Software Release - psad-2.1.7
14 July, 2010
The 2.1.7 release of psad is available for
download. This release adds some
relatively minor functionality to switch whois lookups to the destination IP
whenever the source IP is part of a directly connected subnet. This change gives
better reporting data in normal psad email alerts. The complete
ChangeLog entries are displayed below. The psad-2.1.6 release was also made
a few days ago, and fixes a bug that caused psad to die on some Ubuntu systems
when using the Date::Calc Decode_Month() function, and it also added the
--Override-config feature so that alternate configuration variables can
be specified via config files besides psad.conf (implemented by Franck Joncourt).
- (Dan A. Dickey) Added the ability to use the "ip" command from the iproute2 tools to acquire IP addresses from local interfaces. Dan's description is as follows: "...A main reason for doing this is in the case of multi-homed hosts. ifconfig sets these up on an interface using aliases, iproute2 does not. So, for a multi-homed interface (eth0 with multiple addresses), ifconfig -a only shows the first one configured and not the rest. ip addr shows all of the configured addresses...".
- Added ENABLE_WHOIS_FORCE_ASCII to replace any non-ascii characters in
whois data (which is common with whois lookups against Chinese IP
addresses for example) with the string "NA". This option is disabled by
default, but can be useful if errors like the following are seen upon
receiving an email alert from psad:
<<< 554 5.6.1 Eight bit data not allowed
554 5.0.0 Service unavailable - Updated psad to issue whois lookups against IP addresses that are not directly connected to the local system. This is useful for example when an internal system is scanning an external destination system, and the scan is logged in the FORWARD chain. Issuing whois lookups on the internal system (frequently on RFC 1918 address space) is not usually very useful, but issuing the whois lookup against the destination system gives much more interesting data. This feature can be disabled with the new ENABLE_WHOIS_FORCE_SRC_IP variable.
