Re: [psad-discuss] Brute force attacks and statistics

[Franck J. <fra...@dt...>]

[...]
>> Should I avoid working this way?
> 
> I just scanned the doucmentation. And I see that fail2ban is quite 
> capable of notifiying you of its activity. So the questions are: Why 
> would do you want to work this hard? And why would you have your 
> computer do extra work (no matter how trivial) when you and it don't 
> need to?

I must admit you are right :)

I started with Michael's scripts and updated them to work with psad
rather than the psad fifo and kmsgsd. Then I moved to fail2ban for a try
but sticked to psad as well.

> What you can do is filter your incoming email to stick PSAD alerts in
>  one folder mail coming from fail2ban in another. You wouldn't need
> to keep track of the logs. These programs will do it for you. You can
>  just monitor your email; if you want to.

Ok, you have convinced me. I will move to a full fail2ban setup and work
as you said.

Thanks,

-- 
Franck Joncourt
http://debian.org - http://smhteam.info/wiki/