{"id":893,"date":"2010-07-05T15:15:30","date_gmt":"2010-07-05T15:15:30","guid":{"rendered":"http:\/\/pchero21.com\/?p=893"},"modified":"2010-07-05T15:15:30","modified_gmt":"2010-07-05T15:15:30","slug":"8-psad%eb%a5%bc-%ec%9d%b4%ec%9a%a9%ed%95%9c-%eb%8a%a5%eb%8f%99%ec%a0%81-%ec%9d%91%eb%8b%b5","status":"publish","type":"post","link":"http:\/\/pchero21.com\/?p=893","title":{"rendered":"8.psad\ub97c \uc774\uc6a9\ud55c \ub2a5\ub3d9\uc801 \uc751\ub2f5"},"content":{"rendered":"

 * \uce68\uc785 \ubc29\uc9c0\uc640 \ub2a5\ub3d9\uc801 \uc751\ub2f5<\/p>\n

 \uc624\ub298\ub0a0 \ub098\uc640 \uc788\ub294 \ub2e4\uc591\ud55c \ubcf4\uc548 \uc81c\ud488, \uae30\uc220, \uc194\ub8e8\uc158\uc5d0\uc11c \uce68\uc785 \ud0d0\uc9c0\ub77c\ub294 \uc6a9\uc5b4\ub294 \ud070 \uc8fc\ubaa9\uc744 \ubc1b\uc544\uc654\ub2e4. \uc774\ub7ec\ud55c \uc8fc\ubaa9\uc758 \ub300\ub2e4\uc218\ub294 \uc774 \uc6a9\uc5b4\uac00 \uc8fc\ub294 \uc9c0\ub098\uce58\uac8c \uac15\ud55c \uc758\ubbf8\uc5d0\uc11c \ub098\uc628\uac83\uc73c\ub85c \ubcf4\uc778\ub2e4. \ubb3c\ub860 \ubcf4\uc548 \uce68\ubd80\ub97c \uc0ac\uc804\uc5d0 \ubc29\uc9c0\ud55c\ub2e4\ub294 \uac1c\ub150 \uc790\uccb4\uac00 \uc7a5\uc810\uc774 \uc5c6\ub2e4\ub294 \ub73b\uc740 \uc544\ub2c8\ub2e4. \ub2e4\ub9cc \uce68\uc785 \ud0d0\uc9c0 \uae30\uc220\uc740 \ud638\uc2a4\ud2b8 \uc218\uc900 \uc2a4\ud0dd \uac15\ud654 \uae30\ubc95(http:\/\/pax.grseurity.net \uc758 PaX \ud504\ub85c\uc81d\ud2b8 \ucc38\uc870)\uc5d0\uc11c\ubd80\ud130 \uc545\uc758\uc801\uc778 \ud328\ud0b7\uc774 \uc758\ub3c4\ub41c \ubaa9\ud45c\uc5d0 \ub3c4\ub2ec\ud558\uc9c0 \ubabb\ud558\uac8c \ubc29\uc9c0\ud558\ub294 \ub3d9\uc2dc\uc5d0 \ub2e4\ub978 \ud2b8\ub798\ud53d\uc740 \ubaa8\ub450 \ud1b5\uacfc\uc2dc\ud0ac \uc218 \uc788\ub294 \uc18c\ud504\ud2b8\uc6e8\uc5b4\ub97c \uac16\ucd98 \uc778\ub77c\uc778 \ub124\ud2b8\uc6cc\ud06c \uc7a5\uce58\uae4c\uc9c0 \ub2e4\uc591\ud558\ub2e4.<\/p>\n

 \uc774\uc640 \ub2ec\ub9ac \ub2a5\ub3d9\uc801 \uc751\ub2f5\uc740 (\uacf5\uaca9\uc774 \ud0d0\uc9c0\ub41c \uacbd\uc6b0) \uacf5\uaca9\uc790\uc5d0\uac8c \ucde8\ud560 \uc218 \uc788\ub294 \uae30\ubc95\ub4e4\uc744 \ub9d0\ud558\uba70 \uc774\uac83\uc774 \uaf2d \uacf5\uaca9\uc744 \ubb34\ub825\ud654\ud558\ub294 \uae30\ubc95\ub9cc\uc744 \uc758\ubbf8\ud558\ub294 \uac83\uc740 \uc544\ub2c8\ub2e4. \ub2a5\ub3d9\uc801 \uc751\ub2f5\uc774 \ud56d\uc0c1 \ucd08\uae30 \uacf5\uaca9\uc744 \ub9c9\uc744 \uc218 \uc5c6\ub2e4\ub294 \uc0ac\uc2e4\uc774 \uc911\uc694\ud55c \ucc28\uc774\uba70, \uc774\uac83\uc774 \uce68\uc785 \ubc29\uc9c0\uc640 \ub2a5\ub3d9\uc801 \uc751\ub2f5 \uac04\uc758 \ucc28\uc774\uc810\uc744 \uba85\ud655\ud788 \uc11c\uc220\ud574\uc900\ub2e4.<\/p>\n

 * \ub2a5\ub3d9\uc801 \uc751\ub2f5\uc758 \ud2b8\ub808\uc774\ub4dc\uc624\ud504<\/p>\n

 \uc138\uc158 \ud30c\uad34(session-busting) \ud2b8\ub798\ud53d\uc744 \uc0dd\uc131\ud558\uac70\ub098 \ubc29\ud654\ubcbd \uc815\ucc45\uc744 \uc218\uc815\ud574\uc11c \uacf5\uaca9\uc5d0 \uc790\ub3d9\uc73c\ub85c \uc751\ub2f5\ud558\ub294 \uac83\uc5d0\ub294 \uacb0\uacfc\uac00 \ub530\ub978\ub2e4. \uacf5\uaca9\uc790\ub294 \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uacfc\uc758 TCP \uc138\uc158\uc774 \uc885\ub8cc\ub418\ub294 \uc911\uc774\ub77c\uac70\ub098 \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uacfc\uc758 \ubaa8\ub4e0 \uc5f0\uacb0\uc774 \ub04a\uc5b4\uc84c\ub2e4\ub294 \uac83\uc744 \uc7ac\ube68\ub9ac \uc54c\uc544\ucc4c \uc218 \uc788\ub2e4. \uc774\ub85c\ubd80\ud130 \uc774\ub04c\uc5b4 \ub0bc \uc218 \uc788\ub294 \uac00\uc7a5 \ub17c\ub9ac\uc801\uc778 \uacb0\ub860\uc740 \ud2b9\uc815 \uc720\ud615\uc758 \ub2a5\ub3d9\uc801 \uc751\ub2f5\uae30\ubc95\uc774 \ubaa9\ud45c\ub97c \ubcf4\ud638\ud558\uae30 \uc704\ud574 \uc124\uce58\ub410\ub2e4\ub294 \uac83\uc774\ub2e4. \ub2a5\ub3d9\uc801 \uc751\ub2f5 \uc2dc\uc2a4\ud15c\uc774 \ud3ec\ud2b8 \uc2a4\uce94\uc774\ub098 \ud3ec\ud2b8 \uc2a4\uc715\uacfc \uac19\uc774 \uc0c1\ub300\uc801\uc73c\ub85c \uc545\uc758\uac00 \uc5c6\ub294 \ud2b8\ub798\ud53d\uc5d0 \uc751\ub2f5\ud558\uac8c \uc124\uc815\ub410\ub2e4\uba74 \uacf5\uaca9\uc790\uac00 \uc751\ub2f5 \uae30\ubc95\uc744 \ub0a8\uc6a9\ud574\uc11c \uc774\uac83\uc774 \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc5d0 \ubc18\ud558\uac8c \ubc14\uafb8\ub294 \uac83\uc740 \ub9e4\uc6b0 \uc26c\uc6cc\uc9c4\ub2e4. \uc774\ub294 \ubaa9\ud45c\uc640\uc758 \uc591\ubc29\ud5a5 \ud1b5\uc2e0\uc744 \ud544\uc694\ub85c \ud558\uc9c0 \uc54a\ub294 \ubc29\uc2dd\uc73c\ub85c \uc804\ub2ec\ub420 \uc218 \uc788\ub294 \uc545\uc758\uc801\uc778 \ud2b8\ub798\ud53d(\uc989, \uacf5\uaca9\uc774 \uc2a4\ud478\ud551\ub420 \uc218 \uc788\ub294 \uacbd\uc6b0)\uc5d0\ub3c4 \uc801\uc6a9\ub418\uba70 \uc704\ud2f0 \uc6dc\uc774 \ubc14\ub85c \uadf8 \uc608\ub2e4.<\/p>\n

 – \uacf5\uaca9\uc758 \uc885\ub958
 \ub2a5\ub3d9\uc801\uc778 \uc751\ub2f5 \uae30\ub2a5\uc744 \uc81c\uacf5\ud558\ub294 \ub9ce\uc740 \uc18c\ud504\ud2b8\uc6e8\uc5b4(psad \ud3ec\ud568)\uac00 \ud2b9\uc815 \ud638\uc2a4\ud2b8\ub098 \ub124\ud2b8\uc6cc\ud06c\ub97c \ud5c8\uc6a9 \ub9ac\uc2a4\ud2b8(whitelist)\uc5d0 \ucd94\uac00\ud558\ub294 \uae30\ub2a5\uc744 \uc81c\uacf5\ud55c\ub2e4. \uc774\ub294 \uacf5\uaca9\uc790\uac00 \ud5c8\uc6a9 \ub9ac\uc2a4\ud2b8\uc5d0 \uc18d\ud55c \ub124\ud2b8\uc6cc\ud06c\ub85c\ubd80\ud130 \ud3ec\ud2b8 \uc2a4\uce94\uc774\ub098 \uae30\ud0c0 \uc545\uc758\uc801\uc778 \ud2b8\ub798\ud53d\uc744 \uc2a4\ud478\ud551\ud558\ub354\ub77c\ub3c4 \uc751\ub2f5 \uae30\ubc95\uc774 \uc544\ubb34\ub7f0 \uc870\uce58\ub97c \ucde8\ud558\uc9c0 \uc54a\uac8c \ud558\uae30 \uc704\ud568\uc774\ub2e4. \uadf8\ub7ec\ub098 \uc18c\ud504\ud2b8\uc6e8\uc5b4 \uad00\ub9ac\uc790\uac00 \uc774 \ubaa9\ub85d\uc5d0 \uc911\uc694\ud55c \uc2dc\uc2a4\ud15c\uc744 \ubaa8\ub450 \ud3ec\ud568\uc2dc\ud0a4\uc9c0 \uc54a\uc744 \uc218 \uc788\uc73c\ubbc0\ub85c \uacf5\uaca9\uc790\ub294 \uc790\uc2e0\uc758 \ucc3d\uc758\ub825\uc5d0 \ub530\ub77c \uacf5\uaca9\uc744 \uc1a1\uacf5\ud560 \uc218 \uc788\ub2e4. \uc2ec\uc9c0\uc5b4 TCP \uc720\ud734 \uc2a4\uce94\uc870\ucc28 \uc62c\ubc14\ub85c \ub3d9\uc791\ud558\ub824\uba74 \uc2a4\uce94\uc774 \uc2a4\ud478\ud551\ub3fc\uc57c \ud55c\ub2e4.<\/p>\n

 \uacf5\uaca9\uc5d0 \uc751\ub2f5\ud558\ub294 \uc880 \ub354 \ub098\uc740 \uc804\ub7b5\uc740 \uacf5\uaca9\uc790\uc640 \ubaa9\ud45c \uc0ac\uc774\uc5d0 \uc591\ubc29\ud5a5 \ud1b5\uc2e0\uc744 \ud544\uc694\ub85c\ud558\ub294 \uacf5\uaca9\uc5d0\ub9cc \uc751\ub2f5\ud558\uac8c \uc751\ub2f5 \uae30\ubc95\uc744 \ud65c\uc131\ud654\ud558\ub294 \uac83\uc774\ub2e4. \uc774\ub294 \uc77c\ubc18\uc801\uc73c\ub85c \uacf5\uaca9\uc790\uac00 TCP \uc5f0\uacb0\uc744 \uc218\ub9bd\ud588\uace0 \uacf5\uaca9(\uc6f9 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc5d0 \ub300\ud55c SQL \uc778\uc81d\uc158 \uacf5\uaca9\uc774\ub098 TCP \ud3ec\ud2b8\uc5d0\uc11c \ub300\uae30\uc911\uc778 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc5d0\uc11c \ubc84\ud37c \uc624\ubc84\ud50c\ub85c\uc6b0 \ucde8\uc57d\uc810\uc744 \ud1b5\ud574 \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc774 \uc258 \ucf54\ub4dc\ub97c \uc2e4\ud589\ud558\uac8c \uac15\uc81c\ud558\ub824\ub294 \uc2dc\ub3c4)\uc744 \uc804\ub2ec\ud558\ub294 \ub370 \uc218\ub9bd\ud55c TCP \uc5f0\uacb0\uc744 \uc0ac\uc6a9 \uc911\uc774\ub77c\ub294 \uac83\uc744 \uc758\ubbf8\ud55c\ub2e4.<\/p>\n

 \uc218\ub9bd\ub41c TCP \uc5f0\uacb0\uc5d0\uc11c \uacf5\uaca9\uc744 \ud0d0\uc9c0\ud558\ub824\uba74 \ud0d0\uc9c0 \uc2dc\uc2a4\ud15c\uc774 \uc218\ub9bd\ub41c \uc5f0\uacb0\uc5d0 \ub300\ud55c \ud45c\ub97c \uc720\uc9c0\ud558\uba74\uc11c \uc774\ubbf8 \uc218\ub9bd\ub41c \uc5f0\uacb0\ub4e4 \ub0b4\uc5d0\uc11c \uacf5\uaca9\uc744 \ucc3e\uc544\uc57c \ud55c\ub2e4. \uc2e4\uc81c\ucc98\ub7fc \ubcf4\uc774\ub294 \uc21c\uc11c \ubc88\ud638\uc640 \uc2b9\uc778 \ubc88\ud638\ub97c \uac00\uc9c0\ub294 TCP \ud328\ud0b7\ub3c4 \uacb0\uad6d \uc2a4\ud478\ud551\ub420 \uc218 \uc788\uc9c0\ub9cc \uc774\ub7f0 \ud328\ud0b7\uc740 \uc2e4\uc81c\ub85c \uc218\ub9bd\ub41c \uc5f0\uacb0\uc758 \uc77c\ubd80\uac00 \uc544\ub2c8\uba70 \uc2a4\ud478\ud551 \uc131\uacf5 \uc5ec\ubd80\ub294 \uc774\ub97c \uacb0\uc815\ud558\ub294 \ud0d0\uc9c0 \uae30\ubc95\uc5d0 \ub2ec\ub824\uc788\ub2e4.<\/p>\n

 – \uae0d\uc815\uc624\ub958
 \uce68\uc785 \ud0d0\uc9c0 \uc2dc\uc2a4\ud15c\uc740 \uc5b4\ub5a4 \uac83\uc774\ub4e0 \ubaa8\ub450 \uae0d\uc815 \uc624\ub958(\uc815\uc0c1\uc801\uc778 \ud65c\ub3d9\uc744 \uc545\uc758\uc801\uc778 \uac83\uc73c\ub85c \uc798\ubabb \ud310\ub2e8\ud558\ub294 \uacbd\uace0)\ub97c \uc0dd\uc131\ud558\uae30\ub3c4 \ud55c\ub2e4. \ubd80\uc815 \uc624\ub958\ub098 \uc2e4\uc81c \uc545\uc758\uc801\uc778 \ud2b8\ub798\ud53d\uc774 \uc874\uc7ac\ud560 \ub300 \uc774\ubca4\ud2b8\ub97c \uc0dd\uc131\ud558\uc9c0 \ubabb\ud558\ub294 \uac83 \uc5ed\uc2dc \uc0c1\ub300\uc801\uc73c\ub85c \ud754\ud55c \uc77c\uc774\ub2e4.<\/p>\n

 psad\ub3c4 \uc774 \uaddc\uce59\uc5d0 \uc608\uc678\uac00 \uc544\ub2c8\uba70 psad\ub97c \uc2e4\ud589\ud558\ub2e4 \ubcf4\uba74 \uc815\uc0c1\uc801\uc778 \ud2b8\ub798\ud53d\uc5d0 \ub300\ud574 \uc774\ubca4\ud2b8\ub97c \uc0dd\uc131\ud558\ub294 \uacbd\uc6b0\ub97c \ubcfc \uc218 \uc788\ub2e4. \uae0d\uc815 \uc624\ub958\ub294 \uc8fc\uc758 \uae4a\uac8c \uc124\uc815\ud574\uc11c \ucd5c\uc18c\ud654\ud560 \uc218 \uc788\uc9c0\ub9cc \uc644\uc804\ud788 \uc81c\uac70\ud560 \uc218\ub294 \uc5c6\ub2e4. \uadf8\ub7ec\ubbc0\ub85c \uc545\uc758\uc801\uc774\ub77c\uace0 \uc798\ubabb \ud310\ub2e8\ub41c \ud2b8\ub798\ud53d\uc5d0 \uc790\ub3d9\uc73c\ub85c \uc751\ub2f5\ud558\ub294 \uac83\uc740 \uc77c\ubc18\uc801\uc778 \ub124\ud2b8\uc6cc\ud06c \uc5f0\uacb0\uc131\uc744 \uc720\uc9c0\ud558\ub294 \ub370 \uc88b\uc9c0 \uc54a\ub2e4.<\/p>\n

 \uadf8\ub7fc\uc5d0\ub3c4 \uc5ec\uc804\ud788 \ub9ce\uc740 \ubcf4\uc548 \uad00\ub9ac\uc790\uac00 \uc5b4\ub5a4 \uc720\ud615\uc758 \uc774\ubca4\ud2b8\ub294 \uadf8\uac83\uc774 \uc798\ubabb \uc2dd\ubcc4\ub41c \ud65c\ub3d9\uc73c\ub85c\ubd80\ud130 \uc0dd\uc131\ub41c \uac83\uc774\ub77c \ud560\uc9c0\ub77c\ub3c4 \uc5c4\uaca9\ud558\uac8c \uc751\ub2f5\ud560 \ub9cc\ud07c \ucda9\ubd84\ud788 \uc7a0\uc7ac\uc801\uc73c\ub85c \uc704\ud5d8\ud558\ub2e4\uace0 \ud310\ub2e8\ud55c\ub2e4. \uc608\ub97c \ub4e4\uc5b4 \uc0c8\ub85c\uc6b4 \uc6dc\uc758 \ucd9c\ud604\uc774 \ub124\ud2b8\uc6cc\ud06c\uc640 \uad6c\uc131 \uc2dc\uc2a4\ud15c\uc744 \uc644\uc804\ud788 \ubb34\ub825\ud654\ud560 \uc218 \uc788\uc73c\ubbc0\ub85c \uc774\ub7f0 \uc6dc\uc5d0 \uac10\uc5f4\ub420 \uac00\ub2a5\uc131\uc774 \uc874\uc7ac\ud558\ub294 \ud55c \ud53c\ud574\ub97c \ucd5c\uc18c\ud654\ud558\ub294 \uc2dc\ub3c4\ub85c \ub2a5\ub3d9\uc801 \uc751\ub2f5\uc744 \uc0ac\uc6a9\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 * psad\ub97c \uc774\uc6a9\ud574 \uacf5\uaca9\uc5d0 \uc751\ub2f5\ud558\uae30
 psad\uac00 \uacf5\uaca9\uc5d0 \uc751\ub2f5\ud558\ub294\ub370 \uc0ac\uc6a9\ud558\ub294 \uc8fc\uc694 \ubc29\ubc95\uc740 \uc124\uc815 \uac00\ub2a5\ud55c \uc2dc\uac04 \ub3d9\uc548 \uacf5\uaca9\uc790\uc758 \ucd9c\ubc1c\uc9c0 IP \uc8fc\uc18c\ub85c\ubd80\ud130\uc758 \ubaa8\ub4e0 \uc811\uc18d\uc744 \ucc28\ub2e8\ud558\uac8c \ub85c\uceec \ud544\ud130\ub9c1 \uc815\ucc45\uc744 \ub3d9\uc801\uc73c\ub85c \uc7ac\uc124\uc815\ud558\ub294 \uac83\uc774\ub2e4.<\/p>\n

 Tcpwrappers \uc5d0 \ub300\ud55c \ub178\ud2b8
 psad\ub3c4 tcpwrappers \uac00 \uacf5\uaca9\uc790\uc758 \ucd9c\ubc1c\uc9c0 IP \uc8fc\uc18c\ub85c\ubd80\ud130\uc758 \uc811\uadfc\uc744 \ubd80\uc778\ud558\uac8c \/etc\/hosts.deny \ud30c\uc77c\uc744 \uc7ac\uc124\uc815\ud560 \uc218\ub3c4 \uc788\ub2e4. \uadf8\ub7ec\ub098 \uc774 \uae30\ubc95\uc740 \uba87 \uac00\uc9c0 \uc774\uc720\uc5d0\uc11c iptables\ub97c \uc0ac\uc6a9\ud558\ub294 \uac83\ubcf4\ub2e4 \uc548 \uc88b\ub2e4. \uc6b0\uc120 tcpwrappers \ub294 tcpwrappers \ub97c \uc0ac\uc6a9\ud558\uac8c \uc124\uc815\ub41c \ub370\ubaac\uc73c\ub85c\uc758 \uc811\uadfc\ub9cc \ucc28\ub2e8\ud560 \uc218 \uc788\ub2e4. \uc774\uc640 \ub2ec\ub9ac iptables \uc758 \uc77c\ubc18\uc801\uc778 \ucc28\ub2e8 \uaddc\uce59\uc740 \uacf5\uaca9\uc790\uac00 \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uc758 IP \uc2a4\ud0dd\uc744 \ud1b5\ud55c \ud1b5\uc2e0\uc744 \uc804\ud600 \uc218\ud589\ud560 \uc218 \uc5c6\uac8c \ud55c\ub2e4. \ub458\uc9f8\ub85c, tcpwrappers \ub294 \ub85c\uceec \uc2dc\uc2a4\ud15c\uc5d0\uc11c \uc2e4\ud589 \uc911\uc778 \ub370\ubaac\uc744 \ubcf4\ud638\ud558\ub294 \ub370\uc5d0\ub9cc \ud6a8\uacfc\uc801\uc778 \ubc18\uba74 psad\ub294 FORWARD \uccb4\uc778\uc758 \uc2a4\uce94\uc774\ub098 \uae30\ud0c0 \uc545\uc758\uc801\uc778 \ud2b8\ub798\ud53d\ub3c4 \ud0d0\uc9c0\ud560 \uc218 \uc788\ub2e4. \ub05d\uc73c\ub85c tcpwrappers \ub85c \ub370\ubaac\uc744 \ubcf4\ud638\ud558\ub294 \uacbd\uc6b0 \uacf5\uaca9\uc790\ub294 iptables\uc640 \uc5f0\ub3d9\ud560 \uc218 \uc788\ub294 \ubc29\ubc95\ubcf4\ub2e4 \ud6e8\uc52c \ub354 \ub9ce\uc740 \ubc29\ubc95\uc73c\ub85c \ubaa9\ud45c \uc2dc\uc2a4\ud15c\uacfc \uc5f0\ub3d9\ud560 \uc218 \uc788\uc73c\uba70, \uc774 \uc911\uc5d0\uc11c \uc5b4\ub5a4 \uac83(\ucee4\ub110\uacfc \uc0ac\uc6a9\uc790 \uacf5\uac04 \uc911 \uc5b4\ub514\uc5d0 \uc788\ub294 \uac83\uc774\ub4e0)\uc774\ub77c\ub3c4 \ubcf4\uc548 \ucde8\uc57d\uc810\uc744 \uac00\uc9c8 \uac00\ub2a5\uc131\uc774 \uc874\uc7ac\ud55c\ub2e4.<\/p><\/blockquote>\n

\ub85c\uceec iptables \uc815\ucc45\uc744 \ub3d9\uc801\uc73c\ub85c \uc7ac\uc124\uc815\ud558\ub294 \uae30\ub2a5\uc740 \uc751\ub2f5\uc774 \ub124\ud2b8\uc6cc\ud06c \uacc4\uce35\uc5d0\uc11c \uc77c\uc5b4\ub09c\ub2e4\ub294 \uac83\uc744 \uc758\ubbf8\ud55c\ub2e4. \uc608\ub97c \ub4e4\uc5b4 \uacf5\uaca9\uc790\uc758 IP \uc8fc\uc18c\ub294 IP \uc2a4\ud0dd\uc744 \ud1b5\ud55c \ud1b5\uc2e0\uc744 \ubabb\ud558\uac8c \ucc28\ub2e8\ub41c\ub2e4. \ucc28\ub2e8 \uaddc\uce59\uc774 \uc778\uc2a4\ud134\uc2a4\ud654\ub420 \ub54c \uacf5\uaca9\uc790\uac00 \ub85c\uceec \ub124\ud2b8\uc6cc\ud06c\uc758 \uc11c\ubc84 \uc911 \ud558\ub098\uc640 \uc218\ub9bd\ub41c TCP \uc138\uc158\uc744 \uac00\uc9c0\uace0 \uc788\ub2e4\uba74 (\ucc28\ub2e8 \uaddc\uce59\uacfc \ud568\uaed8 \uc0dd\uc131\ub41c TCP \uc7ac\uc124\uc815\uc774 \uc5c6\uae30 \ub54c\ubb38\uc5d0) \ubaa8\ub4e0 TCP \ud328\ud0b7\uc740 \ubc84\ub824\uc9c8 \uac83\uc774\uba70, \ub9d0\ub2e8 TCP \uc2a4\ud0dd\uc740 \uc2dc\uac04 \ub9cc\ub8cc \ub54c\uae4c\uc9c0 \uc7ac\uc804\uc1a1\uc744 \uc2dc\ub3c4\ud560 \uac83\uc774\ub2e4.<\/p>\n

 ** \uae30\ub2a5<\/p>\n

 psad\ub294 \ub2e4\uc74c\uacfc \uac19\uc740 \ub2a5\ub3d9\uc801 \uc751\ub2f5 \uae30\ub2a5\uc744 \uc9c0\uc6d0\ud55c\ub2e4.<\/p>\n

 – iptables \ucc28\ub2e8 \uaddc\uce59\uc774 \ucd94\uac00\ub418\uae30 \uc804\uc5d0 \uacf5\uaca9\uc790\uac00 \ub3c4\ub2ec\ud574\uc57c \ud558\ub294 \uc0ac\uc6a9\uc790 \uc124\uc815 \uac00\ub2a5 \ucd5c\uc18c \uc704\ud5d8 \uc218\uc900
 – \uc124\uc815 \uac00\ub2a5\ud55c \uc2dc\uac04 \ub9cc\ub8cc\uc5d0 \uae30\ubc18\ud574\uc11c \uc601\uc18d\uc801\uc774\uac70\ub098 \uc77c\uc2dc\uc801\uc778 \ucc28\ub2e8 \uaddc\uce59\uc744 \uc0dd\uc131\ud558\ub294 \uae30\ub2a5
 – \uae30\uc874\uc758 \ub85c\uceec \uc2dc\uc2a4\ud15c iptables \uc815\ucc44\uace0\uac00 \ucda9\ub3cc\ud558\uc9c0 \uc54a\uac8c \ubaa8\ub4e0 \ucc28\ub2e8 \uaddc\uce59\uc5d0 \ubcc4\ub3c4\uc758 iptables \uccb4\uc778\uc744 \uc0ac\uc6a9\ud558\ub294 \uae30\ub2a5
 – psad\ub098 \uc2dc\uc2a4\ud15c \uc7ac\uc2dc\uc791 \uc0ac\uc774\uc5d0\ub3c4 \ucc28\ub2e8 \uaddc\uce59\uc744 \ubcf4\uc874\ud558\ub294 \uae30\ub2a5(\uc774 \uae30\ub2a5\uc740 \uc124\uc815 \uac00\ub2a5\ud558\uc9c0\ub9cc \uae30\ubcf8 \uc124\uc815\uc740 psad\uac00 \uc2dc\uc791\ud560 \ub54c \uae30\uc874\uc758 \ucc28\ub2e8 \uaddc\uce59\uc744 \ubaa8\ub450 \ubc84\ub9ac\ub294 \uac83)
 – \ud604\uc7ac \ucc28\ub2e8\ub41c \ubaa8\ub4e0 IP \uc8fc\uc18c\uc758 \uc0c1\ud0dc \ucd9c\ub825\uc744 \uad00\ub828 iptables \ucc28\ub2e8 \uaddc\uce59\uc774 \uc81c\uac70\ub420 \ub54c\uae4c\uc9c0 \ub0a8\uc740 \ucd08\uc640 \ud568\uaed8 \ud3ec\ud568\ud558\ub294 \uae30\ub2a5
 – \uc678\ubd80 \ud504\ub85c\uc138\uc2a4\uac00 –fw-block-ip \uc640 –fw-rm-block-ip \uba85\ub839 \ud589 \uc778\uc790\ub97c \uc0ac\uc6a9\ud574\uc11c psad\uc5d0\uac8c \ud2b9\uc815 IP \uc8fc\uc18c\uc5d0 \ub300\ud55c \ucc28\ub2e8 \uaddc\uce59\uc744 \ucd94\uac00\ud558\uac70\ub098 \uc81c\uac70\ud558\uac8c \uc9c0\uc2dc\ud560 \uc218 \uc788\ub294 \uae30\ub2a5
 – psad \ucc28\ub2e8 \uccb4\uc778\uc5d0\uc11c IP \uc8fc\uc18c\uac00 \ucd94\uac00\ub418\uac70\ub098 \uc0ad\uc81c\ub420 \ub54c \uba54\uc77c\ub85c \ud1b5\uc9c0\ud558\ub294 \uae30\ub2a5<\/p>\n

 ** \uc124\uc815 \ubcc0\uc218
 psad\uac00 \ub2a5\ub3d9\uc801 \uc751\ub2f5 \ubaa8\ub4dc\uc5d0 \uc9c4\uc785\ud560\uc9c0 \uc5ec\ubd80\ub97c \uacb0\uc815\ud558\ub294 \uac00\uc7a5 \uc911\uc694\ud55c \ubcc0\uc218\ub294 ENABLE_AUTO_IDS \ub85c \/etc\/psad\/psad.conf \ud30c\uc77c\uc5d0\uc11c Y\uc774\ub098 N\uc73c\ub85c \uc124\uc815\ud560 \uc218 \uc788\ub2e4. \uc774 \uae30\ub2a5\uc774 \ud65c\uc131\ud654\ub418\uba74 \ub2e4\ub978 \uc77c\ubd80 \ubcc0\uc218\ub294 psad\uac00 \uacf5\uaca9\uc790\ub97c \uc790\ub3d9\uc73c\ub85c \ucc28\ub2e8\ud558\ub824\uace0 \ud560 \ub54c psad\uc758 \ub2e4\uc591\ud55c \ub3d9\uc791\uc744 \uc81c\uc5b4\ud55c\ub2e4.<\/p>\n

 AUTO_IDS_DANGER_LEVEL \ubcc0\uc218\ub294 \ucc28\ub2e8 \uaddc\uce59\uc774 \uc778\uc2a4\ud134\uc2a4\ud654\ub418\uae30 \uc804\uc5d0 IP \uc8fc\uc18c\uac00 \ub3c4\ub2ec\ud574\uc57c \ud560 \ucd5c\uc18c \uc704\ud5d8 \uc218\uc900\uc5d0 \ub300\ud574 1 ~ 5 \uc758 \uc784\uacc4\uce58\ub97c \uc124\uc815\ud55c\ub2e4. \ud3ec\ud2b8 \uc2a4\uce94 \uc784\ub3a8\uce58, \uac1c\ubcc4\uc801\uc778 \uc11c\uba85 \uc704\ud5d8 \uc218\uc900(\/etc\/psad\/signatures \ucc38\uc870), \uc790\ub3d9 \uc704\ud5d8 \uc218\uc900 \ud560\ub2f9(\/etc\/psad\/auto_dl \ucc38\uc870)\uc744 \uc870\uc808\ud568\uc73c\ub85c\uc368 psad\ub294 IP \uc8fc\uc18c\ub97c \uc790\ub3d9\uc73c\ub85c \ucc28\ub2e8\ud560\uc9c0\uc5d0 \ub300\ud574 \uc138\ubc00\ud55c \uacb0\uc815\uc744 \ub0b4\ub9b4 \uc218 \uc788\ub2e4. \uc608\ub97c \ub4e4\uc5b4 \ud2b9\uc815 IP \uc8fc\uc18c\ub098 \ub124\ud2b8\uc6cc\ud06c(\uc608\ub97c \ub4e4\uc5b4 192.168.1.0\/24)\uac00 \uacfc\uac70\uc758 \uc2a4\uce94\uc774\ub098 \uce68\uc785 \uc2dc\ub3c4\ub85c \uc778\ud574 \uacf5\uaca9\uc790\ub85c \uc54c\ub824\uc838 \uc788\ub2e4\uba74 \/etc\/psad\/auto_dl \ud30c\uc77c\uc5d0 \ub2e4\uc74c\uc744 \ucd94\uac00\ud574\uc11c \uc774 \uc8fc\uc18c\uc640\uc758 \ud1b5\uc2e0\uc744 \uc5b5\uc81c\ud55c \uc0c1\ud0dc\ub85c \uc720\uc9c0\ud560 \uc218 \uc788\ub2e4<\/p>\n

 192.168.1.0\/24     5;<\/p><\/blockquote>\n

\uc774\uc81c 192.168.1.0\/24 \ud074\ub798\uc2a4 C \ub124\ud2b8\uc6cc\ud06c\uc5d0 \uc18d\ud558\ub294 \ubaa8\ub4e0 IP \uc8fc\uc18c\ub294 AUTO_IDS_DANGER_LEVEL\uc774 \uc5bc\ub9c8\ub098 \ub192\uac8c \uc124\uc815\ub410\ub294\uc9c0\uc640 \ubb34\uad00\ud558\uac8c \ud544\ud130\ub9c1 \uc815\ucc45\uc5d0 \uc704\ubc30\ub418\uba70 \uc774 IP \uc8fc\uc18c\uc5d0 \ub300\ud55c \ucc28\ub2e8 \uaddc\uce59\uc774 \ucd94\uac00\ub41c\ub2e4.<\/p>\n

 \uc77c\ubc18\uc801\uc778 \uc0c1\ud669\uc5d0\uc11c iptables\ub294 \uc911\uc694\ud55c \uc11c\ube44\uc2a4\ub85c\uc758 \uc801\ubc95\ud55c \ud2b8\ub798\ud53d(\uc608\ub97c \ub4e4\uba74 DNS)\uc744 \uae30\ub85d\ud558\uc9c0 \uc54a\uac8c \uc124\uc815\ub418\ubbc0\ub85c iptables\uac00 \ud328\ud0b7\uc744 \uae30\ub85d\ud558\uac8c \uc720\ubc1c\ud558\uc9c0 \uc54a\ub294 \ud55c 192.168.1.0\/24 \ub124\ud2b8\uc6cc\ud06c \ub0b4\uc758 \ubaa8\ub4e0 IP \uc8fc\uc18c\ub294 \uc774\ub7f0 \uc11c\ube44\uc2a4\uc5d0 \uc811\uadfc\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 AUTO_BLOCK_TIMEOUT \ubcc0\uc218\ub294 iptables \ucc28\ub2e8 \uaddc\uce59\uc774 \uc720\ud6a8\ud55c \uc2dc\uac04\uc744 \ucd08\ub85c \uc815\uc758\ud55c\ub2e4. \uae30\ubcf8\uac12\uc740 360\ucd08, \uc989 \ud55c\uc2dc\uac04\uc774\ub2e4. AUTO_BLOCK_TIMEOUT\uc744 0\uc73c\ub85c \uc124\uc815\ud558\uba74 \ubaa8\ub4e0 \ucc28\ub2e8 \uaddc\uce59\uc774 \uc601\uc18d\uc801\uc73c\ub85c \uc720\uc9c0\ub418\uba70 FLUSH_IPT_AT_INIT \uac00 \ube44\ud65c\uc131\ud654\ub3fc \uc788\uc9c0 \uc54a\ub294 \ud55c psad\uac00 \uc7ac\uc2dc\uc791\ub418\uac70\ub098 \uc2dc\uc2a4\ud15c\uc774 \uc7ac\ubd80\ud305\ub420 \ub54c\ub9cc \uc81c\uac70\ub41c\ub2e4.<\/p>\n

 IPTABLES_BLOCK_METHOD\uc640 TCPWRAPPERS_BLOCK_METHOD \ubcc0\uc218\ub294 psad\uac00 \uacf5\uaca9 IP \uc8fc\uc18c\ub97c \ucc28\ub2e8\ud558\uae30 \uc704\ud574 iptables\ub098 tcpwrappers\ub97c \uc0ac\uc6a9\ud560\uc9c0 \uc5ec\ubd80\ub97c \uc81c\uc5b4\ud55c\ub2e4. psad\ub97c \uacf5\uaca9\uc5d0 \uc751\ub2f5\ud558\uac8c \uc124\uc815\ud588\ub2e4\uba74 \ucd94\ucc9c \uc124\uc815\uc740 iptables \ucc28\ub2e8\uc744 \ud65c\uc131\ud654\ud558\ub294 \uac83\uc774\ub2e4.<\/p>\n

 ENABLE_AUTO_IDS_REGEX\uc640 AUTO_BLOCK_REGEX \ubcc0\uc218\ub97c \uc0ac\uc6a9\ud558\uba74 \ub85c\uae45 \uc811\ub450\uc5b4\uac00 \ud2b9\uc815 \uc815\uaddc\uc2dd\uacfc \ub9e4\uce6d\ub418\ub294\uc9c0 \uc5ec\ubd80\uc640 IP \uc8fc\uc18c\uc5d0 \ub300\ud55c \ucc28\ub2e8 \uaddc\uce59\uc758 \ucd94\uac00 \ub3d9\uc791\uc744 \uacb0\ud569\ud560 \uc218 \uc788\ub2e4. \uc774\ub294 \uc218\ub9bd\ub41c TCP \uc138\uc158\uc744 \ud1b5\ud55c \uc591\ubc29\ud5a5 \ud1b5\uc2e0\uc744 \ud544\uc694\ub85c \ud558\ub294 \uacf5\uaca9\uc744 \uac10\uc2dc\ud55c \uacbd\uc6b0\uc758 IP \uc8fc\uc18c \ucc28\ub2e8\uc5d0\ub9cc \uac00\uc7a5 \uc720\uc6a9\ud558\ub2e4. \ud3ec\ud2b8 \uc2a4\uce94\uc740 \uc27d\uac8c \uc2a4\ud478\ud551\ub418\uae30 \ub54c\ubb38\uc5d0 \uc774 \uae30\ub2a5\uc740 \uacf5\uaca9\uc790\uc5d0 \uc758\ud574 \ub2e8\uc21c\ud788 \uc2a4\ud478\ud551\ub418\uc9c0 \uc54a\uc740 IP \uc8fc\uc18c\ub4e4\ub85c \ucc28\ub2e8 \uaddc\uce59\uc744 \uc81c\ud55c\ud558\ub294 \uac15\ub825\ud55c \uae30\ubc95\uc744 \uc81c\uacf5\ud55c\ub2e4.<\/p>\n

 \ub05d\uc73c\ub85c \uacf5\uaca9\uc790\ub97c \uc790\ub3d9\uc73c\ub85c \ucc28\ub2e8\ud558\ub294 \ub370 \uc911\uc694\ud55c \ub098\uba38\uc9c0 \uc124\uc815 \ubcc0\uc218\ub294 iptables \uaddc\uce59\uc774 \uc0dd\uc131\ub418\ub294 \ubc29\uc2dd\uc744 \uc81c\uc5b4\ud55c\ub2e4. \uc774\ub7ec\ud55c \ubcc0\uc218\ub294 \ubaa8\ub450 IPT_AUTO_CHAIN \ubb38\uc790\uc5f4\ub85c \uc2dc\uc791\ud558\uba70 \uadf8 \ub4a4\uc5d0 \uc815\uc218\uac00 \ub098\uc628\ub2e4(DANGER_LEVEL{n} \ubcc0\uc218\uc640 \ub9c8\ucc2c\uac00\uc9c0\ub2e4). \uc774 \ubcc0\uc218\ub4e4\uc740 psad\uac00 iptables\uc5d0 \uaddc\uce59\uc744 \ucd94\uac00\ud558\ub294 \ubc29\uc2dd\uc5d0 7\uac00\uc9c0\uc758 \uae30\uc900\uc744 \uba85\uc2dc\ud55c\ub2e4.<\/p>\n

 – \uaddc\uce59\uc5d0 \ub300\ud55c iptables \ud0c0\uac9f(\uc608\ub97c \ub4e4\uc5b4 DROP)
 – \uaddc\uce59\uc744 \ucd9c\ubc1c\uc9c0\ub098 \ubaa9\uc801\uc9c0(\ub610\ub294 \ub458 \ubaa8\ub450)\uc5d0 \uc801\uc6a9\ud560\uc9c0 \uc5ec\ubd80
 – \uaddc\uce59\uc774 \ucd94\uac00\ub418\ub294 \ud14c\uc774\ube14(\uc608\ub97c \ub4e4\uc5b4 filter \ud14c\uc774\ube14)
 – \ub9de\ucda4\ud654 psad \uccb4\uc778\uc744 \uc704\ud574 \uac74\ub108\ub6f0\uae30 \uaddc\uce59\uc774 \ucd94\uac00\ub420 iptables \uccb4\uc778
 – iptables \uccb4\uc778 \ub0b4\uc5d0\uc11c \uac74\ub108\ub6f0\uae30 \uaddc\uce59\uc774 \ucd94\uac00\ub420 \uc704\uce58
 – \ub9de\ucda4\ud654 psad \uccb4\uc778\uc758 \uc774\ub984
 – \ub9de\ucda4\ud654 psad \uccb4\uc778 \ub0b4\uc5d0\uc11c \uc0c8\ub85c\uc6b4 \uaddc\uce59\uc774 \ucd94\uac00\ub420 \uc704\uce58<\/p>\n

 psad\ub294 \ucc28\ub2e8 \uaddc\uce59 \uc790\uccb4\ubfd0\ub9cc \uc544\ub2c8\ub77c \ub9de\ucda4\ud654 psad \uccb4\uc778\uacfc \uac74\ub108\ub6f0\uae30 \uaddc\uce59\uc758 \uc0dd\uc131\uacfc \uc720\uc9c0\ub3c4 \uad00\ub9ac\ud55c\ub2e4.<\/p>\n

 \uae30\ubcf8 IPT_AUTO_CHAIN{n} \ubcc0\uc218\ub294 psad\uac00 AUTO_IDS_DANGER_LEVEL \uc784\uacc4\uce58\uc5d0 \ub3c4\ub2ec\ud55c IP \uc8fc\uc18c\uc5d0 \ub300\ud574 \ucd1d \ub124 \uac1c\uc758 \ucc28\ub2e8 \uaddc\uce59\uc744 \ucd94\uac00\ud558\uac8c \ud55c\ub2e4.<\/p>\n

 – \ud328\ud0b7\uc774 PSAD_BLOCK_INPUT \uccb4\uc778\uc73c\ub85c \uac74\ub108\ub6f0\uac8c \uac15\uc81c\ud574\uc11c \ub85c\uceec \uc2dc\uc2a4\ud15c\uc774 \ubaa9\uc801\uc9c0\uc778 \uacf5\uaca9\uc790\ub85c\ubd80\ud130\uc758 \ud328\ud0b7\uc774 \ub85c\uceec \uc18c\ucf13\uacfc \ud1b5\uc2e0\ud560 \uc218 \uc5c6\uac8c \uacf5\uaca9 IP \uc8fc\uc18c\uc5d0 \ub300\ud55c DROP \uaddc\uce59\uc744 PSAD_BLOCK_INPUT \uccb4\uc778\uc5d0 \ucd94\uac00<\/p>\n

 – \ub85c\uceec \uc2dc\uc2a4\ud15c\uc5d0\uc11c \uc2dc\uc791\ub41c \ud328\ud0b7\uc774 \uacf5\uaca9\uc790\uc5d0\uac8c \uc804\uc1a1\ub420 \uc218 \uc5c6\uac8c PSAD_BLOCK_OUTPUT \uccb4\uc778\uc5d0 \uacf5\uaca9 IP \uc8fc\uc18c\uc5d0 \ub300\ud55c DROP \uaddc\uce59 \ucd94\uac00<\/p>\n

 – \uacf5\uaca9 IP \uc8fc\uc18c\uc5d0\uc11c \uc2dc\uc791\ub410\uac70\ub098 \uacf5\uaca9 IP \uc8fc\uc18c\ub85c \uc804\uc1a1\ub418\ub294 \ud328\ud0b7\uc744 \uc81c\ud55c\ud558\ub294 \uacf5\uaca9 IP \uc8fc\uc18c\uc5d0 \ub300\ud55c \ub450 \uac1c\uc758 DROP \uaddc\uce59\uc744 PSAD_BLOCK_FORWARD \uccb4\uc778\uc5d0 \ucd94\uac00. iptables \ubc29\ud654\ubcbd\uc774 \uc774\ub7f0 \uc2dd\uc73c\ub85c \ub0b4\ubd80 \ub124\ud2b8\uc6cc\ud06c\uc758 \uc2dc\uc2a4\ud15c\uc744 \ubcf4\ud638\ud558\uba74 \uc5b4\ub5a4 \uacf5\uaca9\uc790\ub3c4 \ud574\ub2f9 \uc2dc\uc2a4\ud15c\uacfc \uc5f0\uacb0\ud560 \uc218 \uc5c6\ub2e4.<\/p>\n

 * \ub2a5\ub3d9\uc801 \uc751\ub2f5\uc758 \uc608<\/p>\n

 \ub2e4\uc74c\uc740 \ud544\uc790\uac00 \uc0ac\uc6a9\ud558\ub294 psad.conf \ud30c\uc77c\uc758 \ub0b4\uc6a9\uc774\ub2e4.<\/p>\n

#
##############################################################################
#
#  This is the configuration file for psad (the Port Scan Attack Detector).
#  Normally this file gets installed at \/etc\/psad\/psad.conf, but can be put
#  anywhere in the filesystem and then the path can be specified on the
#  command line argument “-c <file>” to psad.  All three psad daemons (psad,
#  kmsgsd, and psadwatchd) reference this config file.
#
#  Each line has the form  “<variable name>    <value>;”.  Note the semi-
#  colon after the <value>.  All characters after the semicolon will be
#  ignored to provide space for comments.
#
##############################################################################
#
# $Id: psad.conf 2179 2008-06-07 15:21:55Z mbr $
#<\/p>\n

### Supports multiple email addresses (as a comma separated
### list).
EMAIL_ADDRESSES             root@localhost;<\/p>\n

### Machine hostname
HOSTNAME                    extreme;<\/p>\n

### Specify the home and external networks.  Note that by default the
### ENABLE_INTF_LOCAL_NETS is enabled, so psad automatically detects
### all of the directly connected subnets and uses this information as
#@@ the HOME_NET variable.
HOME_NET                    any;
EXTERNAL_NET                any;<\/p>\n

### The FW_SEARCH_ALL variable controls has psad will parse iptables
### messages.  If it is set to “Y” then psad will parse all iptables
### messages for evidence of scan activity.  If it is set to “N” then
### psad will only parse those iptables messages that contain logging
### prefixes specified by the FW_MSG_SEARCH variable below.  Logging
### prefixes are set with the –log-prefix command line option to iptables.
### Setting FW_SEARCH_ALL to “N” is useful for having psad only analyze
### iptables messages that are logged out of a specific iptables chain
### (multiple strings can be searched for, see the comment above the
### FW_MSG_SEARCH variable below) or a specific logging rule for example.
### FW_SEARCH_ALL is set to “Y” by default since usually people want psad
### to parse all iptables messages.
FW_SEARCH_ALL               Y;<\/p>\n

### The FW_MSG_SEARCH variable can be modified to look for logging messages
### that are specific to your firewall configuration (specified by the
### “–log-prefix” option.  For example, if your firewall uses the
### string “Audit” for packets that have been blocked, then you could
### set FW_MSG_SEARCH to “Audit”;  The default string to search for is
### “DROP”.  Both psad and kmsgsd reference this file.  NOTE: You can
### specify this variable multiple times to have psad search for multiple
### strings.  For example to have psad search for the strings “Audit” and
### “Reject”, you would use the following two lines:
#FW_MSG_SEARCH               Audit;
#FW_MSG_SEARCH               REJECT;
FW_MSG_SEARCH               DROP;<\/p>\n

### Set the type of syslog daemon that is used.  The SYSLOG_DAEMON
### variable accepts four possible values: syslogd, syslog-ng, ulogd,
### or metalog.
SYSLOG_DAEMON               syslogd;<\/p>\n

### Danger levels.  These represent the total number of
### packets required for a scan to reach each danger level.
### A scan may also reach a danger level if the scan trips
### a signature or if the scanning ip is listed in
### auto_ips so a danger level is automatically
### assigned.
DANGER_LEVEL1               5;    ### Number of packets.
DANGER_LEVEL2               15;
DANGER_LEVEL3               150;
DANGER_LEVEL4               1500;
DANGER_LEVEL5               10000;<\/p>\n

### Set the interval (in seconds) psad will use to sleep before
### checking for new iptables log messages
CHECK_INTERVAL              5;<\/p>\n

### Search for snort “sid” values generated by fwsnort
### or snort2iptables
SNORT_SID_STR               SID;<\/p>\n

### Set the minimum range of ports that must be scanned before
### psad will send an alert.  The default is 1 so that at
### least two port must be scanned (p2-p1 >= 1).  This can be set
### to 0 if you want psad to be extra paranoid, or 30000 if not.
PORT_RANGE_SCAN_THRESHOLD   1;<\/p>\n

### If “Y”, means that scans will never timeout.  This is useful
### for catching scans that take place over long periods of time
### where the attacker is trying to slip beneath the IDS thresholds.
ENABLE_PERSISTENCE          Y;<\/p>\n

### This is used only if ENABLE_PERSISTENCE = “N”;
SCAN_TIMEOUT                3600;  ### seconds<\/p>\n

### If “Y”, means all signatures will be shown since
### the scan started instead of just the current ones.
SHOW_ALL_SIGNATURES         N;<\/p>\n

### Allow reporting methods to be enabled\/restricted.  This keyword can
### accept values of “nosyslog” (don’t write any messages to syslog),
### “noemail” (don’t send any email messages), or “ALL” (to generate both
### syslog and email messages).  “ALL” is the default.  Both “nosyslog”
### and “noemail” can be combined with a comma to disable all logging
### and alerting.
ALERTING_METHODS            ALL;<\/p>\n

### By default, psad acquires iptables log data from the \/var\/log\/psad\/fwdata
### file which is written to by kmsgsd.  However, psad can just read an
### existing file that syslog writes iptables log data to (commonly
### \/var\/log\/messages).  On some systems, having syslog communicate log data
### to kmsgsd can be problematic (syslog configs and external factors such
### as Apparmor and SELinux can play a role here), so using this feature can
### simplify a psad deployment.
ENABLE_SYSLOG_FILE          N;
IPT_WRITE_FWDATA            Y;
IPT_SYSLOG_FILE             \/var\/log\/messages;<\/p>\n

### When enabled, this instructs psad to write the “msg” field
### associated with Snort rule matches to syslog.
ENABLE_SIG_MSG_SYSLOG       Y;
SIG_MSG_SYSLOG_THRESHOLD    10;
SIG_SID_SYSLOG_THRESHOLD    10;<\/p>\n

### TTL values are decremented depending on the number of hops
### the packet has taken before it hits the firewall.  We will
### assume packets will not jump through more than 20 hops on
### average.
MAX_HOPS                    20;<\/p>\n

### Do not include any timestamp included within kernel logging
### messages (Ubuntu systems commonly have this)
IGNORE_KERNEL_TIMESTAMP     Y;<\/p>\n

### FIXME: try to mitigate the affects of the iptables connection
### tracking bug by ignoring tcp packets that have the ack bit set.
### Read the “BUGS” section of the psad man page.  Note that
### if a packet matches a snort SID generated by fwsnort (see
### http:\/\/www.cipherdyne.org\/fwsnort\/)
### then psad will see it even if the ack bit is set.  See the
### SNORT_SID_STR variable.
IGNORE_CONNTRACK_BUG_PKTS   Y;<\/p>\n

### define a set of ports to ignore (this is useful particularly
### for port knocking applications since the knock sequence will
### look to psad like a scan).  This variable may be defined as
### a comma-separated list of port numbers or port ranges and
### corresponding protocol,  For example, to have psad ignore all
### tcp in the range 61000-61356 and udp ports 53 and 5000, use:
### IGNORE_PORTS        tcp\/61000-61356, udp\/53, udp\/5000;
IGNORE_PORTS                NONE;<\/p>\n

### allow entire protocols to be ignored.  This keyword can accept
### a comma separated list of protocols.  Each protocol must match
### the protocol that is specified in a Netfilter log message (case
### insensitively, so both “TCP” or “tcp” is ok).
### IGNORE_PROTOCOL             tcp,udp;
IGNORE_PROTOCOLS            NONE;<\/p>\n

### allow packets to be ignored based on interface (this is the
### “IN” interface in Nefilter logging messages).
IGNORE_INTERFACES           NONE;<\/p>\n

### Ignore these specific logging prefixes
IGNORE_LOG_PREFIXES         NONE;<\/p>\n

### Minimum danger level a scan must reach before any logging or
### alerting is done.  The EMAIL_ALERT_DANGER_LEVEL variable below
### only refers to email alerts; the MIN_DANGER_LEVEL variable
### applies to everything from email alerts to whether or not the
### IP directory is created within \/var\/log\/psad\/.  Hence
### MIN_DANGER_LEVEL should be set less than or equal to the value
### assigned to the EMAIL_ALERT_DANGER_LEVEL variable.
MIN_DANGER_LEVEL            1;<\/p>\n

### Only send email alert if danger level >= to this value.
EMAIL_ALERT_DANGER_LEVEL    1;<\/p>\n

### Treat all subnets on local interfaces as part of HOME_NET (this
### means that these networks do not have to be manually defined)
ENABLE_INTF_LOCAL_NETS      Y;<\/p>\n

### Include MAC addresses in email alert
ENABLE_MAC_ADDR_REPORTING   N;<\/p>\n

### Look for the Netfilter logging rule (fwcheck_psad is executed)
ENABLE_FW_LOGGING_CHECK     Y;<\/p>\n

### Send no more than this number of emails for a single
### scanning source IP.  Note that enabling this feature may cause
### alerts for real attacks to not be generated if an attack is sent
### after the email threshold has been reached for an IP address.
### This is why the default is set to “0”.
EMAIL_LIMIT                 0;<\/p>\n

### By default, psad maintains a counter for each scanning source address,
### but by enabling this variable psad will maintain email counters for
### each victim address that is scanned as well.
ENABLE_EMAIL_LIMIT_PER_DST  N;<\/p>\n

### If “Y”, send a status email message when an IP has reached the
### EMAIL_LIMIT threshold.
EMAIL_LIMIT_STATUS_MSG      Y;<\/p>\n

### If “Y”, send email for all newly logged packets from the same
### source ip instead of just when a danger level increases.
ALERT_ALL                   Y;<\/p>\n

### If “Y”, then psad will import old scan source ip directories
### as current scans instead of moving the directories into the
### archive directory.
IMPORT_OLD_SCANS            Y;<\/p>\n

### syslog facility and priority (the defaults are usually ok)
### The SYSLOG_FACILITY variable can be set to one of LOG_LOCAL{0-7}, and
### SYSLOG_PRIORITY can be set to one of LOG_INFO, LOG_DEBUG, LOG_NOTICE,
### LOG_WARNING, LOG_ERR, LOG_CRIT, LOG_ALERT, or LOG_EMERG
SYSLOG_IDENTITY             psad;
SYSLOG_FACILITY             LOG_LOCAL7;
SYSLOG_PRIORITY             LOG_INFO;<\/p>\n

### Port thresholds for logging and -S and -A output.
TOP_PORTS_LOG_THRESHOLD     500;
STATUS_PORTS_THRESHOLD      20;<\/p>\n

### Signature thresholds for logging and -S and -A output.
TOP_SIGS_LOG_THRESHOLD      500;
STATUS_SIGS_THRESHOLD       50;<\/p>\n

### Attackers thresholds for logging and -S and -A output.
TOP_IP_LOG_THRESHOLD        500;
STATUS_IP_THRESHOLD         25;<\/p>\n

### Specify how often to log the TOP_* information (i.e. how many
### CHECK_INTERVAL iterations before the data is logged again).
TOP_SCANS_CTR_THRESHOLD     1;<\/p>\n

### Send scan logs to dshield.org.  This is disabled by default,
### but is a good idea to enable it (subject to your site security
### policy) since the DShield service helps to track the bad guys.
### For more information visit http:\/\/www.dshield.org
ENABLE_DSHIELD_ALERTS       Y;<\/p>\n

### dshield.org alert email address; this should not be changed
### unless the guys at DShield have changed it.
DSHIELD_ALERT_EMAIL         reports@dshield.org;<\/p>\n

### Time interval (hours) to send email alerts to dshield.org.
### The default is 6 hours, and cannot be less than 1 hour or
### more than 24 hours.
DSHIELD_ALERT_INTERVAL      6;  ### hours<\/p>\n

### If you have a DShield user id you can set it here.  The
### default is “0”.
DSHIELD_USER_ID             0;<\/p>\n

### If you want the outbound DShield email to appear as though it
### is coming from a particular user address then set it here.
DSHIELD_USER_EMAIL          NONE;<\/p>\n

### Threshold danger level for DShield data; a scan must reach this
### danger level before associated packets will be included in an
### alert to DShield.  Note that zero is the default since this
### will allow DShield to apply its own logic to determine what
### constitutes a scan (_all_ iptables log messages will be included
### in DShield email alerts).
DSHIELD_DL_THRESHOLD        0;<\/p>\n

### List of servers.  Fwsnort supports the same variable resolution as
#### Snort.
HTTP_SERVERS                $HOME_NET;
SMTP_SERVERS                $HOME_NET;
DNS_SERVERS                 $HOME_NET;
SQL_SERVERS                 $HOME_NET;
TELNET_SERVERS              $HOME_NET;<\/p>\n

#### AOL AIM server nets
AIM_SERVERS                 [64.12.24.0\/24, 64.12.25.0\/24, 64.12.26.14\/24, 64.12.28.0\/24, 64.12.29.0\/24, 64.12.161.0\/24, 64.12.163.0\/24, 205.188.5.0\/24, 205.188.9.0\/24];<\/p>\n

### Configurable port numbers
HTTP_PORTS                  80;
SHELLCODE_PORTS             !80;
ORACLE_PORTS                1521;<\/p>\n

### If this is enabled, then psad will die if a rule in the
### \/etc\/psad\/signatures file contains an unsupported option (otherwise
### a syslog warning will be generated).
ENABLE_SNORT_SIG_STRICT     Y;<\/p>\n

### If “Y”, enable automated IDS response (auto manages
### firewall rulesets).
ENABLE_AUTO_IDS             Y;<\/p>\n

### Block all traffic from offending IP if danger
### level >= to this value
AUTO_IDS_DANGER_LEVEL       5;<\/p>\n

### Set the auto-blocked timeout in seconds (the default
### is one hour).
#AUTO_BLOCK_TIMEOUT          36000;
AUTO_BLOCK_TIMEOUT          360;<\/p>\n

### Enable regex checking on log prefixes for active response
ENABLE_AUTO_IDS_REGEX       N;<\/p>\n

### Only block if the Netfilter log message matches the following regex
AUTO_BLOCK_REGEX            ESTAB;  ### from fwsnort logging prefixes<\/p>\n

### Control whether “renew” auto-block emails get sent.  This is disabled
### by default because lots of IPs could have been blocked, and psad
### should not generate a renew email for each of them.
ENABLE_RENEW_BLOCK_EMAILS   N;<\/p>\n

### By setting this variable to N, all auto-blocking emails can be
### suppressed.
ENABLE_AUTO_IDS_EMAILS      Y;<\/p>\n

### Enable iptables blocking (only gets enabled if
### ENABLE_AUTO_IDS is also set)
IPTABLES_BLOCK_METHOD       Y;<\/p>\n

### Specify chain names to which iptables blocking rules will be
### added with the IPT_AUTO_CHAIN{n} keyword.  There is no limit on the
### number of IPT_AUTO_CHAIN{n} keywords; just increment the {n} number
### to add an additional IPT_AUTO_CHAIN requirement. The format for this
### variable is: <Target>,<Direction>,<Table>,<From_chain>,<Jump_rule_position>,
###              <To_chain>,<Rule_position>.
### “Target”: Can be any legitimate Netfilter target, but should usually
###           just be “DROP”.
### “Direction”: Can be “src”, “dst”, or “both”, which correspond to the
###              INPUT, OUTPUT, and FORWARD chains.
### “Table”: Can be any Netfilter table, but the default is “filter”.
### “From_chain”: Is the chain from which packets will be jumped.
### “Jump_rule_position”: Defines the position within the From_chain where
###                       the jump rule is added.
### “To_chain”: Is the chain to which packets will be jumped. This is the
###             main chain where psad rules are added.
### “Rule_position”: Defines the position where rule are added within the
###                  To_chain.
###
### The following defaults make sense for most installations, but note
### it is possible to include blocking rules in, say, the “nat” table
### using this functionality as well.  The following three lines provide
### usage examples:
#IPT_AUTO_CHAIN1              DROP, src, filter, INPUT, 1, PSAD_BLOCK_INPUT, 1;
#IPT_AUTO_CHAIN2              DROP, dst, filter, OUTPUT, 1, PSAD_BLOCK_OUTPUT, 1;
#IPT_AUTO_CHAIN3              DROP, both, filter, FORWARD, 1, PSAD_BLOCK_FORWARD, 1;
IPT_AUTO_CHAIN1             DROP, src, filter, INPUT, 1, PSAD_BLOCK_INPUT, 1;
IPT_AUTO_CHAIN2             DROP, dst, filter, OUTPUT, 1, PSAD_BLOCK_OUTPUT, 1;
IPT_AUTO_CHAIN3             DROP, both, filter, FORWARD, 1, PSAD_BLOCK_FORWARD, 1;<\/p>\n

### Flush all existing rules in the psad chains at psad start time.
FLUSH_IPT_AT_INIT           Y;<\/p>\n

### Prerequisite check for existence of psad chains and jump rules
IPTABLES_PREREQ_CHECK       1;<\/p>\n

### Enable tcp wrappers blocking (only gets enabled if
### ENABLE_AUTO_IDS is also set)
TCPWRAPPERS_BLOCK_METHOD    N;<\/p>\n

### Set the whois timeout
WHOIS_TIMEOUT               60;  ### seconds<\/p>\n

### Set the number of times an ip can be seen before another whois
### lookup is issued.
WHOIS_LOOKUP_THRESHOLD      20;<\/p>\n

### Set the number of times an ip can be seen before another dns
### lookup is issued.
DNS_LOOKUP_THRESHOLD        20;<\/p>\n

### Enable psad to run an external script or program (use at your
### own risk!)
ENABLE_EXT_SCRIPT_EXEC      N;<\/p>\n

### Define an external program to run after a scan is caught.
### Note that the scan source ip can be specified on the command
### line to the external program through the use of the “SRCIP”
### string (along with some appropriate switch for the program).
### Of course this is only useful if the external program knows
### what to do with this information.
### Example:  EXTERNAL_SCRIPT       \/path\/to\/script –ip SRCIP -v;
EXTERNAL_SCRIPT             \/bin\/true;<\/p>\n

### Control execution of EXTERNAL_SCRIPT (only once per IP, or
### every time a scan is detected for an ip).
EXEC_EXT_SCRIPT_PER_ALERT   N;<\/p>\n

### Disk usage variables
DISK_CHECK_INTERVAL         300;  ### seconds<\/p>\n

### This can be set to 0 to disable disk checking altogether
DISK_MAX_PERCENTAGE         95;<\/p>\n

### This can be set to 0 to have psad not place any limit on the
### number of times it will attempt to remove data from
### \/var\/log\/psad\/.
DISK_MAX_RM_RETRIES         10;<\/p>\n

### Enable archiving of old scan directories at psad startup.
ENABLE_SCAN_ARCHIVE         N;<\/p>\n

### Truncate fwdata file at startup
TRUNCATE_FWDATA             Y;<\/p>\n

### Only archive scanning IP directories that have reached a danger
### level greater than or equal to this value.  Archiving old
### scanning ip directories only takes place at psad startup.
MIN_ARCHIVE_DANGER_LEVEL    1;<\/p>\n

### Email subject line config.  Change these prefixes if you want
### psad to generate email alerts that say something other than
### the following.
MAIL_ALERT_PREFIX           [psad-alert];
MAIL_STATUS_PREFIX          [psad-status];
MAIL_ERROR_PREFIX           [psad-error];
MAIL_FATAL_PREFIX           [psad-fatal];<\/p>\n

### URL for getting the latest psad signatures
SIG_UPDATE_URL              http:\/\/www.cipherdyne.org\/psad\/signatures;<\/p>\n

### These next two are psadwatchd vars
PSADWATCHD_CHECK_INTERVAL   5;  ### seconds
PSADWATCHD_MAX_RETRIES      10;<\/p>\n

### Directories
PSAD_DIR                    \/var\/log\/psad;
PSAD_RUN_DIR                \/var\/run\/psad;
PSAD_FIFO_DIR               \/var\/lib\/psad;
PSAD_LIBS_DIR               \/usr\/lib\/psad;
PSAD_CONF_DIR               \/etc\/psad;
PSAD_ERR_DIR                $PSAD_DIR\/errs;
CONF_ARCHIVE_DIR            $PSAD_CONF_DIR\/archive;
SCAN_DATA_ARCHIVE_DIR       $PSAD_DIR\/scan_archive;
ANALYSIS_MODE_DIR           $PSAD_DIR\/ipt_analysis;
SNORT_RULES_DIR             $PSAD_CONF_DIR\/snort_rules;<\/p>\n

### Files
FW_DATA_FILE                $PSAD_DIR\/fwdata;
ULOG_DATA_FILE              $PSAD_DIR\/ulogd.log;
FW_CHECK_FILE               $PSAD_DIR\/fw_check;
DSHIELD_EMAIL_FILE          $PSAD_DIR\/dshield.email;
SIGS_FILE                   $PSAD_CONF_DIR\/signatures;
ICMP_TYPES_FILE             $PSAD_CONF_DIR\/icmp_types;
AUTO_DL_FILE                $PSAD_CONF_DIR\/auto_dl;
SNORT_RULE_DL_FILE          $PSAD_CONF_DIR\/snort_rule_dl;
POSF_FILE                   $PSAD_CONF_DIR\/posf;
P0F_FILE                    $PSAD_CONF_DIR\/pf.os;
IP_OPTS_FILE                $PSAD_CONF_DIR\/ip_options;
PSAD_FIFO_FILE              $PSAD_FIFO_DIR\/psadfifo;
ETC_HOSTS_DENY_FILE         \/etc\/hosts.deny;
ETC_SYSLOG_CONF             \/etc\/syslog.conf;
ETC_RSYSLOG_CONF            \/etc\/rsyslog.conf;
ETC_SYSLOGNG_CONF           \/etc\/syslog-ng\/syslog-ng.conf;
ETC_METALOG_CONF            \/etc\/metalog\/metalog.conf;
STATUS_OUTPUT_FILE          $PSAD_DIR\/status.out;
ANALYSIS_OUTPUT_FILE        $PSAD_DIR\/analysis.out;
INSTALL_LOG_FILE            $PSAD_DIR\/install.log;<\/p>\n

### PID files
PSAD_PID_FILE               $PSAD_RUN_DIR\/psad.pid;
PSAD_CMDLINE_FILE           $PSAD_RUN_DIR\/psad.cmd;
KMSGSD_PID_FILE             $PSAD_RUN_DIR\/kmsgsd.pid;
PSADWATCHD_PID_FILE         $PSAD_RUN_DIR\/psadwatchd.pid;<\/p>\n

### List of ips that have been auto blocked by iptables
### or tcpwrappers (the auto blocking feature is disabled by
### default, see the psad man page and the ENABLE_AUTO_IDS
### variable).
AUTO_BLOCK_IPT_FILE         $PSAD_DIR\/auto_blocked_iptables;
AUTO_BLOCK_TCPWR_FILE       $PSAD_DIR\/auto_blocked_tcpwr;<\/p>\n

### File used internally by psad to add Netfilter blocking
### rules to a running psad process
AUTO_IPT_SOCK               $PSAD_RUN_DIR\/auto_ipt.sock;<\/p>\n

FW_ERROR_LOG                $PSAD_ERR_DIR\/fwerrorlog;
PRINT_SCAN_HASH             $PSAD_DIR\/scan_hash;<\/p>\n

### \/proc interface for controlling ip forwarding
PROC_FORWARD_FILE           \/proc\/sys\/net\/ipv4\/ip_forward;<\/p>\n

### Packet counters for tcp, udp, and icmp protocols
PACKET_COUNTER_FILE         $PSAD_DIR\/packet_ctr;<\/p>\n

### Top scanned ports
TOP_SCANNED_PORTS_FILE      $PSAD_DIR\/top_ports;<\/p>\n

### Top signature matches
TOP_SIGS_FILE               $PSAD_DIR\/top_sigs;<\/p>\n

### Top attackers
TOP_ATTACKERS_FILE          $PSAD_DIR\/top_attackers;<\/p>\n

### Counter file for Dshield alerts
DSHIELD_COUNTER_FILE        $PSAD_DIR\/dshield_ctr;<\/p>\n

### Counter file for iptables prefixes
IPT_PREFIX_COUNTER_FILE     $PSAD_DIR\/ipt_prefix_ctr;<\/p>\n

### iptables command output and error collection files; these are
### used by IPTables::ChainMgr
IPT_OUTPUT_FILE             $PSAD_DIR\/psad.iptout;
IPT_ERROR_FILE              $PSAD_DIR\/psad.ipterr;<\/p>\n

### system binaries
iptablesCmd      \/sbin\/iptables;
shCmd            \/bin\/sh;
wgetCmd          \/usr\/bin\/wget;
gzipCmd          \/bin\/gzip;
mknodCmd         \/bin\/mknod;
psCmd            \/bin\/ps;
mailCmd          \/usr\/bin\/mail;
sendmailCmd      \/usr\/sbin\/sendmail;
ifconfigCmd      \/sbin\/ifconfig;
killallCmd       \/usr\/bin\/killall;
netstatCmd       \/bin\/netstat;
unameCmd         \/bin\/uname;
# we do not need to compile the whois client
# stripped the extention ..\/whois_psad
whoisCmd         \/usr\/bin\/whois;
dfCmd            \/bin\/df;
fwcheck_psadCmd  \/usr\/sbin\/fwcheck_psad;
psadwatchdCmd    \/usr\/sbin\/psadwatchd;
kmsgsdCmd        \/usr\/sbin\/kmsgsd;
psadCmd          \/usr\/sbin\/psad;<\/p><\/blockquote>\n

 \uc774 \ub2a5\ub3d9\uc801 \uc751\ub2f5 \uc124\uc815\uc5d0 \ub300\ud574 \uc0b4\ud3b4\ubcfc \uac83\uc774 \ub9ce\ub2e4. \uc6b0\uc120 psad\ub294 AUTO_BLOCK_TIMEOUT \ubcc0\uc218\ub97c \ud1b5\ud574 \uacf5\uaca9\uc790\ub97c \uc601\uc18d\uc801\uc73c\ub85c \ucc28\ub2e8\ud558\uc9c0 \uc54a\ub294\ub2e4(psad\ub294 \uacf5\uaca9\uc790\uc5d0 \ub300\ud55c \ucc28\ub2e8 \uaddc\uce59\uc744 3600\ucd08, \uc989 \ud55c\uc2dc\uac04 \ub3d9\uc548\ub9cc \ucd94\uac00\ud55c\ub2e4). \ub458\uc9f8\ub85c \ucc28\ub2e8 \uaddc\uce59\uc774 \uc778\uc2a4\ud134\uc2a4\ud654\ub418\uae30 \uc804\uc5d0 \uacf5\uaca9\uc790\ub294 \ucd5c\uc18c\ud55c DANGER_LEVEL3\uc5d0 \ub3c4\ub2ec\ud574\uc57c \ud55c\ub2e4. \uc774\ub294 \ucd5c\uc18c\ud55c 150\uac1c\uc758 \ud328\ud0b7\uc744 \uc218\ubc18\ud558\uc9c0 \uc54a\uac70\ub098 \/etc\/psad\/signature \uc5d0\uc11c psad_dl\uc774 3\uc73c\ub85c \uc124\uc815\ub41c \uc11c\uba85\uacfc \ub9e4\uce6d\ub418\uc9c0 \uc54a\uac70\ub098 \/etc\/psad\/auto_dl \uc5d0\uc11c \uc704\ud5d8 \uc218\uc900\uc774 \ucd5c\uc18c\ud55c 3\uc73c\ub85c \uc790\ub3d9 \ud560\ub2f9\ub418\uc9c0 \uc54a\ub294 \uc2a4\uce94\uc5d0 \ub300\ud574\uc11c\ub294 \uc5b4\ub5a4 \uc870\uce58\ub3c4 \ucde8\ud574\uc9c0\uc9c0 \uc54a\ub294\ub2e4\ub294 \uac83\uc744 \uc758\ubbf8\ud55c\ub2e4. \ub05d\uc73c\ub85c ENABLE_AUTO_IDS_REGEX\uac00 N \uc774\uae30 \ub54c\ubb38\uc5d0 IP \uc8fc\uc18c \ucc28\ub2e8\uc744 \uc704\ud574 \ud544\ud130\ub9c1 \uc815\ucc45\uc774 \ud2b9\uc218 \ub85c\uae45 \uc811\ub450\uc5b4\ub97c \uc0dd\uc131\ud560 \ud544\uc694\ub294 \uc5c6\ub2e4.<\/p>\n

 ** SYN \uc2a4\uce94 \uc751\ub2f5<\/p>\n

 \uacf5\uaca9\uc790\uac00 iptables \ubc29\ud654\ubcbd\uc5d0 \ub300\ud574 \ud45c\uc900 Nmap SYN \uc2a4\uce94\uc744 \uc218\ud589\ud574\ubcf4\uc790.<\/p>\n

soft-ftp:\/etc# nmap -sS -P0 -n X.X.X.X<\/p>\n

Starting Nmap 4.11 ( http:\/\/www.insecure.org\/nmap\/ ) at 2010-07-04 23:48 KST
Interesting ports on 117.17.172.120:
Not shown: 1674 filtered ports
PORT    STATE  SERVICE
20\/tcp  closed ftp-data
21\/tcp  open   ftp
22\/tcp  open   ssh
53\/tcp  closed domain
80\/tcp  open   http
443\/tcp closed https<\/p>\n

Nmap finished: 1 IP address (1 host up) scanned in 153.357 seconds<\/p><\/blockquote>\n

 \uc2e4\uc81c\ub85c psad\ub294 (\uc55e\uc11c \uc124\uba85\ud55c\ub300\ub85c IPT_AUTO_CHAIN{n} \ubcc0\uc218\uc5d0 \uc815\uc758\ub41c \ub9de\ucda4\ud654 psad \uccb4\uc778\uc5d0 \ucc28\ub2e8 \uaddc\uce59\uc744 \ucd94\uac00\ud574\uc11c \uacf5\uaca9\uc790\ub97c \ucc28\ub2e8\ud588\uc73c\uba70, iptables -v -n -L \uc758 \ucd9c\ub825\uc744 \uc790\uc138\ud788 \uac80\uc0c9\ud558\ub294 \ub300\uc2e0 \uc0ac\uc6a9\uc790\uac00 psad \uccb4\uc778\uc5d0\uc11c \uc0c8\ub85c\uc6b4 \ucc28\ub2e8 \uaddc\uce59\uc744 \uc27d\uac8c \ubcfc \uc218 \uc788\uac8c \ud574\uc900\ub2e4.<\/p>\n

root@seclab:\/etc\/psad# psad –fw-list
[+] Listing chains from IPT_AUTO_CHAIN keywords…<\/p>\n

Chain PSAD_BLOCK_INPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination        
  347 15268 DROP       all  —  *      *       X.X.X.X      0.0.0.0\/0               <\/p>\n

Chain PSAD_BLOCK_OUTPUT (1 references)
 pkts bytes target     prot opt in     out     source               destination        
    0     0 DROP       all  —  *      *       0.0.0.0\/0            X.X.X.X
   <\/p>\n

Chain PSAD_BLOCK_FORWARD (1 references)
 pkts bytes target     prot opt in     out     source               destination        
    0     0 DROP       all  —  *      *       0.0.0.0\/0            X.X.X.X     
    0     0 DROP       all  —  *      *       X.X.X.X       0.0.0.0\/0                   <\/p><\/blockquote>\n

 \uc0c1\ud0dc \uce21\uba74\uc5d0\uc11c \ubcf4\uba74 psad –Status \uba85\ub839\uc5b4\ub97c \uc0ac\uc6a9\ud574\uc11c IP \uc8fc\uc18c\uc5d0 \ub300\ud55c \ucc28\ub2e8 \uaddc\uce59\uc774 \uc55e\uc73c\ub85c \uc5bc\ub9c8 \ub3d9\uc548 \ub354 \uc720\ud6a8\ud55c\uc9c0 \ud655\uc778\ud560 \uc218\ub3c4 \uc788\ub2e4. \uc774 \uba85\ub839\uc5b4\uc758 \uc804\uccb4 \ucd9c\ub825\uc740 \uc5ec\uae30\uc5d0 \ubcf4\uc774\uc9c0 \uc54a\uc9c0\ub9cc \ub05d\ubd80\ubd84\uc5d0\ub294 \ub2e4\uc74c\uacfc \uac19\uc740 \ub450 \uc904\uc774 \ub098\uc628\ub2e4. \uc774 \uacbd\uc6b0 \uc544\ub798\uc758 \ub450 \uc904\uc744 \ud1b5\ud574 IP X.X.X.X \uac00 \ucd1d 65\ucd08 \ub3d9\uc548 \ub354 \ucc28\ub2e8\ub41c\ub2e4\ub294 \uac83\uc744 \uc54c \uc218 \uc788\ub2e4.<\/p>\n

    iptables auto-blocked IPs:
      X.X.X.X (65 seconds remaining)<\/p><\/blockquote>\n

 \ub05d\uc73c\ub85c \ubaa9\ud45c\uac00 \uacf5\uaca9\uc790\ub85c\ubd80\ud130 \uc811\uadfc\ud560 \uc218 \uc5c6\uac8c \ub410\ub2e4\ub294 \uac83\uc744 \ud655\uc778\ud558\uae30 \uc704\ud574 \uc2a4\uce94\uc744 \ub2e4\uc2dc \uc2dc\ub3c4\ud574\ubcf4\uc790. \uc774\ubc88\uc5d0\ub294 \uadf8 \uc5b4\ub5a4 \ud3ec\ud2b8\ub3c4 \ub3c4\ub2ec\ud560 \uc218 \uc5c6\uc744 \uac83\uc774\ub2e4.<\/p>\n

 * \uc368\ub4dc\ud30c\ud2f0 \ub3c4\uad6c\uc640 psad \ub2a5\ub3d9\uc801 \uc751\ub2f5\uc758 \ud1b5\ud569<\/p>\n

 \ub9ce\uc740 \uc18c\ud504\ud2b8\uc6e8\uc5b4 \uc5c5\uccb4\uac00 \uc368\ub4dc\ud30c\ud2f0 \uc18c\ud504\ud2b8\uc6e8\uc5b4\uac00 \uc790\uc0ac \uc18c\ud504\ud2b8\uc6e8\uc5b4\ub97c \uad00\ub9ac\ud558\uac70\ub098 \uc790\uc0ac \uc18c\ud504\ud2b8\uc6e8\uc5b4\uc640 \uc5f0\ub3d9\ud558\uae30 \uc27d\uac8c API \ub97c \ub9cc\ub4e0\ub2e4. API \ub97c \uc774\uc6a9\ud558\uc9c0 \uc54a\uc73c\uba74 \uc5bb\uc744 \uc218 \uc5c6\ub294 \uc735\ud1b5\uc131, \ud50c\ub7ec\uadf8\uc778 \uac00\ub2a5\uc131, \uc2a4\ud06c\ub9bd\ud2b8\ud654 \uac00\ub2a5\uc131\uc774 API\ub97c \ud1b5\ud574 \uc81c\uacf5\ub418\uae30 \ub54c\ubb38\uc5d0 API\ub294 \uc0ac\uc6a9\uc790\ub098 \uc124\uce58 \uae30\ubc18\uc744 \uc99d\uac00\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n

 ** \uba85\ub839 \ud589 \uc778\ud130\ud398\uc774\uc2a4<\/p>\n

 psad\ub294 \ub3d9\uc801\uc73c\ub85c \ucd94\uac00\ub418\ub294(\uadf8\ub9ac\uace0 \uc0ad\uc81c\ub418\ub294) iptables \uaddc\uce59\uc744 \ud1b5\ud574 \uacf5\uaca9 IP \uc8fc\uc18c\ub97c \ucc28\ub2e8\ud558\ub294 \uac83 \uc774\uc0c1\uc758 \uae30\ub2a5\uc744 \uc81c\uacf5\ud55c\ub2e4. \ub2a5\ub3d9\uc801 \uc751\ub2f5 \uae30\ub2a5 \uc5ed\uc2dc (\uc751\ub2f5 \uae30\ub2a5\uc744 \uc27d\uac8c \uc2a4\ud06c\ub9bd\ud2b8\ud654 \uac00\ub2a5\ud558\uac8c \ud574\uc8fc\ub294) \uba85\ub839 \ud589 \uc778\ud130\ud398\uc774\uc2a4\ub97c \ud1b5\ud558\uac70\ub098 \uc720\ub2c9\uc2a4 \ub3c4\uba54\uc778 \uc18c\ucf13\uc744 \ud1b5\ud574 \uc2e4\ud589 \uc911\uc778 psad \ub370\ubaac\uacfc \uc880 \ub354 \uc9c1\uc811\uc801\uc73c\ub85c \ud1b5\uc2e0\ud568\uc73c\ub85c\uc368 \uc368\ub4dc\ud30c\ud2f0 \ub3c4\uad6c\uc640 \uc27d\uac8c \ud1b5\ud569\ub420 \uc218 \uc788\ub2e4. \ub2e4\uc74c\uc740 \uc81c3\uc790 \uc560\ud50c\ub9ac\ucf00\uc774\uc158\uc5d0 iptables \uaddc\uce59\uc9d1\ud569 \uad00\ub9ac \uae30\ub2a5\uc744 \uc9c1\uc811 \ub9cc\ub4dc\ub294 \ub300\uc2e0 \uc774\ub97c \uc704\ud574 psad\ub97c \uc0ac\uc6a9\ud558\ub294 \uac83\uc774 \uac00\uc9c0\ub294 \uc7a5\uc810\uc774\ub2e4.<\/p>\n

 – \ud0c0\uc774\uba38\uc5d0 \uae30\ubc18\ud574\uc11c \uaddc\uce59\uc744 \ub9cc\ub8cc\uc2dc\ud0ac \uc218 \uc788\ub294 \uae30\ub2a5\uc774 psad\uc5d0 \ub0b4\uc7a5\ub3fc \uc788\uc73c\ubbc0\ub85c \ub530\ub85c \uac1c\ubc1c\ud560 \ud544\uc694\uac00 \uc5c6\ub2e4.
 – psad\ub294 \ub3d9\uc801\uc73c\ub85c \uc0dd\uc131\ub41c \uaddc\uce59\uc758 \uc0bd\uc785\uacfc \uc0ad\uc81c\ub97c \uc790\uc2e0\ub9cc\uc758 \uccb4\uc778\uc5d0\uc11c \uad00\ub9ac\ud55c\ub2e4. \uc774\ub294 psad \uaddc\uce59\uc744 \uae30\uc874\uc758 iptables \uc815\ucc45\uacfc \uc644\uc804\ud788 \ubd84\ub9ac\uc2dc\ud0a8\ub2e4.
 – psad\ub294 psad \uccb4\uc778\uc5d0 \uc774\ubbf8 \ucc28\ub2e8 \uaddc\uce59\uc774 \uc788\ub294 \uacbd\uc6b0 \ud574\ub2f9 IP \uc8fc\uc18c\ub098 \ub124\ud2b8\uc6cc\ud06c\uc5d0 \ub300\ud574 \uc911\ubcf5 \uaddc\uce59\uc744 \ucd94\uac00\ud558\uc9c0 \uc54a\ub294\ub2e4.
 – psad\ub294 \/etc\/psad\/auto_dl \ud30c\uc77c\uc744 \uc774\uc6a9\ud574\uc11c \ud5c8\uc6a9\ub41c IP \uc8fc\uc18c\ub098 \ub124\ud2b8\uc6cc\ud06c\uac00 \ucc28\ub2e8\ub418\uc9c0 \uc54a\uac8c \ubcf4\uc7a5\ud55c\ub2e4.
 – \ud604\uc7ac \ucc28\ub2e8 \uc911\uc778 IP \uc8fc\uc18c\uc5d0 \ub300\ud55c \uc0c1\ud0dc \uc815\ubcf4\ub294 psad –Status \uba85\ub839\uc744 \ud1b5\ud574 \uc27d\uac8c \ud655\uc778\ud560 \uc218 \uc788\ub2e4.
 – psad \ub9de\ucda4\ud654 \uccb4\uc778\uc758 \ubaa9\ub85d\uc740 psad –fw-list \uba85\ub839\uc744 \ud1b5\ud574 \ud655\uc778\ud560 \uc218 \uc788\ub2e4. \uc774\ub97c \ud1b5\ud574 psad\ub97c \ud1b5\ud574 \uc0dd\uc131\ub41c iptables \uaddc\uce59\uacfc \ubcf5\uc7a1\ud55c \ud544\ud130\ub9c1 \uc815\ucc45 \ub0b4\uc758 \ub2e4\ub978 \uaddc\uce59\uc744 \uc27d\uac8c \uad6c\ubcc4\ud560 \uc218 \uc788\ub2e4.<\/p>\n

 psad\uc758 \uba85\ub839 \ud589 \ud638\ucd9c\uc744 \ud1b5\ud574 \uc774\uc6a9\ud560 \uc218 \uc788\ub294 \ub2a5\ub3d9\uc801 \uc751\ub2f5 \uae30\ub2a5\uc744 \uc0ac\uc6a9\ud558\ub824\uba74 \uc2dc\uc2a4\ud15c\uc5d0 \ub370\ubaac\uc73c\ub85c \uc2e4\ud589 \uc911\uc778 psad \uc778\uc2a4\ud134\uc2a4\uac00 \uc788\uc5b4\uc57c \ud55c\ub2e4. \uc2e4\ud589 \uc911\uc778 psad \ub370\ubaac\uc774 \uc5c6\ub2e4\uba74 \ud604\uc7ac psad\uac00 \uc2e4\ud589 \uc911\uc774\uc9c0 \uc54a\ub2e4\ub294 \uc624\ub958\uac00 \ubc1c\uc0dd\ud55c\ub2e4.<\/p><\/blockquote>\n

 – \ucc28\ub2e8 \uaddc\uce59 \ucd94\uac00<\/p>\n

 –fw-block-ip \uba85\ub839 \ud589 \uc778\uc790\ub97c \uc0ac\uc6a9\ud558\uba74 \uc9c1\uc811 \ud2b9\uc815 IP \uc8fc\uc18c\ub098 \ub124\ud2b8\uc6cc\ud06c\uc5d0 \ub300\ud55c \ucc28\ub2e8 \uaddc\uce59\uc744 \ub9de\ucda4\ud654 psad \uccb4\uc778\uc5d0 \ucd94\uac00\ud560 \uc218 \uc788\ub2e4. \ub2e4\uc74c\uc758 \uc608\ub97c \ubcf4\uc790.<\/p>\n

root@seclab:\/etc\/psad# psad –fw-block-ip 192.168.10.1
[+] Writing 192.168.10.1 to socket; psad will add the IP
    within 5 seconds.<\/p><\/blockquote>\n

\uc77c\ub2e8 \uc2e4\ud589 \uc911\uc778 psad \ub370\ubaac\uc5d0\uc11c CHECK_INTERVAL \ud0c0\uc774\uba38\uac00 \ub9cc\ub8cc\ub418\uba74 \ud574\ub2f9 IP \uc8fc\uc18c\ub294 AUTO_BLOCK_TIMEOUT \ubcc0\uc218\uc5d0 \ud574\ub2f9\ud558\ub294 \uae30\uac04 \ub3d9\uc548 \ucc28\ub2e8 \uccb4\uc778\uc5d0 \ucd94\uac00\ub41c\ub2e4.<\/p>\n

Jul  5 01:13:25 seclab psad: added iptables auto-block against 192.168.10.1 for 360 seconds<\/p><\/blockquote>\n

 – \ucc28\ub2e8 \uaddc\uce59 \uc81c\uac70<\/p>\n

 \ud2b9\uc815 IP \uc8fc\uc18c\ub098 \ub124\ud2b8\uc6cc\ud06c\uc5d0 \ub300\ud55c \ubaa8\ub4e0 \ucc28\ub2e8 \uaddc\uce59\uc744 \uc81c\uac70\ud558\ub824\uba74 –fw-rm-block-ip \uba85\ub839 \ud589 \uc778\uc790\ub97c \uc0ac\uc6a9\ud55c\ub2e4.<\/p>\n

root@seclab:\/etc\/psad# psad –fw-rm-block-ip 192.168.10.1
[+] Writing 192.168.10.1 to socket; psad will remove the IP
    within 5 seconds.<\/p><\/blockquote>\n

 \uc2e4\uc81c\ub85c \uc2e4\ud589 \uc911\uc778 psad\uac00 \ucc28\ub2e8 \uaddc\uce59\uc744 \ub9cc\ub8cc\uc2dc\ud0a8\ub2e4.<\/p>\n

Jul  5 01:17:00 seclab psad: removed iptables auto-block against 192.168.10.1<\/p><\/blockquote>\n

 – \ubaa8\ub4e0 \ucc28\ub2e8 \uaddc\uce59 \uc81c\uac70<\/p>\n

 \ub54c\ub54c\ub85c \uae30\ubcf8\uc801\uc778 \ub124\ud2b8\uc6cc\ud06c \uc5f0\uacb0\uc131\uc5d0 \ubb38\uc81c\uac00 \uc0dd\uae38 \uc218 \uc788\uc73c\uba70, \uc5b4\ub5a4 \uacbd\uc6b0\uc5d0\ub294 \ub2a5\ub3d9\uc801 \uc751\ub2f5 \uae30\ubc95 \ub54c\ubb38\uc5d0 \uc774\ub7f0 \uc5f0\uacb0\uc131 \ubb38\uc81c\uac00 \uc545\ud654\ub420 \uc218 \uc788\ub2e4. \ud2b9\uc815 IP \uc8fc\uc18c\ub098 \ub124\ud2b8\uc6cc\ud06c\ub97c \ud5c8\uc6a9 \ubaa9\ub85d\uc5d0 \ucd94\uac00\ud560 \uc218 \uc788\ub294 \uc81c\uacf5\ud558\ub294 \uac83 \uc678\uc5d0\ub3c4 \ub2a5\ub3d9\uc801 \uc751\ub2f5 \uae30\ubc95\uc740 \ub124\ud2b8\uc6cc\ud06c\uc5d0 \uc790\uc2e0\uc774 \ubbf8\uce58\ub294 \uc601\ud5a5\uc744 \uc27d\uac8c \uc81c\uac70\ud560 \uc218 \uc788\uac8c \ud574\uc918\uc57c \ud55c\ub2e4. psad\uc758 \uacbd\uc6b0\uc5d0\ub294 \ub3d9\uc801\uc73c\ub85c \uc0dd\uc131\ub418\ub294 iptables \uaddc\uce59\ubfd0\ub9cc \uc544\ub2c8\ub77c \ub9de\ucda4\ud654 psad \uccb4\uc778\uc5d0 \uc874\uc7ac\ud558\ub294 \ubaa8\ub4e0 \uaddc\uce59\uc744 \uc27d\uac8c \uc81c\uac70\ud560 \uc218 \uc788\ub294 \ubc29\ubc95\ub3c4 \uc81c\uacf5\ud574\uc57c \ud55c\ub2e4. psad –Flush \uba85\ub839\uc774 \uc774 \uae30\ub2a5\uc744 \uc81c\uacf5\ud55c\ub2e4.<\/p>\n

root@seclab:~# psad –Flush
[+] Flushing psad chains.<\/p><\/blockquote>\n

 \uc77c\ub2e8 CHECK_INTERVAL \ud0c0\uc774\uba38\uac00 \ub9cc\ub8cc\ub418\uba74 \uc2e4\ud589 \uc911\uc778 psad \ub370\ubaac\uc774 \ub2e4\uc74c\uacfc \uac19\uc740 syslog \uba54\uc2dc\uc9c0\ub97c \uc0dd\uc131\ud55c\ub2e4.<\/p>\n

Jul  6 00:28:52 seclab psad: flushing existing psad iptables auto-response chains
Jul  6 00:28:52 seclab psad: flushed: PSAD_BLOCK_INPUT
Jul  6 00:28:52 seclab psad: flushed: PSAD_BLOCK_OUTPUT
Jul  6 00:28:52 seclab psad: flushed: PSAD_BLOCK_FORWARD<\/p><\/blockquote>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

 * \uce68\uc785 \ubc29\uc9c0\uc640 \ub2a5\ub3d9\uc801 \uc751\ub2f5  \uc624\ub298\ub0a0 \ub098\uc640 \uc788\ub294 \ub2e4\uc591\ud55c \ubcf4\uc548 \uc81c\ud488, \uae30\uc220, \uc194\ub8e8\uc158\uc5d0\uc11c \uce68\uc785 \ud0d0\uc9c0\ub77c\ub294 \uc6a9\uc5b4\ub294 \ud070 \uc8fc\ubaa9\uc744 \ubc1b\uc544\uc654\ub2e4. \uc774\ub7ec\ud55c \uc8fc\ubaa9\uc758 \ub300\ub2e4\uc218\ub294 \uc774 \uc6a9\uc5b4\uac00 \uc8fc\ub294 \uc9c0\ub098\uce58\uac8c \uac15\ud55c \uc758\ubbf8\uc5d0\uc11c \ub098\uc628\uac83\uc73c\ub85c \ubcf4\uc778\ub2e4. \ubb3c\ub860 \ubcf4\uc548 \uce68\ubd80\ub97c \uc0ac\uc804\uc5d0 \ubc29\uc9c0\ud55c\ub2e4\ub294 \uac1c\ub150 \uc790\uccb4\uac00 \uc7a5\uc810\uc774 \uc5c6\ub2e4\ub294 \ub73b\uc740 … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[52],"tags":[218,311,557,664],"_links":{"self":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/posts\/893"}],"collection":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=893"}],"version-history":[{"count":0,"href":"http:\/\/pchero21.com\/index.php?rest_route=\/wp\/v2\/posts\/893\/revisions"}],"wp:attachment":[{"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=893"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=893"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/pchero21.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}