Port Scan Attack Detector

A new feature whereby iptables log data can be acquired just by parsing an existing file (/var/log/messages by default) that is written to by syslog was added. Better installation support was provided for various Linux distributions, including Fedora 8 and Ubuntu. Situations where either the /var/log/psad/fwdata file or the /var/log/messages file (whichever syslog is writing iptables log messages to) gets rotated are now handled automatically.

The EMAIL_LIMIT model was changed to apply to scanning source addresses only instead of also factoring in the destination address. The original src/dst email limit behavior can be restored by setting a new variable "ENABLE_EMAIL_LIMIT_PER_DST" to "Y". The patches/iptables-1.3.8_LOG_prefix_space.patch file was added, which can be applied to the iptables-1.3.8 code to enforce a trailing space character before any log prefix when a LOG rule is added. A fix was implemented to ensure that parsing TCP options does not descend into an infinite loop in some some circumstances with obscure or maliciously constructed options.

A --gnuplot mode was added so that psad can output data that is suitable for plotting with gnuplot. The ability to negate match conditions on fields specified with the --CSV-fields argument was added. The Storable-2.16 module was added along with the --use-store-file argument so that in --gnuplot mode the Gnuplot data can be stored on disk and retrieved quickly. --analysis-fields was added so the iptables log messages that are parsed in -A mode can be restricted to those that meet certain criteria.

A bugfix to define a custom 'source' definition for syslog-ng daemons (this fixes a problem on SuSE systems where the existing syslog-ng reconfig caused the daemon to not start). A bugfix to allow specific signatures to be ignored by setting SID values of zero in /etc/psad/snort_rule_dl. An -X command line argument to allow the user to delete any psad chains (in auto-response mode). This is a synonym for the iptables -X command line argument.

Integration with fwsnort was improved, so psad
signature match syslog messages and email alerts
now include the fwsnort rule number (for fwsnort
version 0.9.0 and greater) and chain information.
The Snort bleeding-all.rules signature file from
the Bleeding Snort project was added. uname,
ifconfig, and syslog process information were
added to --Dump-conf output. The psad.SlackBuild
script was added for building psad on Slackware
systems. It uses the Cipherdyne cd_rpmbuilder
script to first build an RPM, and then uses it to
build a Slackware package.