tar zxvf portsentry-1.1.tar.gz
cd portsentry-1.1

make linux
make install

 # Un-comment these if you are really anal:
 #TCP_PORTS="1,7,9,11,15,70,79,80,109,110,111,119,138,139,143,512,513,514,515,540,635,1080,1524,2000,2001,[..]
 #UDP_PORTS="1,7,9,66,67,68,69,111,137,138,161,162,474,513,517,518,635,640,641,666,700,2049,31335,27444,34555,[..]
 #
 # Use these if you just want to be aware:
 TCP_PORTS="1,11,15,79,111,119,143,540,635,1080,1524,2000,5742,6667,12345,12346,20034,27665,31337,32771,32772,[..]
 UDP_PORTS="1,7,9,69,161,162,513,635,640,641,700,37444,34555,31335,32770,32771,32772,32773,32774,31337,54321"
 #
 # Use these for just bare-bones
 #TCP_PORTS="1,11,15,110,111,143,540,635,1080,1524,2000,12345,12346,20034,32771,32772,32773,32774,49724,54320"
 #UDP_PORTS="1,7,9,69,161,162,513,640,700,32770,32771,32772,32773,32774,31337,54321"

IGNORE_FILE="/usr/local/psionic/portsentry/portsentry.ignore"
HISTORY_FILE="/usr/local/psionic/portsentry/portsentry.history"
BLOCKED_FILE="/usr/local/psionic/portsentry/portsentry.blocked"

KILL_ROUTE="/usr/local/sbin/iptables -I INPUT -s $TARGET$ -j DROP"

KILL_HOSTS_DENY="ALL: $TARGET$ # Portsentry blocked"

#!/bin/bash
#
# portsentry Start the portsentry portscan detector
# Authors: Craig Rowland , Tim Powers
# and Matthias Saou
# configfile: /usr/local/psionic/portsentry/portsentry.conf
# pidfile: /var/run/portsentry.pid

# Source function library.
. /etc/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0

# For this script to work on non english systems
export LANG=C

RETVAL=0

start () {
  # Set up the ignore file
  SENTRYDIR=/usr/local/psionic/portsentry
  FINALIGNORE=$SENTRYDIR/portsentry.ignore
  TMPFILE=/usr/local/psionic/portsentry/portsentry.ignore.tmp
  # Testline is used to see if the initscript has already been run
  if [ -f $FINALIGNORE ] ; then
   cp -f $FINALIGNORE $TMPFILE
   testline=`grep -n "Do NOT edit below this" $TMPFILE | cut --delimiter=":" -f1`
   if [ -z "$testline" ] ; then
    echo > /dev/null # Do nothing
   else
    let headline=$testline-2
    head -$headline $FINALIGNORE > $TMPFILE
   fi
  fi
  echo '#########################################' >> $TMPFILE
  echo '# Do NOT edit below this line, if you #' >> $TMPFILE
  echo '# do, your changes will be lost when #' >> $TMPFILE
  echo '# portsentry is restarted via the #' >> $TMPFILE
  echo '# initscript. Make all changes above #' >> $TMPFILE
  echo '# this box. #' >> $TMPFILE
  echo '#########################################' >> $TMPFILE

  echo '' >> $TMPFILE
  echo '# Exclude all local interfaces' >> $TMPFILE
  for i in `/sbin/ifconfig -a | grep inet | awk '{print $2}' | sed 's/addr://'` ; do
    echo $i >> $TMPFILE
  done

  echo '' >> $TMPFILE
  echo '# Exclude the default gateway(s)' >> $TMPFILE
  for i in `/sbin/route -n | grep ^0.0.0.0 | awk '{print $2}'` ; do
    echo $i >> $TMPFILE
  done

  echo '' >> $TMPFILE
  echo '# Exclude the nameservers' >> $TMPFILE
  for i in `/bin/cat /etc/resolv.conf | grep ^nameserver | awk '{print $2}'` ; do
   echo $i >> $TMPFILE
  done

  echo '' >> $TMPFILE
  echo '# And last but not least...' >> $TMPFILE
  echo '0.0.0.0' >> $TMPFILE
  echo '' >> $TMPFILE

  cp -f $TMPFILE $SENTRYDIR/portsentry.ignore
  rm -f $TMPFILE

  # Check for modes defined in the config file
  if [ -s $SENTRYDIR/portsentry.modes ] ; then
   modes=`cut -d "#" -f 1 $SENTRYDIR/portsentry.modes`
  else
   modes="tcp udp"
  fi
  for i in $modes ; do
   action $"Starting portsentry -$i: " /usr/local/psionic/portsentry/portsentry -$i
   RETVAL=$?
  done
  [ $RETVAL -eq 0 ] && touch /var/lock/subsys/portsentry
  return $RETVAL
 }

stop() {
  echo -n $"Stopping portsentry: "
  killproc portsentry
  RETVAL=$?
  echo
  [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/portsentry
  return $RETVAL
<  }

# See how we were called.
case $1 in
  start)
   start
   ;;
  stop)
   stop
   ;;
  status)
   status portsentry
   RETVAL=$?
   ;;
  restart)
   stop
   start
   RETVAL=$?
   ;;
  condrestart)
    if [ -f /var/lock/subsys/portsentry ]; then
     stop
     start
     RETVAL=$?
    fi
    ;;
  *)
  echo $"Usage: portsentry {start|stop|restart|condrestart|status}"
  exit 1
 esac

exit $RETVAL

ADVANCED_PORTS_TCP="1024"
ADVANCED_PORTS_UDP="1024"
ADVANCED_EXCLUDE_TCP="113,139"
ADVANCED_EXCLUDE_UDP="520,138,137,67"