#19 psad - script for psad IDS

[jwbrock]

PSAD, also known as Port Scan Attack Detector, is a lightweight IDS that uses the snort signatures. I made a simple script to add a summary to logwatch: report the number of IP's blocked by PSAD after a portscan; the top-attackers and a list of countries from which the attackers operate.

For more people to make use of it, it can be added to the source...

I am new on sourceforge, so please help me to start.

[Bjorn]

Thanks for the files. I am not familiar with psad, but I do have some comments:

• I assume you're willing to post this under the MIT/X-Consortium license. The relevant header can be found in the script files. For example, you can execute head -25 scripts/services/named to obtain a standard version of it. Change the year and copyright holder, and prepend it to the scripts/services/psad script.
• Is the file location of $psadstatus hard-coded in the psad source? It is preferable to make it a configurable option, and can default to the value you've hard-coded in the script if not re-defined.
• Better to make use of the $Detail variable. The output all appears to be informational, so maybe the script can exit early if $Detail is less than some value (perhaps 5). The intent is that for $Detail = 0 only actionable output should be generated.
• I see that there is a system call to whois for each IP address. It appears that psad has some sort of whois functionality. Can that be enabled when starting the psad process, and then Logwatch simply processes the log files with the embedded whois info?