概述
防火牆可以保護我們的網絡免受攻擊。我們可以選擇打開哪些端口，關閉哪些端口。但是有些攻擊者可以用端口掃描程序掃描服務器的所有端口來收集有用的信息（哪些端口打開，哪些關閉）。
下面是對PortSentry的介紹：
l 服務器被端口掃描是入侵的前兆。PortSentry被設計成實時地發現端口掃描並對端口掃描作出反應。一旦發現端口掃描，PortSentry做出的反應有：
l 通過syslog()函數給出一個日志消息
l 自動地把對服務器進行端口掃描的主機加到TCP-Wrappers的“/etc/hosts.deny”文件中
l 本地主機會自動把所有的信息流都從定向到一個不存在的主機
l 本地主機用包過濾程序把所有的數據包（來自對其進行端口掃描的主機）都過濾掉。
注意事項
下面所有的命令都是Unix兼容的命令。
源路徑都為“/var/tmp”（當然在實際情況中也可以用其它路徑）。
安裝在RedHat Linux 6.1和6.2下測試通過。
要用“root”用戶進行安裝。
PortSentry的版本是1.0。
軟件包的來源
PortSentry的主頁：http://www.psionic.com/abacus/portsentry/。
下載：portsentry-1.0.tar.gz。
安裝軟件包需要注意的問題
最好在編譯前和編譯後都做一張系統中所有文件的列表，然後用“diff”命令去比較它們，找出其中的差別並知道到底把軟件安裝在哪裡。只要簡單地在編譯之前運行一下命令“find /* >PortSentry1”，在編譯和安裝完軟件之後運行命令“find /* > PortSentry2”，最後用命令“diff PortSentry1 PortSentry2 > PortSentry-Installed”找出變化。
解壓軟件包
把軟件包（tar.gz）解壓：
[root@deep /]# cp portsentry-version.tar.gz /var/tmp/
[root@deep /]# cd /var/tmp
[root@deep tmp]# tar xzpf portsentry-version.tar.gz
編譯和優化
必須修改“Makefile”文件，設置PortSentry的安裝路徑、編譯標記，還要根據你的系統進行優化。必須根據RedHat的文件系統結構來修改“Makefile”文件。
第一步
轉到新的PortSentry目錄。
編輯“Makefile”文件（vi Makefile）並改變下面這幾行：
CC = cc
改為：
CC = egcs
CFLAGS = -O -Wall
改為：
CFLAGS = -O9 -funroll-loops -ffast-math -malign-double -mcpu=pentiumpro -march=pentiumpro -fomit -frame-pointer -fno-exceptions –Wall
INSTALLDIR = /usr/local/psionic
改為：
INSTALLDIR = /usr/psionic
上面這些修改是為了把“Makefile”配置為使用“egcs”編譯器，使用適應於我們系統的編譯優化標記，並且把PortSentry安裝到我們選擇的目錄。
第二步
因為我們不用“/usr/local/psionic”目錄，我們必須“portsentry_config.h”頭文件中PortSentry的配置。
編輯“portsentry_config.h”文件（vi portsentry_config.h）並改變下面這一行：
#define CONFIG_FILE "/usr/local/psionic/portsentry/portsentry.conf"
改為：
#define CONFIG_FILE "/usr/psionic/portsentry/portsentry.conf"
第三步
在系統中安裝PortSentry。
[root@deep portsentry-1.0]# make linux
[root@deep portsentry-1.0]# make install
第三步
上面的命令配置軟件，編譯軟件，最後把它安裝到合適的目錄中。
清除不必要的文件
用下面的命令刪除不必要的文件：
[root@deep /]# cd /var/tmp
[root@deep tmp]# rm -rf portsentry-version/ portsentry-version_tar.gz
“rm”命令刪除所有編譯和安裝PortSentry所需要的源程序，並且把PortSentry軟件的壓縮包刪除掉。
配置“/usr/psionic/portsentry/portsentry.conf”文件
“/usr/psionic/portsentry/portsentry.conf”是PortSentry的主要配置文件。你可設置需要監聽的端口，需要禁止、監控的IP地址，等等。可以看PortSentry得“README.install”文件以獲取更多的信息。
編輯“portsentry.conf”文件（vi /usr/psionic/portsentry.conf）並且根據需要做出改變：
# PortSentry Configuration
#
# $Id: portsentry.conf,v 1.13 1999/11/09 02:45:42 crowland EXP crowland $
#
# IMPORTANT NOTE: You CAN NOT put spaces between your port arguments.
#
# The default ports will catch a large number of common probes
#
# All entries must be in quotes.
#######################
# Port Configurations #
#######################
#
#
# Some example port configs for classic and basic Stealth modes
#
# I like to always keep some ports at the "low" end of the spectrum.
# This will detect a sequential port sweep really quickly and usually
# these ports are not in use (i.e. tcpmux port 1)
#
# ** X-Windows Users **: If you are running X on your box, you need to be sure
# you are not binding PortSentry to port 6000 (or port 2000 for OpenWindows users).
# Doing so will prevent the X-client from starting properly.
#
# These port bindings are *ignored* for Advanced Stealth Scan Detection Mode.
#
# Un-comment these if you are really anal:
#TCP_PORTS="1,7,9,11,15,70,79,80,109,110,111,119,138,139,143,512,513,514,515,540,635,1080,1524,2
000,2001,4000,4001,5742,6000,6001,6667,12345,12346,20034,30303,32771,32772,32773,32774,31337,4
0421,40425,49724,54320"
#UDP_PORTS="1,7,9,66,67,68,69,111,137,138,161,162,474,513,517,518,635,640,641,666,700,2049,3277
0,32771,32772,32773,32774,31337,54321"
#
# Use these if you just want to be aware:
TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,31337,32
771,32772,32773,32774,40421,49724,54320"
UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,32770,32771,32772,32773,32774,31337,54321"
#
# Use these for just bare-bones
#TCP_PORTS="1,11,15,110,111,143,540,635,1080,524,2000,12345,12346,20034,32771,32772,32773,327
74,49724,54320"
#UDP_PORTS="1,7,9,69,161,162,513,640,700,32770,32771,32772,32773,32774,31337,54321"
###########################################
# Advanced Stealth Scan Detection Options #
###########################################
#
# This is the number of ports you want PortSentry to monitor in Advanced mode.
# Any port *below* this number will be monitored. Right now it watches
# everything below 1023.
#
# On many Linux systems you cannot bind above port 61000. This is because
# these ports are used as part of IP masquerading. I dont recommend you
# bind over this number of ports. Realistically: I DONT RECOMMEND YOU MON99vOR
# OVER 1023 PORTS AS YOUR FALSE ALARM RATE WILL ALMOST CERTAINLY RISE. Youve been
# warned! Dont write me if you have have a problem because Ill only tell
# you to RTFM and dont run above the first 1023 ports.
#
#
ADVANCED_PORTS_TCP="1023"
ADVANCED_PORTS_UDP="1023"
#
# This field tells PortSentry what ports (besides listening daemons) to
# ignore. This is helpful for services like ident that services sUCh
# as FTP, SMTP, and wrappers look for but you may not run (and probably
# *shouldnt* IMHO).
#
# By specifying ports here PortSentry will simply not respond to
# incoming requests, in effect PortSentry treats them as if they are
# actual bound daemons. The default ports are ones reported as
# problematic false alarms and should pro
# incoming requests, in effect PortSentry treats them as if they are
# actual bound daemons. The default ports are ones reported as
# problematic false alarms and should pro
