Stuart Cardall bedbf48969 /testing/PSAD - version bump to 2.2.3 ... Version bump to PSAD 2.2.3 ChangeLog psad-2.2.3 (03/01/2014): - Added compatibility with 'upstart' init daemons with assistance from Tim Kramer. This change adds a new config variable 'ENABLE_PSADWATCHD' that can be used to disable psadwatchd when deployed with upstart since it has built-in process monitoring and restarting capabilities. By default psadwatchd is not enabled anymore since this variable is set to "N". The reason for this change is that psad is extremely stable and so almost never needs to be restarted in practice, and process monitoring is better provided via other solutions (like upstart) anyway. In addition, a new init script located at init-scripts/upstart/psad.conf has been added that is compatible with upstart - this script is meant to be copied to the /etc/init/ directory. - (Wolfgang Breyha) Bug fix to allow VLAN interfaces and interface aliases in IGNORE_INTERFACES. This fixes issue #8 on github. - Bug fix to not modify /etc/hosts.deny permissions when removing tcpwrappers auto-block rules. This issue was reported as Debian bug #724267 (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=724267) and relayed via Franck Joncourt. Closes issue #7 on github. psad-2.2.2 (01/13/2014): - Added detection for Errata Security's "Masscan" port scanner that was used in an Internet-wide scan for port 22 on Sept. 12, 2013 (see: http://blog.erratasec.com/2013/09/we-scanned-internet-for-port-22.html). The detection strategy used by psad relies on the fact that masscan does not appear to set the options portion of the TCP header, and if the iptables LOG rules that generate log data for psad are built with the --log-tcp-options switch, then no options in a SYN scan can be seen. This is not to say that other scanning software always sets TCP options - Scapy seems to not set options by default when issuing a SYN scan like this either: http://www.secdev.org/projects/scapy/doc/usage.html#syn-scans There is a new psad.conf variable "EXPECT_TCP_OPTIONS" to assist with Masscan detection as well. When looking for Masscan SYN scans, psad requires at least one TCP options field to be populated within a LOG message (so that it knows --log-tcp-options has been set for at least some logged traffic), and after seeing this then SYN packets with no options are attributed to Masscan traffic. All usual psad threshold variables continue to apply however, so (by default) a single Masscan SYN packet will not trigger a psad alert. Masscan detection can be disabled altogether by setting EXPECT_TCP_OPTIONS to "N", and this will not affect any other psad detection techniques such as passive OS fingerprinting, etc. - RPM bug fix to include the protocols file.		2014-03-31 11:52:41 +00:00
..
APKBUILD	/testing/PSAD - version bump to 2.2.3	2014-03-31 11:52:41 +00:00
psad.confd
psad.initd