how to change notification email for portsentry and how to test portsentry

roorings · 11-02-2003, 02:15 PM

sorry, i know this is software. But i figured the security forum would know more about portsentry.
How do you change the notification email for portsentry? I remember i set it to an email adress originally that is not active for me anymore. I remmeber on install it said i thought change it in portsentry.conf but i have looked and looked and have not seen one. Any suggestions? am i really thinking of a completly different program?!

Also what is the best way to be able to test if portsentry is working?

thanks

unSpawn · 11-04-2003, 10:36 AM

How do you change the notification email for portsentry?
If it's emailing then it's doing so using an external command. Either grep the conf file for the email address or look for "KILL_RUN_CMD".

Also what is the best way to be able to test if portsentry is working?
Test it running Nmap, hping or whatever you fancy from another box or use a web-based service like Securityspace etc etc.

Also see from the LQ FAQ: Security references, post #3: "Snort and PortSentry compared": http://www.linux.ie/articles/portsen...rtcompared.php