KMSGSD(8) System Manager's Manual KMSGSD(8)NAME
kmsgsd - separates iptables messages from all other kernel messages.
SYNOPSIS
kmsgsd
DESCRIPTION
kmsgsd reads messages from the /var/lib/psad/psadfifo named pipe and prints any firewall related log messages to the psad data file
"/var/log/psad/fwdata". psad cannot detect port scans or other suspect traffic without kmsgsd running on the machine. kmsgsd uses the
psad.conf configuration file which by default is located at /etc/psad/psad.conf, but a different path can be specified on the command line.
OPTIONS -c <config-file>
Specify path to config file instead of using the default configuration file /etc/psad/psad.conf.
-D Dump the configuration values that kmsgd derives from /etc/psad/psad.conf (or other override files) on STDERR.
-h Display usage information and exit.
-O <config-file>
Override config variable values that are normally read from the /etc/psad/psad.conf file with values from the specified file. Mul-
tiple override config files can be given as a comma separated list.
SEE ALSO psad(8), psadwatchd(8),
AUTHOR
Michael Rash (mbr@cipherdyne.org)
This manual page was written by Daniel Gubser <daniel.gubser@gutreu.ch> for the Debian GNU/Linux system (but may be used by others).
DISTRIBUTION
psad is distributed under the GNU General Public License (GPL), and the latest version may be downloaded from http://www.cipherdyne.org
Debian GNU/Linux November 2002 KMSGSD(8)
Check Out this Related Man Page
FWCHECK_PSAD(8) System Manager's Manual FWCHECK_PSAD(8)NAME
fwcheck_psad - look for iptables rules that log and block unwanted packets.
SYNOPSIS
fwcheck_psad [options]
DESCRIPTION
fwcheck_psad parses the iptables ruleset on the underlying system to see if iptables has been configured to log and block unwanted packets
by default. This program is called by psad , but can also be executed manually from the command line.
OPTIONS --config
Specify path to the psad configuration file. By default this is /etc/psad/psad.conf.
--fw-file
Allow the user to analyze a specific rulset from a file rather than the local policy.
--fw-analyze
Analyze the local iptables ruleset and exit.
--no-fw-search-all
Look for specific log prefix defined through the FW_MSG_SEARCH variable(s) in the configuration file.
--Lib-dir
Specify path to psad lib directory.
--help
Display the help message.
SEE ALSO iptables(8), psad(8)AUTHOR
Michael Rash <mbr@cipherdyne.org>
BUGS
Send bug reports to mbr@cipherdyne.org. Suggestions and/or comments are always welcome as well.
DISTRIBUTION
psad is distributed under the GNU General Public License (GPL), and the latest version may be downloaded from: http://www.cipherdyne.org/
Debian GNU/Linux Aug, 2008 FWCHECK_PSAD(8)
Hi gurus,
1st:
Is possible to detect port scanning just by using utilities included in linux (netstat, iptables...), Yes there is utility called psad but I would write some scripts for my own and learn something new :)
2nd:
Could you point me to good tutorial for writing own Intrusion... (1 Reply)