|[Home] [Credit Search] [Category Browser] [Staff Roll Call]||The LINUX.COM Article Archive|
|Originally Published: Thursday, 4 October 2001||Author: Shashank Pandey|
|Published to: enchance_articles_security/Advanced Security Articles||Page: 2/5 - [Printable]|
Installing and Configuring Portsentry: Intrusion Detection Systems for the Uninitiated.
Linux.com enjoys providing information we suspect you, dear reader, will particulary value. In this Linux.com security article correspondent Shashank Pandey shows us how to set up and configure the Intrusion Detection Software (IDS) PortSentry. We hope you find this useful.
|<< Page 2 of 5 >>|
PART 1 Installing and Configuring PortsentryPlatform : Linux (configuration is similar on other OSs like BSD /sun/*nix )
InstallationThere are two ways in which you can install Portsentry :
a)get an rpm from rpmfind.net.
b)get a tar ball :
copy it and unpack it in any directory, say /tmp:
That will unpack portsentry to a directory "portsentry-1.0" in /tmp or whatever directory you were in when you did the unpacking. Now,
If you do an ls you will see several files. Now we get to the fun part, the actual editing of the files. First, open up portsentry_config.h in a text-editor (vi/pico/emacs etc). See if you can make out anything from all those lines and make any changes (provided you know what you are doing). Normally, you can skip this altogether.
The main configuration file for portsentry is portsentry.conf. It's very customizable and you can edit it before or after installation, as you may like. Here, we will go my way and install it before editing portsentry.conf .
Goto the folder where you have extracted portsentry and do (as root) :
Generally, you shouldn't get any errors.
To check whether Portsentry has been installed properly do:
in my case, I got this:
Dont fret if the path is different in your case.
Ok. Cute. Great going. Now that we have installed portsentry, we can happily configure it:
ConfigurationLike I said earlier, the main configuration file for Portsentry is portsentry.conf.
In my case it was :
Now before we start configuring Portsentry, lets take a few moments to clear up a few fundamentals about Portsentry :
Portsentry can work in three modes:
So, now we move onwards to editing the portsentry.conf file which looks something like this:
|<< Page 2 of 5 >>|