---

---

Comments and suggestions concerning this book should be mailed to gmourani@videotron.ca © Copyright 1999-2000 Gerhard Mourani and Open Network Architecture ® 165 ########################################### # Advanced Stealth Scan Detection Options # ########################################### # # This is the number of ports you want PortSentry to monitor in Advanced mode. # Any port *below* this number will be monitored. Right now it watches   # everything below 1023.   #   # On many Linux systems you cannot bind above port 61000. This is because # these ports are used as part of IP masquerading. I don't recommend you # bind over this number of ports. Realistically: I DON'T RECOMMEND YOU MONITOR   # OVER 1023 PORTS AS YOUR FALSE ALARM RATE WILL ALMOST CERTAINLY RISE. You've been # warned! Don't write me if you have have a problem because I'll only tell # you to RTFM and don't run above the first 1023 ports. # # ADVANCED_PORTS_TCP="1023" ADVANCED_PORTS_UDP="1023" # # This field tells PortSentry what ports (besides listening daemons) to # ignore. This is helpful for services like ident that services such   # as FTP, SMTP, and wrappers look for but you may not run (and probably   # *shouldn't* IMHO).   # # By specifying ports here PortSentry will simply not respond to # incoming requests, in effect PortSentry treats them as if they are # actual bound daemons. The default ports are ones reported as   # problematic false alarms and should probably be left alone for # all but the most isolated systems/networks. # # Default TCP ident and NetBIOS service ADVANCED_EXCLUDE_TCP="113,139" # Default UDP route (RIP), NetBIOS, bootp broadcasts. ADVANCED_EXCLUDE_UDP="520,138,137,67" ###################### # Configuration Files# ###################### # # Hosts to ignore IGNORE_FILE="/usr/psionic/portsentry/portsentry.ignore" # Hosts that have been denied (running history) HISTORY_FILE="/usr/psionic/portsentry/portsentry.history" # Hosts that have been denied this session only (temporary until next restart) BLOCKED_FILE="/usr/psionic/portsentry/portsentry.blocked" ################### # Response Options# ################### # Options to dispose of attacker. Each is an action that will   # be run if an attack is detected. If you don't want a particular # option then comment it out and it will be skipped. # # The variable $TARGET$ will be substituted with the target attacking # host when an attack is detected. The variable $PORT$ will be substituted # with the port that was scanned.   # ################## # Ignore Options # ##################