注：本文采用的操作系統(tǒng)為 ubuntu14.04
簡介PortSentry is part of SentryTools. This daemon will watch unused ports for activity and depending on how it is configured take action upon excessive access to watched ports.wiki
portsentry 采取的措施：
將流量引到一個(gè)虛假的路由疼进，一個(gè)不存在的主機(jī)
自動對服務(wù)器端口掃描的主機(jī)加到 /etc/hosts.deny 文件中去
利用 Netfiliter 機(jī)制，用包過濾的機(jī)制，例如 iptables 和 ipchain 等，把非法的數(shù)據(jù)包（來自對主機(jī)進(jìn)行端口掃描的主機(jī)）都過濾掉狗唉；
通過 syslog() 函數(shù)給出一個(gè)日志消息荒吏，或者一段警告信息
portsentry 安裝下載地址
http://sourceforge.net/projects/sentrytools/
解壓
tar zxvf portsentry-1.2.tar.gz```不能直接編譯，這里有點(diǎn)特殊蚪腋，解壓完的包中耸棒，`portsentry.c`這個(gè)文件中在`1584`行有一處錯誤朵夏，將其改成一行```printf ("Copyright 1997-2003 Craig H. Rowland\n");
然后進(jìn)行編譯
make linux& make install
成功安裝，安裝的路勁為/usr/local/psionic/portsentry
portsentry 配置
修改配置文件 portsentry.conf
通過 portsentry 進(jìn)行入侵檢測榆纽，如下段落為需要監(jiān)視的端口清單，和相應(yīng)的阻止措施捏肢。啟動之后奈籽，后開進(jìn)程開啟監(jiān)控這些端口，發(fā)現(xiàn)有人掃描鸵赫，就啟動相應(yīng)的對策進(jìn)行阻攔衣屏。
NO.1 Port Configurations
這一端列出了默認(rèn)的監(jiān)視的端口，可以通過去掉#號來執(zhí)行默認(rèn)的配置辩棒，可以自行修改
# Port Configurations
# Un-comment these if you are really anal:
#TCP_PORTS="1,7,9,11,15,70,79,80,109,110,111,119,138,139,143,512,513,514,515,540,635,1080,1524,2000,2001,4000,4001,5742,6000,6001,6667,12345,12346,20034,27665,30303,32771,32772,32773,32774,31337,40421,40425,49724,54320"
#UDP_PORTS="1,7,9,66,67,68,69,111,137,138,161,162,474,513,517,518,635,640,641,666,700,2049,31335,27444,34555,32770,32771,32772,32773,32774,31337,54321"
#
# Use these if you just want to be aware:
TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,27665,31337,32771,32772,32773,32774,40421,49724,54320,51010"
UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,37444,34555,31335,32770,32771,32772,32773,32774,31337,54321"
#
# Use these for just bare-bones
#TCP_PORTS="1,11,15,110,111,143,540,635,1080,1524,2000,12345,12346,20034,32771,32772,32773,32774,49724,54320"
#UDP_PORTS="1,7,9,69,161,162,513,640,700,32770,32771,32772,32773,32774,31337,54321"
NO.2 Advanced Stealth Scan Detection Options
# Advanced Stealth Scan Detection Options
ADVANCED_PORTS_TCP="1024"
ADVANCED_PORTS_UDP="1024"
# Default TCP ident and NetBIOS service
ADVANCED_EXCLUDE_TCP="113,139"
# Default UDP route (RIP), NetBIOS, bootp broadcasts.
ADVANCED_EXCLUDE_UDP="520,138,137,67"
NO.3 Configuration Files狼忱；portsentry.conf 相關(guān)的配置文件
# Configuration Files
# Hosts to ignore
#（ 此文件記錄允許合法掃描服務(wù)的主機(jī)地址 ）
IGNORE_FILE="/usr/local/psionic/portsentry/portsentry.ignore"
# Hosts that have been denied (running history)
#（ 此文件中保留入侵主機(jī)的 IP 地址 ）
HISTORY_FILE="/usr/local/psionic/portsentry/portsentry.history"
# Hosts that have been denied this session only (temporary until next restart)
# （ 此文件中是已經(jīng)被阻止連接的主機(jī) IP 記錄 ）
BLOCKED_FILE="/usr/local/psionic/portsentry/portsentry.blocked"
NO.4 Dropping Routes
丟棄規(guī)則，也就是路由重定向一睁，設(shè)置一條虛擬的路由記錄钻弄，把數(shù)據(jù)包重定向到一個(gè)不存在的主機(jī)
根據(jù)不同的操作系統(tǒng)，選擇不同的命令
# Dropping Routes
# Generic
#KILL_ROUTE="/sbin/route add $TARGET$ 333.444.555.666"
# Generic Linux
KILL_ROUTE="/sbin/route add -host $TARGET$ gw 333.444.555.666"
# Newer versions of Linux support the reject flag now. This
# is cleaner than the above option.
#KILL_ROUTE="/sbin/route add -host $TARGET$ reject"
# Generic BSD (BSDI, OpenBSD, NetBSD, FreeBSD)
#KILL_ROUTE="/sbin/route add $TARGET$ 333.444.555.666"
# Generic Sun
#KILL_ROUTE="/usr/sbin/route add $TARGET$ 333.444.555.666 1"
# NEXTSTEP
#KILL_ROUTE="/usr/etc/route add $TARGET$ 127.0.0.1 1"
# FreeBSD
#KILL_ROUTE="route add -net $TARGET$ -netmask 255.255.255.255 127.0.0.1 -blackhole"
# Digital UNIX 4.0D (OSF/1 / Compaq Tru64 UNIX)
#KILL_ROUTE="/sbin/route add -host -blackhole $TARGET$ 127.0.0.1"
# Generic HP-UX
#KILL_ROUTE="/usr/sbin/route add net $TARGET$ netmask 255.255.255.0 127.0.0.1"
NO.5 根據(jù)配置文件記錄下的 IP者吁，使用 iptables 阻塞掉窘俺，切斷與其連接
##
# Using a packet filter is the PREFERRED. The below lines
# work well on many OS's. Remember, you can only uncomment *one*
# KILL_ROUTE option.
# ipfwadm support for Linux
#KILL_ROUTE="/sbin/ipfwadm -I -i deny -S $TARGET$ -o"
#
# ipfwadm support for Linux (no logging of denied packets)
#KILL_ROUTE="/sbin/ipfwadm -I -i deny -S $TARGET$"
#
# ipchain support for Linux
#KILL_ROUTE="/sbin/ipchains -I input -s $TARGET$ -j DENY -l"
#
# ipchain support for Linux (no logging of denied packets)
#KILL_ROUTE="/sbin/ipchains -I input -s $TARGET$ -j DENY"
#
# iptables support for Linux
#KILL_ROUTE="/usr/local/bin/iptables -I INPUT -s $TARGET$ -j DROP"
#
# For those of you running FreeBSD (and compatible) you can
# use their built in firewalling as well.
#
#KILL_ROUTE="/sbin/ipfw add 1 deny all from $TARGET$:255.255.255.255 to any"
#
# For those running ipfilt (OpenBSD, etc.)
# NOTE THAT YOU NEED TO CHANGE external_interface TO A VALID INTERFACE!!
#
#KILL_ROUTE="/bin/echo 'block in log on external_interface from $TARGET$/32 to any' | /sbin/ipf -f -"
NO.6 也可以把攻擊者的 IP 記錄到 /etc/hosts.deny 中，利用 TCP_Wrappers 機(jī)制防止被攻擊
TCP_Wrappers ：Transmission Control Protocol (TCP) Wrappers 為由 inetd 生成的服務(wù)提供了增強(qiáng)的安全性复凳。TCP Wrappers 是一種對使用 /etc/inetd.sec 的替換方法瘤泪。TCP Wrappers 提供防止主機(jī)名和主機(jī)地址欺騙的保護(hù)。欺騙是一種偽裝成有效用戶或主機(jī)以獲得對系統(tǒng)進(jìn)行未經(jīng)授權(quán)的訪問的方法育八。
# TCP Wrappers
#
KILL_HOSTS_DENY="ALL: $TARGET$"
NO.7 定制警告信息对途，警告攻擊者
# Port Banner Section
#
#
# Enter text in here you want displayed to a person tripping the PortSentry.
# I *don't* recommend taunting the person as this will aggravate them.
# Leave this commented out to disable the feature
#
# Stealth scan detection modes don't use this feature
#
PORT_BANNER="** UNAUTHORIZED ACCESS PROHIBITED *** YOUR CONNECTION ATTEMPT HAS BEEN LOGGED. GO AWAY."
修改 portsentry.ignore 的配置文件
文件 /usr/local/psionic/portsentry/portsentry.ignore 配置上本地的 IP 和 常建立連接的主機(jī)，允許合法掃描
配置好之后最好修改一下 /usr/local/psionic/portsentry/portsentry.conf 和 /usr/local/psionic/portsentry/portsentry.ignore 的權(quán)限
chmod 600 /usr/local/psionic/portsentry/portsentry.conf
chmod 600 /usr/local/psionic/portsentry/portsentry.ignore
開啟監(jiān)測模式
PortSentry的啟動檢測模式髓棋。對應(yīng)TCP和UDF兩種協(xié)議方式实檀，PortSentry分別有三種啟動模式惶洲，即基本、秘密和高級秘密掃描檢測模式劲妙，合計(jì)6個(gè)模式湃鹊。
portsentry-tcp，TCP的基本端口綁定模式镣奋；
portsentry-udp币呵，UDP的基本端口綁定模式；
portsentry-stcp侨颈，TCP的秘密掃描檢測模式余赢；
portsentry-sudp，UDP的秘密掃描檢測模式哈垢；
portsentry-atcp妻柒，TCP的高級秘密掃描檢測模式；
portsentry-audp耘分，UDP的高級秘密掃描檢測模式举塔。
一般情況下，建議使用秘密掃描檢測模式或高級秘密掃描檢測模式求泰。
使用高級秘密掃描檢測模式（Advanced Stealth Scan Detection Mode）央渣，PortSentry會自動檢查服務(wù)器上正在運(yùn)行的端口， 然后把這些端口從配置文件中移去渴频， 只監(jiān)控其它的端口芽丹。這樣會加快對端口掃描的反應(yīng)速度，并且只占用很少的CPU時(shí)間卜朗，這種模式非常智能
啟動命令：
/usr/local/psionic/portsentry/portsentry -atcp
建議將這條命令寫入 /etc/rc.local 中拔第，這樣開機(jī)就自啟動了
測試
我的云主機(jī) A IP 假設(shè)為 XXX.XXX.XXX.XXX，云主機(jī) A 上配置并開啟了 portsentry
開啟一臺云主機(jī) B场钉，IP 地址為 115.231.183.78
使用 云主機(jī) B 掃描 云主機(jī) A 的端口
云主機(jī) A 監(jiān)測到了惡意掃描蚊俺，會將其加入 /etc/hosts.deny,并且在 /usr/local/psionic/portsentry/portsentry.blocked.atcp 會記錄 block 掉了
簡單處理一下，發(fā)現(xiàn)還有不是自己掃的逛万，無聊的人也是多- -春叫！
