Does Portsentry make sense if there is a packet filter?

From: Manuel Kiessling (manuel_at_kiessling.net)
Date: 06/19/04

  • Next message: Giles Coochey: "Re: Does Portsentry make sense if there is a packet filter?" 
    Date: Sat, 19 Jun 2004 15:04:14 +0200

    Hello,

    I've just set up some new (Debian 3.0 GNU/Linux) servers, and did so as
    I always do, but this time I thought maybe adding Portsentry is not a
    bad idea.

    The thing is: On these machines I also have, like always, installed some
    iptables rules, in order to only present those ports to the outside that
    should be publicly accessible.

    E.g. on one server, which is meant to serve web pages, I opened only
    port 80 to the outside, things like SSH are only allowed from my
    office's IP, everything else is DROPed.

    Well, my question is, does Portsentry make sense at all in this case?
    Because it binds to all those ports and waits for scans, which is great,
    but due to my packet filter, there will never be a packet that reaches
    those ports.

    Wouldn't the Right Thing to do be enabling logging via iptables?

    Thanks in advance, 

    -- 
  Manuel Kiessling
  • Next message: Giles Coochey: "Re: Does Portsentry make sense if there is a packet filter?"

    Relevant Pages

    • Re: Does Portsentry make sense if there is a packet filter?
      ... > Well, my question is, does Portsentry make sense at all in this case? ... > Because it binds to all those ports and waits for scans, which is great, ... > but due to my packet filter, there will never be a packet that reaches ... with port scanning - - you might ...
      (comp.os.linux.security)
    • Re: Does Portsentry make sense if there is a packet filter?
      ... > Because it binds to all those ports and waits for scans, which is great, ... > but due to my packet filter, there will never be a packet that reaches ... Portsentry does much more than log. ...
      (comp.os.linux.security)
    • Re: Visa PCI Firewall Requirements and Windows Networks
      ... GP without the risk of open ports or a DC in the DMZ. ... Outbound access should be minimized but if windows update is your ... alternative tools on trusted servers to patch your machine. ... > behind the second firewall. ...
      (Focus-Microsoft)
    • Re: Win32 The RPC server is unavailable
      ... correct DNS servers and the port are unblocked. ... WMI errors the seem to be RPC related. ... All od the port are unblocked between the servers and the ... Usually RPC errors are due to name resolution or blocked ports. ...
      (microsoft.public.windows.server.networking)
    • RE: Slow user logon on Terminal server after migration to Windows 2003
      ... The Terminal Servers are 2000 or 2003. ... "Inside the firewall zone" means that the Citrix Servers have a firewall ... available RPC ports? ...
      (microsoft.public.windows.server.active_directory)