and searching function.
- Removed dependency on sendmail command unless DShield alerting is
enabled and a DShield user id is specified.
- Added ALERTING_METHODS keyword in the file alert.conf to allow either
syslog or email alerts (or both) to be disabled. Psad and psadwatchd
reference this file.
psad-1.4.0 (11/26/2004):
- Added p0f-style passive OS fingerprinting through the use of the OPT
field in iptables log messages (which is only logged through the use
of the --log-tcp-options command line arg to iptables).
- Bugfix for iptables log messages that include tcp sequence numbers
(see the iptables --log-tcp-sequence command line argument).
- Bugfix for O_RDONLY open flag when kmsgsd receives a HUP signal.
psad-1.3.4 (10/17/2004):
- Bugfix for init script directory on Slackware systems.
- Bugfix for null prefix counters.
- Added --whois-analysis argument since whois lookups are now disabled