最近我们公司总是被恶意攻击。后面查看了LINUX下有免费的防恶意扫描软件PortSentry去解决了
1.安装portSentry
下裁portsentry-1.2.tar.gz
[root@tomcat135 ~]# tar zxvf portsentry-1.2.tar.gz
[root@tomcat135 ~]# cd portsentry_beta/
打开portsentry.c在1590行左右Copyright 1997-2003那行内容调整为一行，不然安装报警
1584 printf ("Copyright 1997-2003 Craig H. Rowland <craigrowland at users dot
1585 sourceforget dot net>\n");
修改成
1584 printf ("Copyright 1997-2003 Craig H. Rowland <craigrowland at users dot sourceforget dot net>\n");
[root@tomcat135 portsentry_beta]# make && make install
发现cp: 无法 stat “./portsentry”: 没有那个文件或目录
make: *** [install] 错误 1这问题，我们在一次make&& make install&& make linux
[root@tomcat135 portsentry_beta]# make linux
port Sentry的配置
[root@tomcat135 portsentry_beta]# vi /usr/local/psionic/portsentry/portsentry.conf
找到
# Use these if you just want to be aware:
TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,27665,31337,32771,32772,32773,32774,40421,49724,54320"
UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,37444,34555,31335,32770,32771,32772,32773,32774,31337,54321"
可以把你所要监视的端口增加进去
启动portsentry的命令如下
[root@tomcat135 portsentry_beta]# /usr/local/psionic/portsentry/portsentry -atcp
查看日志
[root@tomcat135 portsentry_beta]# tail /var/log/messages
Jul 23 19:58:59 tomcat135 portsentry[11037]: adminalert: Advanced mode will manually exclude port: 139
Jul 23 19:58:59 tomcat135 portsentry[11037]: adminalert: Advanced Stealth scan detection mode activated. Ignored TCP port: 22
Jul 23 19:58:59 tomcat135 portsentry[11037]: adminalert: Advanced Stealth scan detection mode activated. Ignored TCP port: 25
Jul 23 19:58:59 tomcat135 portsentry[11037]: adminalert: Advanced Stealth scan detection mode activated. Ignored TCP port: 80
Jul 23 19:58:59 tomcat135 portsentry[11037]: adminalert: Advanced Stealth scan detection mode activated. Ignored TCP port: 111
Jul 23 19:58:59 tomcat135 portsentry[11037]: adminalert: Advanced Stealth scan detection mode activated. Ignored TCP port: 631
Jul 23 19:58:59 tomcat135 portsentry[11037]: adminalert: Advanced Stealth scan detection mode activated. Ignored TCP port: 637
Jul 23 19:58:59 tomcat135 portsentry[11037]: adminalert: Advanced Stealth scan detection mode activated. Ignored TCP port: 113
Jul 23 19:58:59 tomcat135 portsentry[11037]: adminalert: Advanced Stealth scan detection mode activated. Ignored TCP port: 139
Jul 23 19:58:59 tomcat135 portsentry[11037]: adminalert: PortSentry is now active and listening.
如果被攻击的我们可以查看
[root@tomcat135 portsentry_beta]# cat /etc/hosts.deny
#
# hosts.deny This file contains access rules which are used to
# deny connections to network services that either use
# the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# The rules in this file can also be set up in
# /etc/hosts.allow with a 'deny' option instead.
#
# See 'man 5 hosts_options' and 'man 5 hosts_access'
# for information on rule syntax.
# See 'man tcpd' for information on tcp_wrappers
#
ALL: 216.99.158.196
ALL: 116.10.191.184
ALL: 65.111.161.35
ALL: 58.52.149.161
ALL: 137.175.69.43
ALL: 14.108.157.240
ALL: 198.13.104.182
ALL: 137.175.70.226
ALL: 119.36.79.10
ALL: 27.16.231.69
ALL: 137.175.9.239
ALL: 142.4.126.35
ALL: 112.125.18.175
ALL: 119.122.9.152
ALL: 218.77.79.43
ALL: 204.93.154.216
ALL: 42.120.145.6
ALL: 23.105.86.26
说明这些IP是恶意扫描的，被这软件自动增加到这里面去。
本文转自 jxzhfei 51CTO博客，原文链接:http://blog.51cto.com/jxzhfei/1444740
