[psad-discuss] PSAD without Postfix on Ubuntu

Michael Rash

2015-01-08 04:49:27 UTC

Hello Rinck,

Post by Rinck Sonnenberg
I'm new to the mailing list and hope to find some help/info here regarding
PSAD.
I noticed that PSAD has a fixed dependency on postfix (at least on my
Ubuntu 14.04 LTS system). Is there a way to disable this dependency? I am
not using email alerts in PSAD and do not want to install postfix on all
servers running PSAD. FWIW: I use Logstash to analyze my syslog and notify
me (via nagios) of any suspicious behaviour, so having PSAD email me the
same alert seems like overkill. I also have DSHIELD emails etc disabled.
Simply uninstalling postfix will result in PSAD being uninstalled as well.
Is there a way to make PSAD work without postfix or any other MTA for that
matter?

Yes, psad, can function without sending any email alerts, and generate only
syslog messages - just set the "ALERTING_METHODS" variable to "nomail" in
the /etc/psad/psad.conf file.

Now, in terms of the postfix dependency on Ubuntu, that is currently
enforced by the package itself but I see the issue. Maybe postfix should
not be an enforced dependency. I'll check with the package maintainer to
see what the options are here. In the meantime, if you are ok with
installing psad via its own installer (see the install.pl script in the
psad sources), then you can get psad installed and running.

Thanks,

--Mike

Post by Rinck Sonnenberg
Regards,
Rinck