similar to: Hostsentry RPM?

Hello, After a long delay I'm happy to announce the alpha release of a new security tool called HostSentry. HostSentry is part of the Abacus Project suite of security tools and is designed to function as a Login Anomaly Detector. The tool is in early alpha phase and while some parts may be buggy or incomplete, it is stable enough that it shouldn't cause any harm to a host. A few points

I'm running CentOS 4 with Blue Quartz on a white box, and having problems with installing Portsentry vi the .tar.gz route. Various errors, etc. Anyone here know of a source, like an RPM or something, for Portsentry for CentOS? ... or a similar app? thnx, Manny

Hi, all: This is just a note and suggestion, not a question; but I really like this system and thought it might be useful to others so I decided to share. Hope it helps someone, and comments or suggestions are always welcome. 1. Overview: Shorewall accepts traffic on ports that I consider "hostile" (i.e. ports on which I would NEVER expect to see connections) and redirects

I installed portsentry and am using it with shorewall. I followed the HOWTO posted here, and I have it working together, I have gotten about 4 emails saying such IP is blocked for 5 days. However, in the /etc/portsentry dir, the only files in there are: portsentry.conf portsentry.ignore portsentry.temp.block There are no files that should be there like: portsentry.history portsentry.block -

I'm trying to create an initialization scrip in the /etc/init.d/. Of course, the one I have is failing! At the top of the other initialization scripts in the same directory, there is are two lines, the chkconfig and description # chkconfig: 2345 55 25 # description: OpenSSH server daemon On the check config line, what are the numbers/attributes that follow? If I'm creating an

Just dropping a note, I've built CentOS4 friendly RPMs (as well as RHEL4 and FC4) of two of my favourite tools, PortSentry and ProFTPd: ftp://ftp.pbone.net/mirror/ftp.falsehope.net/home/tengel/portsentry/CentOS4/ ftp://ftp.pbone.net/mirror/ftp.falsehope.net/home/tengel/proftpd/CentOS4/ PortSentry is built using the last known (RedHat 9 based) SPEC/patches from FreshRPMS, updated to apply

On Wed, Feb 3, 2010 at 2:40 PM, Geoff Galitz <geoff at galitz.org> wrote: > > > > Should it be running, or not? > > > > > > >root at mercury:[~]$ netstat -ap --inet | grep rpc > > >tcp 0 0 *:sunrpc *:* > LISTEN 6458/portsentry > > >udp 0 0 localhost:filenet-rpc localhost:filenet-rpc

Hello everyone, I need a little help finding an issue one of my machines. I have 4 setup all the same way and just this one gives the errors. Here are the errors from Logwatch; ?################### LogWatch 5.2.2 (06/23/04) #################### ?--------------------- Arpwatch Begin ------------------------ Argument "4444'service' option expects either the name of a

Just to clarify, I'm looking at this from an application layer Point of View. One of the reasons why I'm looking at it that way, is because Tim said he was looking at LinuxHA..."application level" redundancy that uses IP. Tim, just to let you know, I don't believe that LinuxHA will work in the way you described, only because of the different IP ranges. It looks like Linux

Hello, i use shorewall for a very long time (2 years or so) and i use it for nat and as firewall....i now use portsentrys to detect portscans but there is one problem...i use the HOWTO from the shorewall mailing list to make portsentry and shorewall work together....but there is one prob portscans get detected and a drop rule is added to shorewall for example shorewall drop 62.178.xxx.xx

I'm trying to use snmpwalk to look at other machines, but I can't get a response. It keeps timing out. It can see itself, though. I haven't had this problem with other machines and I don't know what's different. Suggestions? -------------- next part -------------- An HTML attachment was scrubbed... URL:

I'm having some trouble with portsentry on CentOS. I've installed it and configured it to ignore my network. However, every 20 minutes, it reloads my iptables and basically kills any SSH sessions, etc. Any suggestions? Thanks, Todd -------------- next part -------------- An HTML attachment was scrubbed... URL:

Hi all, I appologise in advance if this is a little OT, but I am building a box that will serve as firewall and router for a small ''internet cafe / netcafe'' and am using CentOS... So here it is: What are the best tools to be used for keeping the potential script kiddies from ''harming the Internet'' :) ? I specifically want to be able to detect and prevent

I need to enable forward the xWindows through my SSH session, but I'm having trouble. I'm using Putty and I've configured it to allow enable x11 forwarding through the ssh tunnel. I've also edited the /etc/ssh/sshd_config and set X11Forwarding yes. After doing this, it's not working. I'm sure there's quite a bit not doing. Could anybody offer any guidance? This is

I have a database server that is running out of space. All my databases are being stored in a 80G /opt partition. Because I'm using LVM, wouldn't I be able to pop the HDDs (a h/w raid volume) in, add it to the LVM, and resize my ext3 /opt partition? Everything that I've been reading says this is possible, but I'm not sure. Has anyone done this and are there any pitfalls to

I've been looking online for resources that may help me, but I haven't found anything that worked. I'm trying to run x as a non-root user. Any suggestions? I get the messages: Fatal server error: PAM authentication failed, cannot start X server. Perhaps you do not have console ownership? Please consult the The X.Org Foundation support at

Hi, after reading the docs (no man page) and seeing a few example howtos, I see none for Centos specifically. I hereby offer to write this and even host it, and any other wiki-able howto you want, if you can school me on the first few steps relevant to how to link up the current rpmforge rpm for RHEL4-64. See, right now, the one for centos loads into the /usr/share/doc, which is an odd place

I have dovecot configured to use an LDAP database for mail delivery with dovecot-lda. All of of my user accounts and aliases work fine except for postmaster@ which consistantly bounces. I have compared the entry for postmaster with another working alias and see no difference. When I send mail to postmaster I get the following in the logs: Jun 11 02:11:13 server1 postfix/pipe[12083]: 6D6CF33444:

We currently have a backup site at a different location to our main site. This backup site mirrors (as closely as possible) our main services, particularly web serving. Is there a way to have the backup site act as a failover for the main site using something like Linux-HA? They are on seperate internet connections with different IP ranges. Thanks -- Tim Edwards

Hello, is there anyone out there, who has a current 2.4.23 srpm or good how to compile it from src with supported db4? I tried to compile recent source files, but always finding the current (installed) db4 >4.3 fails. Than I tried to compile the LTB Project Files: http://ltb-project.org/wiki/documentation/openldap-rpm May be it is just a small step or option to be set. Would be nice to get