Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum. |
Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
08-21-2003, 04:17 PM
|
#1
|
Member
Registered: Jul 2003
Posts: 142
Rep:
|
portsentry and email notifications
Well the header tells it all. I have installed portsentry and I have shorewall up and running. But I would like to receive notifications/alerts when my computer is scanned. How would I go about achieving this?
|
|
|
08-21-2003, 06:30 PM
|
#2
|
Senior Member
Registered: Apr 2003
Location: Eire
Distribution: Slackware 12.0, OpenSuse 10.3
Posts: 1,120
Rep:
|
You could use it's counter part Logcheck/Log Sentry in conjunction with Port Sentry, then the scans should show up in the emails that Log Check sends you.
Other than that don't think Port Sentry by itself can do it from my readng anyway
.....going to install Log Check myself and see how it goes.
|
|
|
08-22-2003, 02:06 AM
|
#3
|
Member
Registered: Nov 2002
Distribution: A totally 133t distro :)
Posts: 358
Rep:
|
Which portsentry are you using?
In the version im running this appears in the portsentry.conf file:
# External Command#
###################
# This is a command that is run when a host connects, it can be whatever
# you want it to be (pager, etc.). This command is executed before the
# route is dropped or after depending on the KILL_RUN_CMD_FIRST option below
#
#
# I NEVER RECOMMEND YOU PUT IN RETALIATORY ACTIONS AGAINST THE HOST SCANNING
# YOU!
#
# TCP/IP is an *unauthenticated protocol* and people can make scans appear out
# of thin air. The only time it is reasonably safe (and I *never* think it is
# reasonable) to run reverse probe scripts is when using the "classic" -tcp mode
.
# This mode requires a full connect and is very hard to spoof.
#
# The KILL_RUN_CMD_FIRST value should be set to "1" to force the command
# to run *before* the blocking occurs and should be set to "0" to make the
# command run *after* the blocking has occurred.
#
#KILL_RUN_CMD_FIRST = "0"
#
#
#KILL_RUN_CMD="/some/path/here/script $TARGET$ $PORT$"
#KILL_RUN_CMD="/bin/mail -s 'Portscan from $TARGET$ on port $PORT$' user@host <
/dev/null"
So just use the second KILL_RUN_CMD setting user@host to where you want the email to go and uncomment the KILL_RUN_CMD_FIRST = "0" line
|
|
|
08-22-2003, 02:15 AM
|
#4
|
Senior Member
Registered: Apr 2003
Location: Eire
Distribution: Slackware 12.0, OpenSuse 10.3
Posts: 1,120
Rep:
|
I stand corrected, silly me.
|
|
|
08-22-2003, 07:14 AM
|
#5
|
Member
Registered: Jul 2003
Posts: 142
Original Poster
Rep:
|
Thank you very much for the help, everything seems to be working now, i.e. Im aware of portscans 
|
|
|
All times are GMT -5. The time now is 03:16 PM.
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
Latest Threads
LQ News
|
|