For network administrators, one of the most difficult jobs is that of monitoring incoming packets and IP addresses.

In an ideal world, we would hire someone to sit in front of a screen 24/7 and watch as the log churns through the incoming (and often outgoing) hits. This, of course, isn't an ideal world, and very few organisations have the resources for such a menial task.

You can find tools out there, though, that can aid you in reaching that utopian networked world. One is PortSentry, developed for Linux by Psionic. This handy utility can certainly ease the burden of logging incoming traffic and blocking offending traffic for any network administrator with a Linux box available.

What PortSentry does

PortSentry actually can pull off a number of tricks. When PortSentry detects a port scan, it can react by:

• Creating a log of the scan.
• Adding an entry in /etc/hosts for the offending scan.
• Reconfiguring the host to redirect traffic of the scan target to a dead host.
• Dropping all packets from the offending scan.

PortSentry can also do stealth scan detection in two ways. The first method relies on a list of ports to watch that is predefined by the administrator. From this list, PortSentry knows to watch for scans to those ports. If an offending scan to one of the predefined ports is detected, PortSentry activates. Another method of stealth scan detection is inverse port binding, in which a larger range of ports is watched, excluding those ports the system has bound for network daemons (daemons started either by PortSentry or manually).

Getting and installing

The PortSentry tool is available only in source form, so you'll have to untar and compile it yourself. Download the PortSentry application from the Psionic download site. Then, su to root and run the following commands (in this example, we're working with portsentry-1.1.tar.gz):

tar xvzf portsentry-1.1.tar.gz

Once the file is unpacked, you'll need to type cd in the newly created directory (in this example, it's portsentry-1.1), open the file portsentry_config.h, and make sure the following entries are correct:

• CONFIG_FILEâ€"The path to the PortSentry configuration file
• WRAPPER_HOSTS_DENYâ€"The path to the hosts.deny file
• SYSLOG_FACILITYâ€"The logging facility PortSentry is to use
• SYSLOG_LEVELâ€"At which level syslog is to send messages (Seven is the default for syslog, which will output all but debugging information.)

More than likely, the above entries will be correct. I advise you not to change any of these values unless you know what you're doing. If you do edit this file, make sure you don't delete the # symbols. In the case of the portsentry_config.h file, they're not comments.

The next step is to edit the portsentry.conf file. Within this file, you'll want to look at the following entries:

• TCP_PORTSâ€"This is a listing of TCP ports you want PortSentry to watch. Notice that there are no spaces in this list. Do not add any!
• UDP_PORTSâ€"This is the same as above, only in UDP fashion.
• ADVANCED_PORTS_TCPâ€"This number indicates to PortSentry the highest number it is to check. From that number, PortSentry will then scan all the addresses below it. For instance, if you configure the ADVANCED_PORTS_TCP entry with 1024, PortSentry will start scanning at port 1024 and scan all ports below that number. 1024 is the default entry.
• ADVANCED_PORTS_UDPâ€"This is the same as above, only in UDP fashion.
• ADVANCED_EXCLUDE_TCPâ€"This is a listing of ports to be excluded from PortSentry's advanced mode.
• ADVANCED_EXCLUDE_UDPâ€"This is the same as above, only in UDP fashion.
• IGNORE_FILEâ€"This is the path to the file that contains a listing of addresses for PortSentry to ignore.
• BLOCKED_FILEâ€"This is the path to the file that contains a listing of blocked hosts.
• RESOLVE_HOSTâ€"This turns off DNS resolution. BLOCK_TCPâ€"This disables automatic responses to TCP probes. A setting of 0 blocks all TCP probes.
• BLOCK_UDPâ€"This is the same as above, only in UDP fashion.
• PORT_BANNERâ€"This is the path to the text banner you'd like to display to the offending scanner if PortSentry is activated.

The third step in the installation process involves yet another file, portsentry.ignore. Open this file and add any host addresses you want PortSentry to ignore. If you don't add any addresses, the file should at least contain the localhost (127.0.0.1) entry. The format of these entries is:

IP Address/Netmask

or something like this, for example:

192.168.1.100/16

Use the above with much caution because it can add some particularly nasty loopholes to your system.

Now you're ready to compile the application. As root (you should already be su'd to root), run the following, where is the type of system you will be installing onto: make

For example, if I were installing PortSentry onto a Linux machine, I would type:

make linux
make install

The installer will create a new directory, psionic, within /usr/local. Within the newly created psionic directory will be yet another directory, portsentry, which will contain the portsentry executable binary, the portsentry.conf file, and the portsentry.ignore file. With these files in place, you're now ready to set PortSentry up to run.

Running PortSentry

You can run PortSentry in one of six modes:

• portsentry -tcp (the basic TCP mode)
• portsentry -upd (the basic UDP mode)
• portsentry -stcp (TCP stealth mode)
• portsentry -atcp (advanced TCP stealth mode)
• portsentry -sudp (UDP stealth mode)
• portsentry -audp (advanced UDP stealth mode)

Let's say you want to run PortSentry in basic TCP mode. From the command line, enter (as root, of course):

/usr/local/psionic/portsentry/portsentry -tcp

and PortSentry will begin watching incoming connections.

You'll notice that when you run the command above, a new file called portsentry.blocked.tcp will be created in the /usr/local/psionic/portsentry directory. This file will show you the addresses PortSentry has captured and configured to block from sending TCP traffic.

More than likely, you'll want PortSentry to begin running at startup. The simplest way to accomplish this is to add the following lines in your /etc/rc.d/rc.local file, which will cause PortSentry to start at boot:

//usr/local/psionic/portsentry/portsentry -atcp
/usr/local/psionic/portsentry/portsentry -audp

Once PortSentry is up and running, it will begin logging in the /usr/local/psionic/portsentry/portsentry.blocked files as well as adding entries to the host's /etc/hosts.deny file.

Conclusion

With malicious-minded traffic booming on the Internet, it's critical that you have as much security as possible. Linux offers a vast array of security options, and it's best not to leave any stone unturned. By using PortSentry, you're ensuring that your host will log any incoming traffic and automatically place one more barrier up to block offending traffic. I put PortSentry on all my Linux boxes.

Editorial disclaimer: The authors and editors have taken care in preparation of the content contained herein but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for any damages. Always have a verified backup before making any changes.

TechRepublic is the online community and information resource for all IT professionals, from support staff to executives. We offer in-depth technical articles written for IT professionals by IT professionals. In addition to articles on everything from Windows to e-mail to fire walls, we offer IT industry analysis, downloads, management tips, discussion forums, and e-newsletters.

©2001 TechRepublic, Inc.

Copyright © 2009 CBS Interactive, a CBS Company. All Rights Reserved.
ZDNET is a registered service mark of CBS Interactive. ZDNET Logo is a service mark of CBS Interactive.