Software Release - psad-2.1.4
22 August, 2008
The 2.1.4 release of psad is available for
download. This release moves
all dependencies into a new deps/ directory - including all perl modules, Snort
rules files, and the whois client (from Marco d'Itri). This makes for a cleaner
integration of psad with the Debian Linux distribution, thanks to
Franck Joncourt. There are also a
couple of minor bugfixes and feature enhancements according to the
ChangeLog entries below. Finally, all cipherdyne.org projects are now signed
with a new GnuPG key available here.
- Restructured perl module paths to make it easy to introduce a "nodeps" distribution of psad that does not contain any perl modules. This allows better integration with systems that already have all necessary modules installed (including the IPTables::ChainMgr and IPTables::Parse modules). The main driver for this work is to make all cipherdyne.org projects easily integrated with distributions based on Debian, and Franck Joncourt has been instrumental in making this process a reality. All perl modules are now placed within the "deps" directory, and the install.pl script checks to see if this directory exists - a separate psad-nodeps-<ver> tarball will be distributed without this directory. The Debian package for psad can then reference the -nodeps tarball, and a new "psad-nodeps.spec" file has been added to build an RPM from the psad sources that does not install any perl modules.
- Updated to use the normal system whois client if the /usr/bin/whois_psad path does not exist, and moved the whois/ directory into the deps/ directory. This removes /usr/bin/whois_psad as a strict dependency.
- Bugfix to honor the IPT_SYSLOG_FILE variable in --Analyze-msgs mode.
- Switched from the deprecated bleeding-all.rules file to the new emerging-all.rules available from Matt Jonkman at Emerging Threats (http://www.emergingthreats.net).
