psadwatchd still not running and still firewall error after what I did
faxotherapy opened this issue · 1 comments
Hi,
I've got 3 issues.
Problem 1:
[-] psad: psadwatchd is not running on
[+] psad_fw_read (pid: 2256306) %CPU: 0.0 %MEM: 1.8
Running since: Wed Nov 8 10:34:48 2023
[+] psad (pid: 2256284) %CPU: 0.5 %MEM: 2.2
Running since: Wed Nov 8 10:34:48 2023
I have set ENABLE_PSADWATCHD
to Y
and I have followed the guide here: https://carteryagemann.com/psad-on-pi.html
psadwatchd does indeed start and run, but stops running after a few seconds.
Problem 2:
I still have an issue with firewall as mentioned by psad:
psad --fw-analyze
[+] Parsing INPUT chain rules.
[+] Parsing INPUT chain rules.
[-] Errors found in firewall config.
emailed to root@localhost
[+] Results in /var/log/psad/fw_check
[+] Exiting.
I have added the rules following this scheme:
-A INPUT -j LOG --log-tcp-options --log-prefix "[IPTABLES] "
-A FORWARD -j LOG --log-tcp-options --log-prefix "[IPTABLES] "
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT
Unfortunately, psad still find errors. I don't know what to do as I'm a perfect dum with iptables as I only use ufw front-end.
Problem 3:
Why do I keep having 2 psad processes at the same time:
2275815 ? 00:00:00 psad
2275835 ? 00:00:00 psad
Thanks for your help.
Problem 1 doesn't seem to be an issue.
Problem 2 solved: this is due to the fact I set IPV6
to no
in /etc/default/ufw
file.
Problem 3: still puzzled as to why I always have two running psad processes.
# ps ax -o ppid,pid,lstart,cmd | grep psad
1 2300796 Wed Nov 8 12:47:32 2023 /usr/bin/perl -w /usr/sbin/psad
2300796 2300816 Wed Nov 8 12:47:32 2023 /usr/bin/perl -w /usr/sbin/psad
603347 2303695 Wed Nov 8 12:55:14 2023 grep --color=auto psad