海运的博客

端口做为服务器的大门安全很重要，当服务器运行很多服务时并向外提供服务，为防止有人恶意侦测服务器用途，可使用portsentry来迷惑对方。
portsentry可设定侦听指定的TCP/UDP端口，当遇到扫描时会回应端口开放，并记录扫描者信息可做相应处理：防火墙阻止、路由定向、执行自定义脚本。
portsentry安装之rpm：

rpm -ivh http://flexbox.sourceforge.net/centos/5/x86_64/portsentry-1.2-1.el5.x86_64.rpm

portsentry编译安装：

wget http://sourceforge.net/projects/sentrytools/files/portsentry%201.x/portsentry-1.2/portsentry-1.2.tar.gz
cd portsentry_beta/
#编辑portsentry.c修改以下为一行
#printf ("Copyright 1997-2003 Craig H. Rowland <craigrowland at users dot sourceforget dot net>\n"); 
make linux
make install

portsentry配置文件：

cat /usr/local/psionic/portsentry/portsentry.conf
#TCP和UDP模式监听的端口，可自定义
TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,27665,31337,32771,32772,32773,32774,40421,49724,54320"
UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,37444,34555,31335,32770,32771,32772,32773,32774,31337,54321"
#忽略IP
IGNORE_FILE="/usr/local/psionic/portsentry/portsentry.ignore"
#所有拒绝IP记录
HISTORY_FILE="/usr/local/psionic/portsentry/portsentry.history"
#启动后拒绝IP记录
BLOCKED_FILE="/usr/local/psionic/portsentry/portsentry.blocked"
#对扫描IP的操作，0为无动作，1防火墙阻止，2执行脚本
BLOCK_UDP="0"
BLOCK_TCP="0"
#路由数据包
KILL_ROUTE="/sbin/route add -host $TARGET$ gw 333.444.555.666"
#Iptables阻止
KILL_ROUTE="/usr/local/bin/iptables -I INPUT -s $TARGET$ -j DROP"
#TCP wrappers阻止
KILL_HOSTS_DENY="ALL: $TARGET$"
#执行脚本
KILL_RUN_CMD="/some/path/here/script $TARGET$ $PORT$"

portsentry启动模式：

/usr/local/psionic/portsentry/portsentry -tcp 
#TCP基本端口绑定，以配置文件端口为准
/usr/local/psionic/portsentry/portsentry -udp
#UDP基本端口绑定，以配置文件端口为准
/usr/local/psionic/portsentry/portsentry -stcp
#TCP私密检测，只记录不回应端口开放
/usr/local/psionic/portsentry/portsentry -sudp
#UDP私密检测，只记录不回应端口开放
/usr/local/psionic/portsentry/portsentry -atcp
#UDP高级秘密检测，自动选择监听端口
/usr/local/psionic/portsentry/portsentry -audp 
#UDP高级秘密检测，自动选择监听端口

以基本TCP检测模式启动，用nmap扫描测试：

[root@xenserver5 ~]# nmap -sS  www.haiyun.me
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2012-06-11 22:35 CST
Interesting ports on typecho.domain.com (192.168.1.2):
Not shown: 1654 closed ports
PORT      STATE SERVICE
1/tcp     open  tcpmux
11/tcp    open  systat
15/tcp    open  netstat
22/tcp    open  ssh
79/tcp    open  finger
80/tcp    open  http
111/tcp   open  rpcbind
119/tcp   open  nntp
143/tcp   open  imap
443/tcp   open  https
540/tcp   open  uucp
635/tcp   open  unknown
1080/tcp  open  socks
1524/tcp  open  ingreslock
2000/tcp  open  callbook
3306/tcp  open  mysql
6667/tcp  open  irc
12345/tcp open  NetBus
12346/tcp open  NetBus
27665/tcp open  Trinoo_Master
31337/tcp open  Elite
32771/tcp open  sometimes-rpc5
32772/tcp open  sometimes-rpc7
32773/tcp open  sometimes-rpc9
32774/tcp open  sometimes-rpc11
54320/tcp open  bo2k

查看防火墙阻止记录：

cat /etc/hosts.deny 
ALL: 192.168.1.6

标签：网络安全, postsentry, 服务器安全, 入侵检测测, 防止端口扫描