Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

psadwatchd still not running and still firewall error after what I did #80

Open
faxotherapy opened this issue Nov 8, 2023 · 1 comment

Comments

@faxotherapy
Copy link

faxotherapy commented Nov 8, 2023

Hi,
I've got 3 issues.

Problem 1:

[-] psad: psadwatchd is not running on
[+] psad_fw_read (pid: 2256306)  %CPU: 0.0  %MEM: 1.8
    Running since: Wed Nov  8 10:34:48 2023

[+] psad (pid: 2256284)  %CPU: 0.5  %MEM: 2.2
    Running since: Wed Nov  8 10:34:48 2023

I have set ENABLE_PSADWATCHD to Y and I have followed the guide here: https://carteryagemann.com/psad-on-pi.html

psadwatchd does indeed start and run, but stops running after a few seconds.

Problem 2:
I still have an issue with firewall as mentioned by psad:

psad --fw-analyze
[+] Parsing INPUT chain rules.
[+] Parsing INPUT chain rules.
[-] Errors found in firewall config.
    emailed to root@localhost
[+] Results in /var/log/psad/fw_check
[+] Exiting.

I have added the rules following this scheme:

-A INPUT -j LOG --log-tcp-options --log-prefix "[IPTABLES] "
-A FORWARD -j LOG --log-tcp-options --log-prefix "[IPTABLES] "

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT

Unfortunately, psad still find errors. I don't know what to do as I'm a perfect dum with iptables as I only use ufw front-end.

Problem 3:
Why do I keep having 2 psad processes at the same time:

2275815 ?        00:00:00 psad
2275835 ?        00:00:00 psad

Thanks for your help.

@faxotherapy faxotherapy changed the title psadwatchd still not running after configuration and still firewall error psadwatchd still not running and still firewall error after what I did Nov 8, 2023
@faxotherapy
Copy link
Author

faxotherapy commented Nov 8, 2023

Problem 1 doesn't seem to be an issue.
Problem 2 solved: this is due to the fact I set IPV6 to no in /etc/default/ufw file.
Problem 3: still puzzled as to why I always have two running psad processes.

# ps ax -o ppid,pid,lstart,cmd | grep psad
      1 2300796 Wed Nov  8 12:47:32 2023 /usr/bin/perl -w /usr/sbin/psad
2300796 2300816 Wed Nov  8 12:47:32 2023 /usr/bin/perl -w /usr/sbin/psad
 603347 2303695 Wed Nov  8 12:55:14 2023 grep --color=auto psad

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant