Bonjour,
J’aimerai une aide pour vérifier ce que j’ai fais et répondre à quatre questions.
1 : Ce que j’ai fais vous parait-il bon ?
2 : mon port SSH que j’ai personnalisé je le met où ?
3 : Dois je personnaliser mes autres ports ( FTP,POP3, IMAP, SMTP, web, named) ?
4 : Dois-je conserver TCP_PORTS et UDP_PORT dans portsentry.conf ?
Merci et passez une bonne journée
Voici ce que j’ai :
nano /etc/default/portsentry
TCP_MODE="atcp"
UDP_MODE="audp"
nano /etc/logrotate.d/portsentry
/var/lib/portsentry/portsentry.* {
weekly
rotate 4
compress
missingok
notifempty
create 0640 root root
sharedscripts
postrotate
/etc/init.d/portsentry restart > /dev/null 2>&1
endscript
}
nano /etc/portsentry/portsentry.conf
TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,27665,31337,32771,32772,32773,32774,40421,49724,54320"
UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,37444,34555,31335,32770,32771,32772,32773,32774,31337,54321"
ADVANCED_PORTS_TCP="1024"
ADVANCED_PORTS_UDP="1024"
ADVANCED_EXCLUDE_TCP="113,139"
ADVANCED_EXCLUDE_UDP="520,138,137,67"
IGNORE_FILE="/etc/portsentry/portsentry.ignore"
HISTORY_FILE="/var/lib/portsentry/portsentry.history"
BLOCKED_FILE="/var/lib/portsentry/portsentry.blocked"
RESOLVE_HOST = "0"
BLOCK_UDP="1"
BLOCK_TCP="1"
KILL_ROUTE="/sbin/iptables -I INPUT -s $TARGET$ -j DROP && /sbin/iptables -I INPUT -s $TARGET$ -m limit --limit 3/minute --limit-burst 5 -j LOG --log-level DEBUG --log-prefix 'Portsentry: dropping: '"
KILL_HOSTS_DENY="ALL: $TARGET$ : DENY"
SCAN_TRIGGER="0"
PORT_BANNER="** UNAUTHORIZED ACCESS PROHIBITED *** YOUR CONNECTION ATTEMPT HAS BEEN LOGGED. GO AWAY."
