Skip to content
100644 478 lines (389 sloc) 18.5 KB
736f79f @mrash minor re-ordering
1 Albert E. Whale
2 - Discovered bug in 1.1 that made fw_check() too strict with looking for
3 precisely FW_MSG_SEARCH in a logging prefix instead of just looking
4 for FW_MSG_SEARCH _within_ the logging prefix.
5 - Suggested use of CPAN downloads of perl modules in
6 - Bugfix for "-" character missing from Mandrake version of ps.
7 - Bugfix for duplicate lines for tcpwrapper auto block IPs in
8 /etc/hosts.deny.
9 - Lots of great testing and feedback on new versions and -pre releases.
10 - Suggested the ability to re-import scanning IP directories.
11 - Bugfix for zero print_scale_factor in --Analyze-msgs mode.
12 - Bugfix for auto-ignored addresses appearing in DShield alerts.
13 - Bugfix for not timing-out blocked IP addresses from a previous psad
14 execution.
15 - Suggested putting -pre release versions in psad to make
16 troubleshooting easier.
17 - Discovered bug in syslog() message generation and --fw-block arg.
18 - Lots of great testing for auto-blocking code... even contributed
19 root access on some systems to help troubleshoot.
20 - Suggested socket communication in --fw-block mode.
21 - Contributed the logrotate.psad file.
0ebdea8 @mrash more stuff for Albert
22 - Suggested that the AUTO_IPT_SOCK file get recreated if some other
23 process comes in and deletes it.
6c18608 @mrash more stuff for Albert
24 - Suggested psadwatchd parse EMAIL_ADDRESSES from psad.conf.
25 - Found bug where auto-blocking stops working after receiving a HUP
26 signal.
5e1aa72 @mrash additions for Albert
27 - Found bug for not properly including elements of the
61b09ee @mrash changed Unix::Syslog import style from use to require since the psad …
28 @connected_subnets_cidr array.
5e1aa72 @mrash additions for Albert
29 - Found bug for not using thresholds in "top attackers" section of
30 --Status output.
31 - Helped troubleshoot the PL_sv_undef issue for installation on Mandriva
32 systems.
48f330b @mrash another entry for Albert
33 - Discovered IP resolution bug in psad-2.1 for auto_dl lines.
736f79f @mrash minor re-ordering
1e1c779 @mrash added Nerijus Baliuna, re-worked format
35 Manual Caphina
36 - Greatly assisting in the first version of Bastille-NIDS which
37 eventually became psad.
39 Tim Schaller
40 - Identifying and submitting a patch for a particularly nasty bug for
41 multiple scanned IPs.
43 Bruce Meyer
44 - Psad testing and suggestions.
46 Peter Watkins
47 - (Bastille Linux) psad/iptables interaction.
49 Sweth Chandramouli
50 - (Bastille Linux) Various suggestions for psad and,
51 including help with various Perl vagaries.
53 Jay Beale
54 - (Bastille Linux) Excellent suggestions for psad reporting and enhanced
55 security, and also for integrating psad with Bastille.
57 Ramiro Morales
58 - Developed all pre-1.0 rpm packages of psad (see:
60 - Various suggestions for psad installation (such as FHS compatibility).
61 - Implemented init script patches.
63 Alexander Hoff
64 - Psad stress testing for kmsgsd.
66 Ryan Delany
67 - diskmond testing to help track down the "rdev" bug.
69 Damien Stuart
70 - Suggested the zombie reaper code for whois processes, and uid/gid
71 check.
72 - Excellent suggestions for coding practices and strategies.
74 Donnie Armstrong
75 - Suggested fix for incorrectly parsing ifconfig output (might have
76 previously included ipv6 interfaces).
78 Ryan Bebeau
79 - Suggested fix for AF_INET protocol error.
81 Cliff Rayman
82 - Helped track down a nasty bug in which psad would parse iptables
83 messages that included a dns name instead of just an ip address for
84 the src and dst.
85 - Performed lots of excellent testing and
86 troubleshooting.
88 Henry Jobst
89 - Bugfix in for chomp error.
91 Ray Curtis
92 - Found bug in kmsgsd for undefined $service lines.
93 - Comprehensive testing to help remove bugs including a difficult one in
94 which psad gets periodically restarted.
96 Manuel Santos
97 - Contributed the first bug report to help troublehshoot a potential bug
98 in psad/whois interaction.
99 - Suggested the auto blocking code should include support for tcp
100 wrappers, and that the auto-blocking alerts should be configurable.
102 L-P Sundqvist
103 - Suggested fix for tab vs. space bug in for
104 /etc/syslog.conf.
105 - Contributed design ideas to make psad run on linux distros that use
106 BSD-style init scripts.
108 Eric Sawler
109 - Suggested the ability to retain auto-blocked IPs even after a reboot.
111 C.Holman
112 - Found, reported, and helped troubleshoot a bug in the ipchains
113 protocol number to name mapping.
115 Mike McCandless
116 - Asked whether or not there is documentation for the various psad
117 configuration variables in psad.conf. The "PSAD CONFIGURATION
118 VARIABLES" section of the man page was the result.
120 Jason Czerak
121 - Found and submitted a fix for a bug in which an IP would not be
122 ignored even if it was given a 0 danger level in psad_auto_ips.
123 - Suggested using the PREROUTING iptables chain along with "-t mangle"
124 for the auto-blocking code.
126 Colin Rose
127 - Discovered and helped troubleshoot a bug introduced when psad and
128 bastille are installed on the same machine (bastille installs an older
129 version of psad).
131 Ugo Viti
132 - Discovered bug in auto-blocking code where the subject line would
133 incorrectly identify the action that had been taken.
134 - Discovered bug in subject line for alert emails not including the
135 source IP if reverse dns did not work.
136 - Suggested adding the FORWARD chain to the auto blocking code.
137 - Found bug for email alert being reached prematurely.
139 Leif Westlye
140 - Discovered a bug where psad would not allow commands to be different
141 than the <cmd>Cmd name. The bugfix allows someone to specify
142 "/usr/bin/mailto" for the mailCmd for example.
144 Daniel Gubser
145 - Wrote the diskmond, kmsgsd, and psadwatchd man pages.
146 - Suggested compatibility mods for syslog-ng.
147 - Develops and maintains Debian builds.
149 Amelia Lewis
150 - Provided information on syslog-ng configs.
152 Nick Temple
153 - Suggested sending alerts to
155 James N. Winner
156 - Discovered bug that prevented psad from detecting scans through the
157 iptables FORWARD chain.
159 David Krider
160 - Discovered iptables path bug on SuSE 8.2.
162 Ciapato Manfredi
163 - Reported psadwatchd bug where multiple useless processes were being
164 spawned.
166 Ben Alcala
167 - Helped troubleshoot diskmond utilization bug.
169 Sebastian Mastropiero
170 - Suggested bugfix for missing pipe character in psad man page for
171 psadfifo line in syslog.conf.
173 Jeff Lunglhofer
174 - Suggested bugfix for packet counters and multiple scan destinations,
175 bugfix for duplicate lines in auto-blocking files, and suggested
176 feature by which psad can add auto blocking firewall rules at
177 arbitrary points within a policy.
179 Ruben Vanhoutte
180 - Bugfix for incorrect path to psadfifo in config.
182 Stefan Divjak
183 - Suggested that psad ignore addresses such as,, and
184 local interface ips from auto blocking routines.
185 - Suggested a generic way to (un)block addresses using an external
186 script.
187 - Suggested psad offer analysis capabilities for snort alert files.
189 Martijn Kruissen
190 - Suggested putting danger levels into psad email alert subjects.
191 - Suggested custom logging line that that will trigger psad to auto
192 block an IP.
194 Jeffrey Sofferin
195 - Lots of great testing for conditions that might cause psad to die.
196 - Bugfix in man page for -HUP option.
197 - Suggested the --status-dl option.
199 - Found bug for 24 hour dshield alerting interval.
8c94e2d @mrash merged r1985:1997 from psad-2.0.5 branch
200 - Found bug for not preserving user modifications in auto_dl file.
5251014 @mrash more additions for Jeff S.
201 - Found bug on SuSE systems running syslog-ng where the syslog-ng.conf
202 reconfig added by psad caused the daemon to not start.
0cb9995 @mrash updates for Jeff S.
203 - Found initialization bug that caused signature danger levels to not
204 be properly assigned by the /etc/psad/snort_rule_dl file.
1e1c779 @mrash added Nerijus Baliuna, re-worked format
206 Kenneth Grande
207 - Suggested protocol-specific thresholds for email alerts.
209 Lenny Cartier
210 - Wrote a spec file for Mandrake Linux. An rpm built from this spec
211 file is in the user contribs section of the Mandrake site now.
213 Bryan Stine
214 - Wrote a psad ebuild script for inclusion in Gentoo Linux. As of the
215 1.2.4 release psad is included in the portage tree.
216 - Wrote a much-improved init script for Gentoo systems.
218 Zenon Panoussis
219 - Submitted patch for rpm spec that replaced the "Requires: sendmail"
220 line with "Requires: smtpdaemon".
222 Dennis Freise
223 - Submitted a patch to add metalog support to psad.
224 - Helped find kmsgsd bug for missing null string in buffer read from
225 psadfifo.
226 - Submitted patch for kmsgsd to open psadfifo in O_RDWR mode to fix a
227 bug where kmsgsd would spike the cpu if the system logger did not keep
228 the psadfifo open.
229 - Found and submitted patch for improper bounds checking in kmsgsd.c.
231 Richard K. Szabo
232 - Discovered and helped test a bug where psad was not honoring IP's/net
233 auto danger level assignments of 0 (ignore).
235 Stefan Rydberg
236 - Discovered a perl internal pp_match bug with psad-1.3.1 on SuSE 8.
237 - Helped troubleshoot -pre releases of psad-1.3.2.
238 - Provided a system on which to troubleshoot psad-1.3.3 (this
239 facilitated the isolation of the pp_match bug to an older version perl
240 on SuSE 8).
242 Joshua Jensen
243 - Found bug with the manner in which was being called
244 from psad (improperly passing --no-fw-search-all option even if
245 FW_SEARCH_ALL was set to "Y").
247 Mate Wierdl
bca54ca @mrash updates for Albert and for Mate W.
248 - Found bug in EMAIL_ADDRESSES format (psad needed to allow addresses
1e1c779 @mrash added Nerijus Baliuna, re-worked format
249 separated by commas).
250 - Submitted patch for new init-scripts directory for psad.spec file.
bca54ca @mrash updates for Albert and for Mate W.
251 - Contributed patch for building the psad RPM on x86_64 platforms.
1e1c779 @mrash added Nerijus Baliuna, re-worked format
690d191 @mrash minor fix to allow easier HTML page generation for contributors listing
253 Stefan (unknown)
1e1c779 @mrash added Nerijus Baliuna, re-worked format
254 - Sugggested permissions fix for world readable files in /var/log/psad.
256 David Jacobs
257 - Troubleshooting firewall parsing code, lots of great beta testing
258 (see:
690d191 @mrash minor fix to allow easier HTML page generation for contributors listing
260 Lucas (unknown)
1e1c779 @mrash added Nerijus Baliuna, re-worked format
261 - Suggested fix for init script directory for Slackware Linux systems.
263 Peter Abraham
264 - Help testing bugfix for auto_dl code.
265 - Suggested EMAIL_LIMIT_STATUS_MSG variable to make email limit status
266 messages optional.
268 James Lay
269 - Suggested support for OUTPUT chain in auto-blocking mode.
271 Yuen Boon Jee
272 - Found bug in psad init scripts for requiring syslogd config file even
273 if syslog-ng is installed.
275 Michael S. Zick
276 - Bugfix for O_RDONLY open flag when kmsgsd receives a HUP signal.
277 - Bugfix for psad validation routine that did not accept "0" for a
cbed8f9 @mrash added Nerijus Baliuna
279 - Suggested the ability to maintain dedicated chains for the iptables
280 auto-blocking code.
1e1c779 @mrash added Nerijus Baliuna, re-worked format
282 Nerijus Baliuna
283 - Suggested ability to ignore entire protocols. The IGNORE_PROTOCOLS
284 keyword was the result.
285 - Suggested adding various psad docs (CREDITS, ChangeLog, INSTALL,
286 etc.) to be installed by the psad rpm
287 - Suggested the ability to have psadwatchd not send emails even if psad
288 dies and has to be restarted.
61b0b5c @mrash added Michael Hadjimichael
290 Michael Hadjimichael
291 - Bug report for syslog format that does not necessarily have the
292 "kernel:" tag.
81351b0 @mrash added Blair Zajac
294 Blair Zajac
295 - Submitted patch to not install perl modules in that are already
7266e91 @mrash .
296 installed in the system perl lib tree (this was originally submitted
297 as a patch for fwknop).
298 - Found bug with perl module file paths and naming convention (this bug
299 resulted in some modules being needlessly installed). This find was
300 originally for fwknop.
5476576 @mrash -O suggestion from Blair
301 - Suggested the -O optimization in Makefile (originally suggested for the
302 fwknop project).
ed57401 @mrash added Troy Swaine
304 Troy Swaine
305 - Suggested a command line interface to block IP addresses. The result
306 is the --fw-block-ip argument.
cbed8f9 @mrash added Nerijus Baliuna
308 Najib Bakari
309 - Pointed out that sendmail is not usually required to run psad. The
310 result is the alert.conf file with the ALERTING_METHODS keyword,
311 which also gets referenced by psadwatchd.
2632694 @mrash Added Sam Weiss, most stuff for Albert
313 Sam Weiss
314 - Suggested that psad default FW_MSG_SEARCH to "DROP" if no strings are
315 defined in fw_search.conf.
8d56a1a @mrash added README.SYSLOG
317 Francois Marier
318 - Contributed REAME.SYSLOG content to help troubleshoot psad and syslog.
1800208 @mrash Added Nathan Colt
320 Nathan Colt
321 - Suggested customizable email subjects.
6320360 @mrash added Alex Luna
323 Alex Luna
324 - Suggested ULOG support.
17a5fd6 @mrash implemented the ability to assign danger levels based on tcp/udp port…
326 Torkel Hasle
327 - Suggested the ability to assign danger levels based on ports in
328 addition to the protocol in auto_dl. Suggested better sweep detection
329 by calculating scan danger levels over all destinations (i.e. 5 packets
736f79f @mrash minor re-ordering
330 to different destinations should trigger danger level 1).
03ce87c @mrash Added SiO
332 SiO
333 - Reported bug with zero masks in auto_dl file.
bc1f4d2 @mrash added Jeroen Vermeulen
335 Jeroen Vermeulen
336 - Suggested that psad collect and report errors that are returned by
337 broken iptables commands to the user. This resulted in a redesign of the
338 IPTables::ChaingMgr module to collect both stdout and stderr from all
339 iptables commands.
340 - Found bug where IPTABLES_AUTO_RULENUM misled the user into thinking that
341 it governed where the jump rule into a custom chain is added within the
342 calling chain. This resulted in the IPT_AUTO_CHAIN{n} variables being
343 updated to support the rule position for both the jump rule and any new
344 rules within the chain.
0ec42ab @mrash Added the ability to disabled auto-blocking emails
346 Adam Mottershead
347 - Suggested the ability to disable psad email alerts about auto-blocking
348 events.
245f5f3 @mrash Bugfix for syslog-ng config so that any custom source for /proc/kmsg …
350 Richard B\351neyt
351 - Suggested syslog-ng enhancement to allow a custom source path for
352 /proc/kmsg to be defined for the psadfifo file.
17a0ab9 @mrash added Philip Lawrence for perl module path import fix
354 Philip Lawrence
355 - Contributed patch to fix module path import bug. This resulted in the
356 psad-2.0.1 release.
d34c7bd @mrash added Stefano Harding
358 Stefano Harding
359 - Reported bug that caused psad to not acquire iptables data on systems
360 running syslog-ng when there is no "source" definition for /proc/kmsg.
3b063f7 @mrash Added Aki Tuomi
362 Aki Tuomi
363 - Reported bug where iptables might report '0' instead of 'all' for the
364 protocol under the -nL output.
713a32e @mrash added pyllyukko's psad.SlackBuild script
366 pyllyukko
367 - Contributed the psad.SlackBuild script for building psad on Slackware
368 systems.
91af474 @mrash update for pyllyukko
369 - Suggested that the psad.spec file respect the %_initrddir RPM macro.
370 - Suggested configurable syslog facility and priority settings.
55f6a8f @mrash additions for pyllyukko
371 - Contributed a suspicious iptables log message that contained a broken
372 set of TCP options. This exposed a bug where psad would consume all
373 available memory on the system and would have to be killed. The result
374 is an additional check to ensure that the length fields parsed from TCP
375 options are greater than one byte; otherwise, the TLV encoding doesn't
376 work out properly.
8c519bb @mrash added Christian Lyra
378 Christian Lyra
379 - Found off-by-one error in number of email alerts that are reported under
380 --Status output.
e5aa57b @mrash added James Neff
382 James Neff
383 - Provided solution for getting psad to run in Fedora 8 systems by
384 pointing psad at the /etc/rsyslog.conf file.
baac108 @mrash added locale C setting for LC_ALL variable
386 Franck Joncourt
387 - Performed analysis of locale settings for fwknop installer and suggested
388 using the LC_ALL environmental variable instead of the LANG variable
389 (which is superseded by LC_* vars).
394fabf @mrash added deps/ blurb for Franck
390 - Suggested moving dependencies into the deps/ directory to build a common
391 architecture for bundling the projects for Debian.
b159985 @mrash dash fixes from Franck
392 - Submitted patches for documentation fixes in various psad man pages.
2177ad6 @mrash Applied patch from Franck Joncourt to fix missing check for the 'mail…
393 - Submitted patch to fix missing check against the 'mail' command for the
394 script.
168b9ea @mrash - Bug fix for local server ports not reported correctly under netstat
395 - Submitted patch to fix a bug where local server ports were not reported
396 correctly under netstat parsing.
d2314eb @mrash - (Franck Joncourt) Submitted patches to fix stderr redirection for the
397 - Submitted patch to correct mail binary usage to redirect stderr.
398 - Submitted patch to close stdout, stderr, and stdin when running as a
399 daemon.
636252d @mrash - (Franck Joncourt) Added --Override-config feature so that alternate
400 - Added --Override-config feature so that alternate configuration files
401 can be specified on the command line to override configuration variables
402 in the standard /etc/psad/psad.conf file.
90cbdba @mrash updated to include Sourcefire trademark mention
403 - Found psad man page section errors with manpage-alert.
a250e58 @mrash Added Erik Heidt
405 Erik Heidt
406 - Submitted patch to fix fwsnort sid reporting w.r.t. ending newline
407 chars.
cbaa681 @mrash psad-2.1.2-pre3
408 - Reported iptables log prefix bug where timestamps that include spaces
409 where not being excluded even when IGNORE_KERNEL_TIMESTAMP is set to
410 "Y".
f5cd766 @mrash added Andrew Kaplan
412 Andrew Kaplan
413 - Reported the inability of an older version of the bundled whois client
414 to query the whois information associated with certain IP addresses.
415 Updating to whois-4.7.26 solved the problem.
19f327f @mrash Bugfix to honor the IPT_SYSLOG_FILE variable in --Analyze-msgs mode (…
417 j.bakshi
418 - Reported a bug where IPT_SYSLOG_FILE was not being honored in -A
419 (analyze) mode.
26737cc @mrash - (Steve B) Submitted patch to fix a bug in the start() function in the
421 Steve B
422 - Submitted patch to fix a bug in the start() function in the Gentoo init
423 script which caused psad to not be started and the error "* ERROR: psad
424 failed to start" to be generated.
3293d85 @mrash added Miroslav Grepl
426 Miroslav Grepl
427 - Contributed policy files to make psad compatible with SELinux. The
428 files are located in a new "selinux" directory in the
429 psad sources.
ca3b4bf @mrash - Bug fix for Decode_Month() call in DShield processing code to ensure
431 Stephen Nims
432 - Reported 'Date::Calc::Decode_Month(): argument is not a string at
433 /usr/sbin/psad line 1103' bug. This affected DShield processing and a
434 few other areas.
65d5935 @mrash (Dan A. Dickey) Added the ability to use the "ip" command from the
436 Dan A. Dickey
437 - Submitted a patch to allow psad to use the "ip" command from the iproute2
438 tools to acquire IP addresses from local interfaces. Dan's description
439 is as follows: "...A main reason for doing this is in the case of multi-
440 homed hosts. ifconfig sets these up on an interface using aliases,
441 iproute2 does not. So, for a multi-homed interface (eth0 with multiple
442 addresses), ifconfig -a only shows the first one configured and not the
443 rest. ip addr shows all of the configured addresses...".
607556c @mrash - Added ENABLE_WHOIS_FORCE_ASCII to replace any non-ascii characters in
445 Graham Murray
446 - Reported a bug where 8-bit data included in some whois output causes mail
447 delivery problems with the following error:
449 <<< 554 5.6.1 Eight bit data not allowed
450 554 5.0.0 Service unavailable
452 The fix for this problem was the addition of the ENABLE_WHOIS_FORCE_ASCII
453 functionality.
e563300 @mrash - Updated psad to issues whois lookups against IP addresses that are not
455 Dean Takemori
456 - Reported a condition where whois lookups were being calculated always on
457 the source IP of suspicious traffic even if the source IP's were on
458 internal directly connected networks (frequently on RFC 1918 address
459 space). This report led to a change where whois lookups are now done
460 against non-local IP addresses by default (see the ENABLE_WHOIS_LOCAL
461 variable).
91a9183 @mrash - Bug fix for ICMP packet handling where psad would incorrectly inter…
463 Lukas Baxa
464 - Reported bug for ICMP packet handling where psad would incorrectly
465 interpret ICMP port unreachable messages as UDP packets because the UDP
466 specifics are included in the iptables log message.
e575fc6 @mrash changelog and credits update
468 @pyllyukko
469 - Suggested --install-root for the script so that psad can be
470 installed in a directory specified by the user.
471 - Suggested the ability to have read answers to queries from a
472 file in the filesystem in order to support easy automated installs of
473 psad.
e5ada77 @mrash INSTALL_ROOT resolution bug fix (found by Kat)
475 Kat
476 - Reported 'Could not resolve sub-var: INSTALL_ROOT to a value' error in
477 the legacy kmsgsd daemon for psad-2.2.
Something went wrong with that request. Please try again.