I just installed PortSentry on a test server and then tried to attack it from another workstation. PortSentry performed well and blocked all the scans there-after by adding a line the portsentry.blocked file and adding an iptables rule. (I'm using the standard PortSentry conf file.)

I'm not running iptables on this server so I know that had no effect, but I've tried to remove the entry in the portsentry.blocked file and it still won't allow me access to the server again from my workstation. I restarted portsentry afterwards and it still didn't reallow access. Only restarting the entire server would allow me to work from the attacking workstation again. What do I need to do to reallow access in the future without restarting the entire server?

I've read plenty about PortSentry, but nothing on how to remove accidental IP blocks .

Thanks in advance,

I hope you won't bite me for this, but...

did you restart iptables after removing the rule? This will make it flush the rules and reread them

service iptables restart

You can always do
iptables -nL --line-numbers
to get a list of current rules to make sure they are no longer being used.
If they are, you can delete the respective line with
iptables -D INPUT 3
for example

I'm pretty sure I have a good grip on that biting thing.

I didn't think to restart because I knew I didn't have iptables running. As a check I did try to flush the new rule, but as expected, it just threw an errer about iptables not running.

The iptables rule is just part of the sample portsentry.conf file that I just didn't remove.

Do you have portsentry experience?

If it isnt iptables its either hosts.deny or the port sentry blocked file thats the problem.

Check hosts.deny for the address and then restart portsentry after adding the address ranges you want to allow to your portsentry.ignore file.

I went through hosts.deny, the portsentry blocking file, and tried to flush the iptables rules and the portsentry file was the only one that had been changed so I know the only thing that was blocking the address was portsentry. I did delete the entry and tried to restart but no luck. Still blocked.

Take a look at your routing table. PortSentry can also add a bogus route to misdirect the offending address.

You can also look in (at least on RedHat) in /usr/local/psionic/portsentry at your blocked files, ignore files and history file.