Hi all, I think of installing a tool, which automatically blocks port scanners at the gateway for a specific time (perhaps one day). Does such a beast exist (at best as SuSE-rpm) ? And would it be really wise to do that? Any pitfalls? TIA, Thomas
On Sun, Feb 18, 2001 at 03:02:02PM +0100, Thomas Lamy wrote:
Hi all,
I think of installing a tool, which automatically blocks port scanners at the gateway for a specific time (perhaps one day).
Does such a beast exist (at best as SuSE-rpm) ? And would it be really wise to do that? Any pitfalls?
TIA, Thomas
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com Portsentry from www.psionic.com. Works great, been using it for years now. -- _ _ __ _____ _____ ___| |_ | '__| / __\ \ /\ / / _ \/ _ \ __| | | _ \__ \\ V V / __/ __/ |_ |_|(_) |___/ \_/\_/ \___|\___|\__| rsweet@socal.rr.com "unix soit qui mal y pense."
On Son, 18 Feb 2001, Thomas Lamy wrote:
I think of installing a tool, which automatically blocks port scanners at the gateway for a specific time (perhaps one day).
Does such a beast exist (at best as SuSE-rpm) ? And would it be really wise to do that? Any pitfalls?
Good configured firewalls should be enough for that: Kernel 2.2: ipchains/sinus-firewall 2.4: iptables Greetings, Joerg Henner. -- LinuxHaus Stuttgart | Tel.: +49 (7 11) 2 85 19 05 J. Henner & A. Reyer, Datentechnik GbR | D2: +49 (1 72) 7 35 31 09 | Fax: +49 (7 11) 5 78 06 92 Linux, Netzwerke, Consulting & Support | http://lihas.de
i use psionic portsentry, highly configurable, will alert and log as well as block. Site is at www.psionic.com. They also have lots of other neat sec. tools like log analysers and the like. Regards, Iain
-----Original Message----- From: Joerg Henner [mailto:jhe@lihas.de] Sent: 18 February 2001 14:12 To: 'suse-security@suse.com' Subject: Re: [suse-security] Anti-Portscan tool
On Son, 18 Feb 2001, Thomas Lamy wrote:
I think of installing a tool, which automatically blocks port scanners at the gateway for a specific time (perhaps one day).
Does such a beast exist (at best as SuSE-rpm) ? And would it be really wise to do that? Any pitfalls?
Good configured firewalls should be enough for that:
Kernel 2.2: ipchains/sinus-firewall 2.4: iptables
Greetings,
Joerg Henner.
-- LinuxHaus Stuttgart | Tel.: +49 (7 11) 2 85 19 05 J. Henner & A. Reyer, Datentechnik GbR | D2: +49 (1 72) 7 35 31 09 | Fax: +49 (7 11) 5 78 06 92 Linux, Netzwerke, Consulting & Support | http://lihas.de
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
i use psionic portsentry, highly configurable, will alert and log as well as block. Site is at www.psionic.com. They also have lots of other neat sec. tools like log analysers and the like.
Portsentry, although a good product, is a subject of constant debate on most of the ISP lists for the simple reason that it can be used as a tool against you (DoS) if not properly configured. Because of this fact the question of whether it is viable at all constantly comes up. M
On 18-Feb-01 Thomas Lamy wrote:
Hi all,
I think of installing a tool, which automatically blocks port scanners at the gateway for a specific time (perhaps one day).
There are numerous tools out to achieve that. Portsentry (www.psionic.com/abacus/portsentry) is just one of them. Basically it's a rather esoteric discussion wether to actively block incoming portscans, say via route-dropping, or to properly configure your firewall and some intrusion detection tools in order to let the admin know what's going on, without active blocking. For a more complete approach you may visit www.snort.org. Snort is an intrusion detection/monitoring software, which, together with tools like Guardian (also on www.snort.org), can be used to monitor, log and drop. Another good place to look for tools of that kind would be the linux tools section of www.securityfocus.com, or start research about intrusion detection on www.securityportal.com.
Does such a beast exist (at best as SuSE-rpm) ? And would it be really wise to do that? Any pitfalls?
Snort is part of the SuSE distro (series "sec"). The problem with such configurations is that you may have some non-hostile routes get dropped because of an anal portsentry-/snort-setup. On the other hand, dropping routes from most script kiddies or win-trojan-scanners may have some "psychological effects", but after dropping the (dynamically assigned) IP address of such a kiddie he or she may hang up and dialin again, thus getting an other IP address from his/her peer, and the scanning begins anew. This fills up your logfiles and may indeed lead to a denial-of-service in the worst case, but doesn't do any good. Finally, if you drop routes from experienced black hats he or she may feel invited to have a second look into your network and to dig deeper into the bag of tricks, especially if you use portsentry's doubtful "feature" where a (probably offending) banner can be spit out after a denied connection attempt. If you plan to set up intrusion/portscan detection systems you should not use any pro-active retaliation (route droppings, etc.) for a while, say a couple of months or so. During this period, carefully watch the output of these tools and finally make a decision wether to switch to active dropping based on these data.
TIA, Thomas
---
Boris Lorenz
participants (6)
-
Boris Lorenz -
Iain Gray -
Joerg Henner -
Mr. M -
Robert Sweet -
Thomas Lamy