Difference between revisions of "Portsentry"

Revision as of 16:42, 6 December 2008

Portsentry portscan detect + block installation log mscompute team

#apt-get install portsentry

#nano /etc/portsentry/portsentry.conf
<span class="Apple-style-span" style="line-height: 16px; ">BLOCK_UDP="1"

</span>BLOCK_TCP="1"

#cd /etc/init.d/
<span class="Apple-style-span" style="line-height: 16px; ">#nano portsentryscript</span>

#!/bin/bash
case "$1" in

   start)
       echo "Starting Portsentry..."
       ps ax | grep -iw '/usr/sbin/portsentry  -atcp' | grep -iv 'grep' > /dev/null
       if [ $? != 0 ]; then
         /usr/sbin/portsentry  -atcp
       fi

       ps ax | grep -iw '/usr/sbin/portsentry  -audp' | grep -iv 'grep' > /dev/null
       if [ $? != 0 ]; then
         /usr/sbin/portsentry  -audp
       fi
       echo "Portsentry is now up and running!"
   ;;
   stop)
       echo "Shutting down Portsentry..."
       array=(`ps ax | grep -iw '/usr/sbin/portsentry ' | grep -iv 'grep' \
                      | awk '{print $1}' | cut -f1 -d/ | tr '\n' ' '`)
       element_count=${#array[@]}
       index=0
       while [ "$index" -lt "$element_count" ]
       do
         kill -9 ${array[$index]}
         let "index = $index + 1"
       done
       echo "Portsentry stopped!"
   ;;
   restart)
       $0 stop  && sleep 3
       $0 start
   ;;
   *)
   echo "Usage: $0 {start|stop|restart}"
   exit 1

esac

exit 0

#chmod 644 portsentry
chmod 755 portsentryscript
update-rc.d portsentryscript defaults