Re: PortSentry: How To Delete an Entry in Routing Table

From: M_F_H (no_one_at_example.com)
Date: 06/23/05

  • Next message: Stan McCann: "sftp password" 
    Date: Thu, 23 Jun 2005 15:21:05 -0400

    M_F_H wrote:
    > While experimenting with PortSentry, I performed an nmap scan on my box
    > from another box to make sure PortSentry was working. As expected, both
    > the /etc/hosts.deny file and the routing table got updated. Now I want
    > to undo the changes that PortSentry did. That's an easy edit of the
    > hosts.deny file, but fixing the routing table baffles me. Here's the
    > routing table:
    >
    > Destination Gateway Genmask Flags Metric Ref Use
    > Iface
    > 208.24.128.3 0.0.0.0 255.255.255.255 UH 0 0 0
    > ppp0
    > 207.20.142.137 - 255.255.255.255 !H 0 - 0 -
    > 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0
    > eth0
    > 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0
    > eth0
    > 0.0.0.0 208.24.128.3 0.0.0.0 UG 0 0 0
    > ppp0
    >
    > Question: How does one flush the line that has the flag "!H"? TIA...

    Answer:
     From the configuration file, /etc/portsentry.conf, PortSentry performs this
    command when it detects a scan:
    route add -host 207.20.142.137 reject

    Therefore, it is reasonable to assume that to restore the route, perform this:
    route del -host 207.20.142.137 reject

  • Next message: Stan McCann: "sftp password"

    Relevant Pages

    • Re: PortSentry: How To Delete an Entry in Routing Table
      ... BLAM!!! ... but the routing table baffles me. ... it is a reject route. ... PortSentry didn't stash it away so that it remembers it for "next time". ...
      (alt.linux)
    • Re: Looking for tool to scan / block IPs
      ... >ex Genuity DNS servers ips in my host.deny file, ... some people have portsentry configured to add a 'reject' ... route, or add the address to the firewall with an explicit ...
      (comp.os.linux.security)
    • "route" issue
      ... mailing lists, I throw myself on your tender mercies.... ... I have a problem with portsentry in that I cannot remove ... The box is running testing/unstable and route is version ...
      (Debian-User)
    • Re: PortSentry: How To Delete an Entry in Routing Table
      ... > from another box to make sure PortSentry was working. ... but the routing table baffles me. ... From the configuration file, /etc/portsentry.conf, PortSentry performs this ... Therefore, it is reasonable to assume that to restore the route, perform this: ...
      (alt.linux)
    • Re: How do I back up a routing table?
      ... Where does the routing table configuration file ... Briefly, there is no single file, but the routing table is the result ... For example - a simple table with no route to the world: ... If you have a second interface, it also gets a network ...
      (alt.linux)