psad: pid file /var/run/psad/psadwatchd.pid does not exist for psadwatchd on ... about how-to-secure-a-linux-server HOT 6 CLOSED

This helped: https://carteryagemann.com/psad-on-pi.html
But when using psad -H it still says [-] psadwatchd daemon not running.

from how-to-secure-a-linux-server.

So it looks like you have to set another setting for psadwatchd to start. I will update the guide.

from how-to-secure-a-linux-server.

This helped: https://carteryagemann.com/psad-on-pi.html
But when using psad -H it still says [-] psadwatchd daemon not running.

in the config file adding (/etc/psad/psad.conf):
ENABLE_PSADWATCHD Y;
and then follow the instructions at https://carteryagemann.com/psad-on-pi.html
worked for me

from how-to-secure-a-linux-server.

Yup. I added the ENABLE_PSADWATCHD thing to my guide.

from how-to-secure-a-linux-server.

HIi, I'm still having the “psad: psadwatchd is not running on” after I added “ENABLE_PSADWATCHD Y;” and followed the above guide.

I also correctly added this in before.rules:

# log all traffic so psad can analyze
-A INPUT -j LOG --log-tcp-options --log-prefix "[IPTABLES] "
-A FORWARD -j LOG --log-tcp-options --log-prefix "[IPTABLES] "

However, I still see:

psad --fw-analyze
[+] Parsing INPUT chain rules.
[+] Parsing INPUT chain rules.
[-] Errors found in firewall config.
    emailed to root@localhost
[+] Results in /var/log/psad/fw_check
[+] Exiting.

Mail shows:

You may just need to add a default logging rule to the 'filter' 'INPUT' chain on

I'm not good with iptables.

from how-to-secure-a-linux-server.

I'm still having the “psad: psadwatchd is not running on” after I added “ENABLE_PSADWATCHD Y;”

psadwatchd does indeed start and run, but stops running after a few seconds. Is it expected?

psad --fw-analyze
[+] Parsing INPUT chain rules.
[+] Parsing INPUT chain rules.
[-] Errors found in firewall config.
emailed to root@localhost
[+] Results in /var/log/psad/fw_check
[+] Exiting.

This is due to the fact I set IPV6 to no in /etc/default/ufw file.

from how-to-secure-a-linux-server.