Portsentry

Portsentry portscan detect&block Installation log mscompute team

#apt-get install portsentry

#nano /etc/portsentry/portsentry.conf
BLOCK_UDP="1"

BLOCK_TCP="1"

#cd /etc/init.d/
nano portsentryscript

#!/bin/bash
case "$1" in
start)

      echo "Starting Portsentry..."
      ps ax | grep -iw '/usr/sbin/portsentry  -atcp' | grep -iv 'grep' > /dev/null
      if [ $? != 0 ]; then
        /usr/sbin/portsentry  -atcp
      fi

ps ax | grep -iw '/usr/sbin/portsentry  -audp' | grep -iv 'grep' > /dev/null

      if [ $? != 0 ]; then
        /usr/sbin/portsentry  -audp
      fi
      echo "Portsentry is now up and running!"
  ;;
  stop)
      echo "Shutting down Portsentry..."
      array=(`ps ax | grep -iw '/usr/sbin/portsentry ' | grep -iv 'grep' \
                     | awk '{print $1}' | cut -f1 -d/ | tr '\n' ' '`)
      element_count=${#array[@]}
      index=0
      while [ "$index" -lt "$element_count" ]
      do
        kill -9 ${array[$index]}
        let "index = $index + 1"
      done
      echo "Portsentry stopped!"
  ;;
  restart)
      $0 stop  && sleep 3
      $0 start
  ;;
  *)
  echo "Usage: $0 {start|stop|restart}"
  exit 1



esac
exit 0

#chmod 644 portsentry
#chmod 755 portsentryscript
#update-rc.d portsentryscript defaults