Fri 13 Mar 2009
Install Portsentry di FreeBSD
Posted by harinto under FreeBSD
No Comments
Teori Singkat
Portsentry merupakan salah satu program aplikasi firewall, yang bisa melakukan pemblokiran
terhadap user yang mencoba melakukan scanning port sistem atau mencoba melakukan aktivitas yang
“tidak terpuji”, antara lain melakukan penyusupan melalui alamat port yang ada. Dengan adanya
portsentry, semua alamat IP yang melakukan aktivitas yang dianggap “mencurigakan”, baik yang
melalui port TCP maupun UDP akan segera diblokir. Sehingga semua user yang menggunakan alamat IP
yang sama seperti warnet, perkantoran, dan anggota ISP, tidak akan bisa mengakses server kita
lagi.
Langkah-langkah install portsentry
router# whereis portsentry
portsentry: /usr/ports/security/portsentry
router# cd /usr/ports/security/portsentry
router# make install clean
===> Vulnerability check disabled, database not found
>> portsentry-1.1.tar.gz doesn’t seem to exist in /usr/ports/distfiles/.
>> Attempting to fetch from http://packetstormsecurity.nl/UNIX/IDS/.
portsentry-1.1.tar.gz 100% of 44 kB 13 kBps
===> Extracting for portsentry-1.1
>> Checksum OK for portsentry-1.1.tar.gz.
===> Patching for portsentry-1.1
===> Applying FreeBSD patches for portsentry-1.1
===> Configuring for portsentry-1.1
===> Building for portsentry-1.1
SYSTYPE=freebsd
Making
cc -O -pipe -DPREFIX=\”/usr/local\” -DBSD44 -o ./portsentry ./portsentry.c ./portsentry_io.c
./portsentry_util.c
===> Installing for portsentry-1.1
===> Generating temporary packing list
===> Checking if security/portsentry already installed
install -o root -g wheel -m 444
/usr/ports/security/portsentry/work/portsentry-1.1/portsentry.conf
/usr/local/etc/portsentry.conf.default
install -o root -g wheel -m 444
/usr/ports/security/portsentry/work/portsentry-1.1/portsentry.ignore /usr/local/etc
install -s -o root -g wheel -m 555
/usr/ports/security/portsentry/work/portsentry-1.1/portsentry /usr/local/bin
/bin/mkdir -p /usr/local/share/doc/portsentry
install -o root -g wheel -m 444
/usr/ports/security/portsentry/work/portsentry-1.1/README.install
/usr/ports/security/portsentry/work/portsentry-1.1/README.methods
/usr/ports/security/portsentry/work/portsentry-1.1/README.stealth
/usr/local/share/doc/portsentry
Edit ${PREFIX}/etc/portsentry.conf and change
your settings if you haven’t already. (route, etc)
***************************************************
* IGNORE stealth mode. It is for Linux only. *
* The author hopes to have a platform independent *
* version at some time. So don’t even bother *
* trying it now. *
***************************************************
===> Registering installation for portsentry-1.1
===> SECURITY REPORT:
This port has installed the following files which may act as network
servers and may therefore pose a remote security risk to the system.
/usr/local/bin/portsentry
If there are vulnerabilities in these programs there may be a security
risk to the system. FreeBSD makes no guarantee about the security of
ports included in the Ports Collection. Please type ‘make deinstall’
to deinstall the port if this is a concern.
===> Cleaning for portsentry-1.1
router# cd /usr/local/etc/
router# cp portsentry.conf.default portsentry.conf
router# touch portsentry.blocked
router# touch portsentry.history
router# touch portsentry.ignore
edit portsentry.ignore,tambahkan ip address yang ingin di allow
# If you don’t supply a netmask it is assumed to be 32 bits.
#
#
192.168.1.0/24
125.162.89.32/32
127.0.0.1/32
0.0.0.0
edit portsentry.conf, tambahkan setingan
# FreeBSD
KILL_ROUTE=”route add -net $TARGET$ -netmask 255.255.255.255 127.0.0.1 -blackhole”
Jalankan Portsentry
router# /usr/local/bin/portsentry -tcp
router# /usr/local/bin/portsentry -udp
cek di background
router# tail -f /var/log/messages
Mar 13 18:43:40 router portsentry[1577]: adminalert: Going into listen mode on UDP port: 34555
Mar 13 18:43:40 router portsentry[1577]: adminalert: Going into listen mode on UDP port: 31335
Mar 13 18:43:40 router portsentry[1577]: adminalert: PortSentry is now active and listening.
router# tail -f /var/log/messages
Mar 12 22:15:26 router kernel: /cache3: optimization changed from SPACE to TIME
Mar 12 22:51:32 router portsentry[367]: attackalert: Connect from host: 92.62.43.77/92.62.43.77
to TCP port: 1080
Mar 12 22:51:32 router portsentry[367]: attackalert: Host 92.62.43.77 has been blocked via
wrappers with string: “ALL: 92.62.43.77″
Mar 12 22:51:32 router portsentry[367]: attackalert: Host 92.62.43.77 has been blocked via
dropped route using command: “route add -net 92.62.43.77 -netmask 255.255.255.255 127.0.0.1
-blackhole”
Mar 13 14:20:01 router portsentry[367]: attackalert: Connect from host:
118-160-210-61.dynamic.hinet.net/118.160.210.61 to TCP port: 1080
Mar 13 14:20:01 router portsentry[367]: attackalert: Host 118.160.210.61 has been blocked via
wrappers with string: “ALL: 118.160.210.61″
Mar 13 14:20:01 router portsentry[367]: attackalert: Host 118.160.210.61 has been blocked via
dropped route using command: “route add -net 118.160.210.61 -netmask 255.255.255.255 127.0.0.1
-blackhole”
contoh ip yang sudah kena blok oleh portsentry
router# cat /etc/hosts.deny
ALL: 194.14.236.50
ALL: 208.99.203.190
ALL: 149.9.1.16
ALL: 194.14.236.50
ALL: 118.136.65.80
