https://sourceforge.net/projects/sentrytools/
[[email protected] ~]# tar -xzvf portsentry-1.2.tar.gz
[[email protected] ~]# cd portsentry_beta/
[[email protected] portsentry_beta]# ls
CHANGES portsentry.c portsentry_io.c README.COMPAT
CREDITS portsentry.conf portsentry_io.h README.install
ignore.csh portsentry_config.h portsentry_tcpip.h README.methods
LICENSE portsentry.h portsentry_util.c README.stealth
Makefile portsentry.ignore portsentry_util.h
[[email protected] portsentry_beta]# make
Usage: make <systype>
<systype> is one of: linux, debian-linux, bsd, solaris, hpux, hpux-gcc,
freebsd, osx, openbsd, netbsd, bsdi, aix, osf, irix, generic
This code requires snprintf()/vsnprintf() system calls
to work. If you run a modern OS it should work on
your system with ‘make generic‘. If you get it to
work on an unlisted OS please write us with the
changes.
Install: make install
NOTE: This will install the package in this
directory: /usr/local/psionic
Edit the makefile if you wish to change these paths.
Any existing files will be overwritten.
[[email protected] portsentry_beta]# make install
Creating psionic directory /usr/local/psionic
Setting directory permissions
Creating portsentry directory /usr/local/psionic/portsentry
Setting directory permissions
chmod 700 /usr/local/psionic/portsentry
Copying files
cp ./portsentry.conf /usr/local/psionic/portsentry
cp ./portsentry.ignore /usr/local/psionic/portsentry
cp ./portsentry /usr/local/psionic/portsentry
cp: cannot stat `./portsentry‘: No such file or directory
make: *** [install] Error 1
[[email protected] portsentry_beta]# make linux
SYSTYPE=linux
Making
cc -O -Wall -DLINUX -DSUPPORT_STEALTH -o ./portsentry ./portsentry.c ./portsentry_io.c ./portsentry_util.c
./portsentry.c: In function ‘PortSentryModeTCP’:
./portsentry.c:1187: warning: pointer targets in passing argument 3 of ‘accept’ differ in signedness
/usr/include/sys/socket.h:214: note: expected ‘socklen_t * __restrict__’ but argument is of type ‘int *’
./portsentry.c: In function ‘PortSentryModeUDP’:
./portsentry.c:1384: warning: pointer targets in passing argument 6 of ‘recvfrom’ differ in signedness
/usr/include/sys/socket.h:166: note: expected ‘socklen_t * __restrict__’ but argument is of type ‘int *’
./portsentry.c:1584:11: warning: missing terminating " character
./portsentry.c: In function ‘Usage’:
./portsentry.c:1584: error: missing terminating " character
./portsentry.c:1585: error: ‘sourceforget’ undeclared (first use in this function)
./portsentry.c:1585: error: (Each undeclared identifier is reported only once
./portsentry.c:1585: error: for each function it appears in.)
./portsentry.c:1585: error: expected ‘)’ before ‘dot’
./portsentry.c:1585: error: stray ‘\’ in program
./portsentry.c:1585:24: warning: missing terminating " character
./portsentry.c:1585: error: missing terminating " character
./portsentry.c:1595: error: expected ‘;’ before ‘}’ token
./portsentry_io.c: In function ‘ConfigTokenRetrieve’:
./portsentry_io.c:321: warning: cast from pointer to integer of different size
./portsentry_io.c:324: warning: cast from pointer to integer of different size
./portsentry_io.c: In function ‘IsBlocked’:
./portsentry_io.c:670: warning: cast from pointer to integer of different size
./portsentry_io.c: In function ‘SubstString’:
./portsentry_io.c:727: warning: cast from pointer to integer of different size
make: *** [linux] Error 1
解决方法 把portsentry.c中代“将带有Copyright 1997-2003字样的那行调整为一行即可”：
调整后如下：
[[email protected] portsentry_beta]# make linux SYSTYPE=linux Making cc -O -Wall -DLINUX -DSUPPORT_STEALTH -o ./portsentry ./portsentry.c ./portsentry_io.c ./portsentry_util.c ./portsentry.c: In function ‘PortSentryModeTCP’: ./portsentry.c:1187: warning: pointer targets in passing argument 3 of ‘accept’ differ in signedness /usr/include/sys/socket.h:214: note: expected ‘socklen_t * __restrict__’ but argument is of type ‘int *’ ./portsentry.c: In function ‘PortSentryModeUDP’: ./portsentry.c:1384: warning: pointer targets in passing argument 6 of ‘recvfrom’ differ in signedness /usr/include/sys/socket.h:166: note: expected ‘socklen_t * __restrict__’ but argument is of type ‘int *’ ./portsentry_io.c: In function ‘ConfigTokenRetrieve’: ./portsentry_io.c:321: warning: cast from pointer to integer of different size ./portsentry_io.c:324: warning: cast from pointer to integer of different size ./portsentry_io.c: In function ‘IsBlocked’: ./portsentry_io.c:670: warning: cast from pointer to integer of different size ./portsentry_io.c: In function ‘SubstString’: ./portsentry_io.c:727: warning: cast from pointer to integer of different size
[[email protected] portsentry_beta]# make install Creating psionic directory /usr/local/psionic Setting directory permissions Creating portsentry directory /usr/local/psionic/portsentry Setting directory permissions chmod 700 /usr/local/psionic/portsentry Copying files cp ./portsentry.conf /usr/local/psionic/portsentry cp ./portsentry.ignore /usr/local/psionic/portsentry cp ./portsentry /usr/local/psionic/portsentry Setting permissions chmod 600 /usr/local/psionic/portsentry/portsentry.ignore chmod 600 /usr/local/psionic/portsentry/portsentry.conf chmod 700 /usr/local/psionic/portsentry/portsentry Edit /usr/local/psionic/portsentry/portsentry.conf and change your settings if you haven‘t already. (route, etc) WARNING: This version and above now use a new directory structure for storing the program and config files (/usr/local/psionic/portsentry). Please make sure you delete the old files when the testing of this install is complete.
安装路径为：
[[email protected] portsentry_beta]# tree /usr/local/psionic/
/usr/local/psionic/
└── portsentry
├── portsentry
├── portsentry.conf
└── portsentry.ignore
1 directory, 3 files
PortSentry的配置：
1:通过PortSentry.conf
# Un-comment these if you are really anal: #TCP_PORTS="1,7,9,11,15,70,79,80,109,110,111,119,138,139,143,512,513,514,515,540,635,1080,1524,2000,2001,4000,4001,5742,6000,6001,6667,12345,12346,20034,27665,30303,32771,32772,32773,32774,31337,40421,40425,49724,54320" #UDP_PORTS="1,7,9,66,67,68,69,111,137,138,161,162,474,513,517,518,635,640,641,666,700,2049,31335,27444,34555,32770,32771,32772,32773,32774,31337,54321" # # Use these if you just want to be aware: TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,27665,31337,32771,32772,32773,32774,40421,49724,54320" UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,37444,34555,31335,32770,32771,32772,32773,32774,31337,54321" # # Use these for just bare-bones #TCP_PORTS="1,11,15,110,111,143,540,635,1080,1524,2000,12345,12346,20034,32771,32772,32773,32774,49724,54320" #UDP_PORTS="1,7,9,69,161,162,513,640,700,32770,32771,32772,32773,32774,31337,54321"
通过portSentry进行入侵检，首先制定要监视的端口清单和相应的阻止对策。然后启动后台进程对这些端口进行检测，一旦发现有人扫描这些端口，以及相应的对策进行阻拦。
通过portentry.conf中关于端口默认配置情况：
一般有意开放的端口是不需要监控的，如果web服务器的80端口！！！！！
在portsentry.conf中自动配置了许多文件如下：
########################################### # Advanced Stealth Scan Detection Options # ########################################### # # This is the number of ports you want PortSentry to monitor in Advanced mode. # Any port *below* this number will be monitored. Right now it watches # everything below 1024. # # On many Linux systems you cannot bind above port 61000. This is because # these ports are used as part of IP masquerading. I don‘t recommend you # bind over this number of ports. Realistically: I DON‘T RECOMMEND YOU MONITOR # OVER 1024 PORTS AS YOUR FALSE ALARM RATE WILL ALMOST CERTAINLY RISE. You‘ve been # warned! Don‘t write me if you have have a problem because I‘ll only tell # you to RTFM and don‘t run above the first 1024 ports. # # ADVANCED_PORTS_TCP="1024" ADVANCED_PORTS_UDP="1024" #这表明,1~1024的所有端口将被监视 # This field tells PortSentry what ports (besides listening daemons) to # ignore. This is helpful for services like ident that services such # as FTP, SMTP, and wrappers look for but you may not run (and probably # *shouldn‘t* IMHO). # # By specifying ports here PortSentry will simply not respond to # incoming requests, in effect PortSentry treats them as if they are # actual bound daemons. The default ports are ones reported as # problematic false alarms and should probably be left alone for # all but the most isolated systems/networks. #但监视高端口号会引起更多的误报，可以通下面参数排除出错的端口 # Default TCP ident and NetBIOS service ADVANCED_EXCLUDE_TCP="111,113,139" #默认请况,使用tcp(111,113,139)的ident和NetBIOS服务以及UDP(520,138,137,67)route,NetBIOS和Bootp服务将被排除在高级扫描之外。 # Default UDP route (RIP), NetBIOS, bootp broadcasts. ADVANCED_EXCLUDE_UDP="520,138,137,67" ######################
###################### # Configuration Files# ###################### # # Hosts to ignore＃记录允许合法扫描服务器的主机地址 IGNORE_FILE="/usr/local/psionic/portsentry/portsentry.ignore" # Hosts that have been denied (running history)＃入侵主机的IP历史记录 HISTORY_FILE="/usr/local/psionic/portsentry/portsentry.history" # Hosts that have been denied this session only (temporary until next restart)＃被阻止连接主机的ip记录 BLOCKED_FILE="/usr/local/psionic/portsentry/portsentry.blocked"
设置路由重定向:
# Generic #KILL_ROUTE="/sbin/route add $TARGET$ 333.444.555.666" # Generic Linux KILL_ROUTE="/sbin/route add -host $TARGET$ gw 333.444.555.666" # Newer versions of Linux support the reject flag now. This # is cleaner than the above option. #KILL_ROUTE="/sbin/route add -host $TARGET$ reject" # Generic BSD (BSDI, OpenBSD, NetBSD, FreeBSD) #KILL_ROUTE="/sbin/route add $TARGET$ 333.444.555.666" #把数据包重定向到一个未知的主机，使这无法获取信息
我们还可以利用linux中的iptables命令，可以切断攻主机的连接:
# iptables support for Linux KILL_ROUTE="/usr/local/bin/iptables -I INPUT -s $TARGET$ -j DROP" # # For those of you running FreeBSD (and compatible) you can
可以直热门把攻击者的ip记录到/etc/hosts.deny文件中，利用TCP_Wrappers保护机制来防止攻击
############### # TCP Wrappers# ############### # This text will be dropped into the hosts.deny file for wrappers # to use. There are two formats for TCP wrappers: # # Format One: Old Style - The default when extended host processing # options are not enabled. # KILL_HOSTS_DENY="ALL: $TARGET$" # Format Two: New Style - The format used when extended option # processing is enabled. You can drop in extended processing # options, but be sure you escape all ‘%‘ symbols with a backslash # to prevent problems writing out (i.e. \%c \%h ) # #KILL_HOSTS_DENY="ALL: $TARGET$ : DENY"
系统默认是利用TCP_Wrappers来切断与主机之间的连接
改变完毕后，改变文件的权限，以保证其安全。
/usr/psionic/portentry/portsentry.ignore文件中设置portsentry忽略主机ip,限允许合法扫描的主机地址一面是配置情况:
[[email protected] portsentry]# cat portsentry.ignore # Put hosts in here you never want blocked. This includes the IP addresses # of all local interfaces on the protected host (i.e virtual host, mult-home) # Keep 127.0.0.1 and 0.0.0.0 to keep people from playing games. # # PortSentry can support full netmasks for networks as well. Format is: # # <IP Address>/<Netmask> # # Example: # # 192.168.2.0/24 # 192.168.0.0/16 # 192.168.2.1/32 # Etc. # # If you don‘t supply a netmask it is assumed to be 32 bits. # # 127.0.0.1/32 0.0.0.0 #Exclude all local interfaces 127.0.0.1
记得带上本机地址
portsentry启动检测模试。对应tcp和udp两种协议方式，portsentry分别有三种启动模式，即基本 秘密和高级秘密扫描检测模式，合计６种模式。
时间： 2024-12-25 06:02:01