海运的博客

Linux/Centos服务器安装portsentry防恶意端口扫描

发布时间:June 28, 2012 // 分类:网络安全 // No Comments

端口做为服务器的大门安全很重要,当服务器运行很多服务时并向外提供服务,为防止有人恶意侦测服务器用途,可使用portsentry来迷惑对方。
portsentry可设定侦听指定的TCP/UDP端口,当遇到扫描时会回应端口开放,并记录扫描者信息可做相应处理:防火墙阻止、路由定向、执行自定义脚本。
portsentry安装之rpm:

rpm -ivh http://flexbox.sourceforge.net/centos/5/x86_64/portsentry-1.2-1.el5.x86_64.rpm

portsentry编译安装:

wget http://sourceforge.net/projects/sentrytools/files/portsentry%201.x/portsentry-1.2/portsentry-1.2.tar.gz
cd portsentry_beta/
#编辑portsentry.c修改以下为一行
#printf ("Copyright 1997-2003 Craig H. Rowland <craigrowland at users dot sourceforget dot net>\n"); 
make linux
make install

portsentry配置文件:

cat /usr/local/psionic/portsentry/portsentry.conf
#TCP和UDP模式监听的端口,可自定义
TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,27665,31337,32771,32772,32773,32774,40421,49724,54320"
UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,37444,34555,31335,32770,32771,32772,32773,32774,31337,54321"
#忽略IP
IGNORE_FILE="/usr/local/psionic/portsentry/portsentry.ignore"
#所有拒绝IP记录
HISTORY_FILE="/usr/local/psionic/portsentry/portsentry.history"
#启动后拒绝IP记录
BLOCKED_FILE="/usr/local/psionic/portsentry/portsentry.blocked"
#对扫描IP的操作,0为无动作,1防火墙阻止,2执行脚本
BLOCK_UDP="0"
BLOCK_TCP="0"
#路由数据包
KILL_ROUTE="/sbin/route add -host $TARGET$ gw 333.444.555.666"
#Iptables阻止
KILL_ROUTE="/usr/local/bin/iptables -I INPUT -s $TARGET$ -j DROP"
#TCP wrappers阻止
KILL_HOSTS_DENY="ALL: $TARGET$"
#执行脚本
KILL_RUN_CMD="/some/path/here/script $TARGET$ $PORT$"

portsentry启动模式:

/usr/local/psionic/portsentry/portsentry -tcp 
#TCP基本端口绑定,以配置文件端口为准
/usr/local/psionic/portsentry/portsentry -udp
#UDP基本端口绑定,以配置文件端口为准
/usr/local/psionic/portsentry/portsentry -stcp
#TCP私密检测,只记录不回应端口开放
/usr/local/psionic/portsentry/portsentry -sudp
#UDP私密检测,只记录不回应端口开放
/usr/local/psionic/portsentry/portsentry -atcp
#UDP高级秘密检测,自动选择监听端口
/usr/local/psionic/portsentry/portsentry -audp 
#UDP高级秘密检测,自动选择监听端口

以基本TCP检测模式启动,用nmap扫描测试:

[root@xenserver5 ~]# nmap -sS  www.haiyun.me
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2012-06-11 22:35 CST
Interesting ports on typecho.domain.com (192.168.1.2):
Not shown: 1654 closed ports
PORT      STATE SERVICE
1/tcp     open  tcpmux
11/tcp    open  systat
15/tcp    open  netstat
22/tcp    open  ssh
79/tcp    open  finger
80/tcp    open  http
111/tcp   open  rpcbind
119/tcp   open  nntp
143/tcp   open  imap
443/tcp   open  https
540/tcp   open  uucp
635/tcp   open  unknown
1080/tcp  open  socks
1524/tcp  open  ingreslock
2000/tcp  open  callbook
3306/tcp  open  mysql
6667/tcp  open  irc
12345/tcp open  NetBus
12346/tcp open  NetBus
27665/tcp open  Trinoo_Master
31337/tcp open  Elite
32771/tcp open  sometimes-rpc5
32772/tcp open  sometimes-rpc7
32773/tcp open  sometimes-rpc9
32774/tcp open  sometimes-rpc11
54320/tcp open  bo2k

查看防火墙阻止记录:

cat /etc/hosts.deny 
ALL: 192.168.1.6

标签:网络安全, postsentry, 服务器安全, 入侵检测测, 防止端口扫描

评论已关闭

分类
最新文章
最近回复
  • 海运: 正常情况下编译整个内核执行make menuconfig后就不会出现此提示,当单独编译单个模块...
  • oijq: 就是用的armbian的配置文件哈,按你的教程做的,在执行make LOCALVERSION=...
  • 海运: 使用armbian的配置文件,其它添加或修改自己懂的部分,不懂的就不要碰了。
  • oijq: 编译时这些选项全部选Y吗?Actions Semi Platforms (ARCH_ACTIO...
  • 海运: n1编译bbr内核模块参考这个:https://www.haiyun.me/archives/...
  • jiqz: make M=net/ipv4/ CONFIG_TCP_CONG_BBR=m modules编...
  • ruralhunter: 哦,文档里应该是对的,是.config
  • ruralhunter: cp /mnt/boot/config-4.18.7-aml-s9xxx .config这里应...
  • 海运: 你是编译不成功呢?还是编译后不能运行呢?还是运行后不能访问web界面呢?
  • 白墨: 可能不清楚就是编译安装后启动后访问不了web界面