psad-2.0.4 released

[Michael Rash <mbr () cipherdyne org>]

Hi all -

psad-2.0.4 has been released.  Here is the complete change log:

- Added Snort rule matches to syslog alerts.  Multiple matches can
  be controlled with new configuration variables in psad.conf:
  ENABLE_SIG_MSG_SYSLOG, SIG_MSG_SYSLOG_THRESHOLD, and
  SIG_SID_SYSLOG_THRESHOLD.
- Bugfix to include scanned UDP port ranges in syslog alerts.
- Bugfix to parse SEQ and ACK iptables log message fields (requires
  --log-tcp-sequence on the iptables command line).  This allows the
  ipEye signature to work.
- Added --debug-sid to allow a specific Snort rule to be debugged
  while psad runs it through its detection engine.  A consequence of
  this is that the -d command line argument must be spelled out, i.e.
  "psad --debug".
- Bugfix to allow logging prefixes to omit trailing spaces.  This is
  a bug in the iptables logging format to allow this in the first place,
  but before this gets fixed psad needs to compensate.
- Bugfix for syslog-ng init script path in install.pl.
- Bugfix to include a "source" definition for /proc/kmsg if not already
  defined for syslog-ng daemons.
- Minor memory handling bugfixes discovered by the excellent Valgrind
  project: http://www.valgrind.org

Another interesting bit of news is that Tenable Network Security has
added support for importing psad syslog events into their products:

http://blog.tenablesecurity.com/2007/01/psad_rules_for_.html
http://www.cipherdyne.org/blog/2007/01/tenable-network-security-and-log-parser-for-psad-events.html

As usual, psad can be downloaded from:

http://www.cipherdyne.org/psad/download/

Also, I've updated cipherdyne.org to include blog style links (RSS and
Atom feeds are available too), so the complete psad-2.0.4 release
posting can be found here (includes few sample syslog signature matches
reported by psad):

http://www.cipherdyne.org/blog/2007/01/software-release-psad-2.0.4.html

--
Michael Rash
http://www.cipherdyne.org/
Key fingerprint = 53EA 13EA 472E 3771 894F  AC69 95D8 5D6B A742 839F

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------