mechennu
Sep 23 2003, 02:47 AM
##########################################
psad: Email message limit for 207.41.xx.xx has been reached on
mydomain.com (207.xxx.xxx.xxx)!!!
##########################################
What is this psad? and why i am getting this error message on my linux box? how can i rectify this? Any enhanced tools to moniter illegal accces to my server?And how to restrict spamming to my server? Plz help me as a new bee was confised with these .
Thanks in Advance.........
Chennu.
mouse
Sep 23 2003, 04:06 AM
My guess is you installed BAstille and PSAD..
search forum for PSAD for a listing and understanding of what it is..
as to the email, it means that someone from that IP keeps getting tagged by your server (PSAD in specific) for scanning ports or doing something it doesnt like so it has emailed you.. Mouse
jaume
Sep 23 2003, 04:07 AM
PaulB
Sep 23 2003, 10:50 AM
Okay, I know what psad is, and I know that a lot of what it reports as scans are not attacks. I've tweaked the settings so I don't get an e-mail for every last incident.
What I am curious about is why I get a huge number of "scans" for IP numbers that belong to RackShack - not RackShack customers, but RackShack it's self (for example 207.218.192.96). I've set these IP numbers to be ignored, so I only see an e-mail when the message limit is reached. I know this is nothing to be concerned about, I just wonder why it happens and what is being done that causes it.