[RaspberryPi] psad(port scan attack detection) 설치

psad 는 iptables log messages 를 분석하여 port scan 등을 탐지하는 소프트웨어

기본 모니터링 구성 후 향후 차단까지 구성 예정

 

1. 설치

sudo apt update && sudo apt upgrade

sudo apt install psad -y

 

2. iptables 초기 셋팅

대충 하다보니... 안되는게 많아서 별도로 정리하여 게시

 

3. iptables 규칙 구성

# 트래픽 로깅 규칙
sudo iptables -A INPUT -j LOG
sudo iptables -A FORWARD -j LOG

 

4. psad 구성

# 메일서버 및 발송 민감도만 수정
sudo vim /etc/psad/psad.conf

# psad 정의 업데이트
sudo psad --sig-update

sudo service psad restart

# 모니터링
sudo service psad status

# 공유기 udp 패킷 및 nmap scan detected
##################################
Jan 08 00:10:20 raspberrypi psad[27677]: imported 206 psad Snort signatures from /etc/psad/signatures
Jan 08 00:10:20 raspberrypi psad[27671]: Starting Port Scan Attack Detector: psad.
Jan 08 00:10:20 raspberrypi systemd[1]: Started LSB: Port Scan Attack Detector (psad).
Jan 08 00:15:06 raspberrypi psad[27706]: scan detected ( -sU scan): 192.168.1.1 -> 192.168.1.30 udp: [33569-60531] udp pkts: 9 DL: 1
Jan 08 00:15:12 raspberrypi psad[27706]: scan detected ( -sU scan): 192.168.1.1 -> 192.168.1.30 udp: [38034] udp pkts: 1 DL: 1
Jan 08 00:15:18 raspberrypi psad[27706]: scan detected ( -sU scan): 192.168.1.1 -> 192.168.1.30 udp: [36058-60580] udp pkts: 6 DL: 2
Jan 08 00:15:24 raspberrypi psad[27706]: scan detected (Nmap -sT or -sS scan, -sU scan): 192.168.1.1 -> 192.168.1.30 udp: [39738-59945] tcp pkts: 19 udp pkts: 3 DL: 2
Jan 08 00:15:25 raspberrypi psad[27706]: scan detected (Nmap -sT or -sS scan, -sU scan): 192.168.1.1 -> 192.168.1.30 udp: [59878] tcp pkts: 16 udp pkts: 1 DL: 2

 

5. 참고

- https://github.com/mrash/psad

- https://www.digitalocean.com/community/tutorials/how-to-use-psad-to-detect-network-intrusion-attempts-on-an-ubuntu-vps

- http://www.cipherdyne.org/psad/docs/config.html#IPTABLES_AUTO_RULENUM