Linux/Centos服务器安装portsentry防恶意端口扫描
时间:2014-07-23 23:52 来源:linux.it.net.cn 作者:it
端口做为服务器的大门安全很重要，当服务器运行很多服务时并向外提供服务，为防止有人恶意侦测服务器用途，可使用portsentry来迷惑对方。
portsentry可设定侦听指定的TCP/UDP端口，当遇到扫描时会回应端口开放，并记录扫描者信息可做相应处理：防火墙阻止、路由定向、执行自定义脚本。
portsentry安装之rpm：
rpm -ivh http://flexbox.sourceforge.net/centos/5/x86_64/portsentry-1.2-1.el5.x86_64.rpm
portsentry编译安装：
wget http://sourceforge.net/projects/sentrytools/files/portsentry%201.x/portsentry-1.2/portsentry-1.2.tar.gz
cd portsentry_beta/
#编辑portsentry.c修改以下为一行
#printf ("Copyright 1997-2003 Craig H. Rowland <craigrowland at users dot sourceforget dot net>\n");
make linux
make install
portsentry配置文件：
cat /usr/local/psionic/portsentry/portsentry.conf
#TCP和UDP模式监听的端口，可自定义
TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,27665,31337,32771,32772,32773,32774,40421,49724,54320"
UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,37444,34555,31335,32770,32771,32772,32773,32774,31337,54321"
#忽略IP
IGNORE_FILE="/usr/local/psionic/portsentry/portsentry.ignore"
#所有拒绝IP记录
HISTORY_FILE="/usr/local/psionic/portsentry/portsentry.history"
#启动后拒绝IP记录
BLOCKED_FILE="/usr/local/psionic/portsentry/portsentry.blocked"
#对扫描IP的操作，0为无动作，1防火墙阻止，2执行脚本
BLOCK_UDP="0"
BLOCK_TCP="0"
#路由数据包
KILL_ROUTE="/sbin/route add -host $TARGET$ gw 333.444.555.666"
#Iptables阻止
KILL_ROUTE="/usr/local/bin/iptables -I INPUT -s $TARGET$ -j DROP"
#TCP wrappers阻止
KILL_HOSTS_DENY="ALL: $TARGET$"
#执行脚本
KILL_RUN_CMD="/some/path/here/script $TARGET$ $PORT$"
portsentry启动模式：
/usr/local/psionic/portsentry/portsentry -tcp
#TCP基本端口绑定，以配置文件端口为准
/usr/local/psionic/portsentry/portsentry -udp
#UDP基本端口绑定，以配置文件端口为准
/usr/local/psionic/portsentry/portsentry -stcp
#TCP私密检测，只记录不回应端口开放
/usr/local/psionic/portsentry/portsentry -sudp
#UDP私密检测，只记录不回应端口开放
/usr/local/psionic/portsentry/portsentry -atcp
#UDP高级秘密检测，自动选择监听端口
/usr/local/psionic/portsentry/portsentry -audp
#UDP高级秘密检测，自动选择监听端口
以基本TCP检测模式启动，用nmap扫描测试：
[root@xenserver5 ~]# nmap -sS www.myhack58.com
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2012-06-11 22:35 CST
Interesting ports on typecho.domain.com (192.168.1.2):
Not shown: 1654 closed ports
PORT STATE SERVICE
1/tcp open tcpmux
11/tcp open systat
15/tcp open netstat
22/tcp open ssh
79/tcp open finger
80/tcp open http
111/tcp open rpcbind
119/tcp open nntp
143/tcp open imap
443/tcp open https
540/tcp open uucp
635/tcp open unknown
1080/tcp open socks
1524/tcp open ingreslock
2000/tcp open callbook
3306/tcp open mysql
6667/tcp open irc
12345/tcp open NetBus
12346/tcp open NetBus
27665/tcp open Trinoo_Master
31337/tcp open Elite
32771/tcp open sometimes-rpc5
32772/tcp open sometimes-rpc7
32773/tcp open sometimes-rpc9
32774/tcp open sometimes-rpc11
54320/tcp open bo2k
查看防火墙阻止记录：
cat /etc/hosts.deny
ALL: 192.168.1.6
(责任编辑：IT)
端口做为服务器的大门安全很重要，当服务器运行很多服务时并向外提供服务，为防止有人恶意侦测服务器用途，可使用portsentry来迷惑对方。
portsentry可设定侦听指定的TCP/UDP端口，当遇到扫描时会回应端口开放，并记录扫描者信息可做相应处理：防火墙阻止、路由定向、执行自定义脚本。
portsentry安装之rpm：
rpm -ivh http://flexbox.sourceforge.net/centos/5/x86_64/portsentry-1.2-1.el5.x86_64.rpm
portsentry编译安装：
wget http://sourceforge.net/projects/sentrytools/files/portsentry%201.x/portsentry-1.2/portsentry-1.2.tar.gz
cd portsentry_beta/
#编辑portsentry.c修改以下为一行
#printf ("Copyright 1997-2003 Craig H. Rowland <craigrowland at users dot sourceforget dot net>\n");
make linux
make install
portsentry配置文件：
cat /usr/local/psionic/portsentry/portsentry.conf
#TCP和UDP模式监听的端口，可自定义
TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,27665,31337,32771,32772,32773,32774,40421,49724,54320"
UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,37444,34555,31335,32770,32771,32772,32773,32774,31337,54321"
#忽略IP
IGNORE_FILE="/usr/local/psionic/portsentry/portsentry.ignore"
#所有拒绝IP记录
HISTORY_FILE="/usr/local/psionic/portsentry/portsentry.history"
#启动后拒绝IP记录
BLOCKED_FILE="/usr/local/psionic/portsentry/portsentry.blocked"
#对扫描IP的操作，0为无动作，1防火墙阻止，2执行脚本
BLOCK_UDP="0"
BLOCK_TCP="0"
#路由数据包
KILL_ROUTE="/sbin/route add -host $TARGET$ gw 333.444.555.666"
#Iptables阻止
KILL_ROUTE="/usr/local/bin/iptables -I INPUT -s $TARGET$ -j DROP"
#TCP wrappers阻止
KILL_HOSTS_DENY="ALL: $TARGET$"
#执行脚本
KILL_RUN_CMD="/some/path/here/script $TARGET$ $PORT$"
portsentry启动模式：
/usr/local/psionic/portsentry/portsentry -tcp
#TCP基本端口绑定，以配置文件端口为准
/usr/local/psionic/portsentry/portsentry -udp
#UDP基本端口绑定，以配置文件端口为准
/usr/local/psionic/portsentry/portsentry -stcp
#TCP私密检测，只记录不回应端口开放
/usr/local/psionic/portsentry/portsentry -sudp
#UDP私密检测，只记录不回应端口开放
/usr/local/psionic/portsentry/portsentry -atcp
#UDP高级秘密检测，自动选择监听端口
/usr/local/psionic/portsentry/portsentry -audp
#UDP高级秘密检测，自动选择监听端口
以基本TCP检测模式启动，用nmap扫描测试：
[root@xenserver5 ~]# nmap -sS www.myhack58.com
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2012-06-11 22:35 CST
Interesting ports on typecho.domain.com (192.168.1.2):
Not shown: 1654 closed ports
PORT STATE SERVICE
1/tcp open tcpmux
11/tcp open systat
15/tcp open netstat
22/tcp open ssh
79/tcp open finger
80/tcp open http
111/tcp open rpcbind
119/tcp open nntp
143/tcp open imap
443/tcp open https
540/tcp open uucp
635/tcp open unknown
1080/tcp open socks
1524/tcp open ingreslock
2000/tcp open callbook
3306/tcp open mysql
6667/tcp open irc
12345/tcp open NetBus
12346/tcp open NetBus
27665/tcp open Trinoo_Master
31337/tcp open Elite
32771/tcp open sometimes-rpc5
32772/tcp open sometimes-rpc7
32773/tcp open sometimes-rpc9
32774/tcp open sometimes-rpc11
54320/tcp open bo2k
查看防火墙阻止记录：
cat /etc/hosts.deny
ALL: 192.168.1.6
(责任编辑：IT) |