portsentry.conf(8)

💖 portsentry.conf — the manual page, bestie edition 💖

okay so you opened the portsentry.conf page from the System Manager's Manual, section 8 (that's the sysadmin-stuff section, iykyk). This is the glow-up version. Same facts, way more fun. Let's go ✨

---

🌸 NAME 🌸

portsentry.conf — the config file for Portsentry. She's the control room. The vibe-setter. The main character of your intrusion-detection setup 💅

---

🦋 DESCRIPTION 🦋

The portsentry.conf file is how you configure Portsentry, periodt.

• The default location for this file is /etc/portsentry/portsentry.conf.
• Portsentry reads this file at startup — so if you edit it, you gotta restart her to make it stick, bestie.
• The config file is a simple text file with one option per line.
• Lines starting with a # are considered comments and are ignored. (So go ahead and annotate your life, she won't judge 💅)

There's an example configuration file included with portsentry, and it's available here with extra comments, examples and recommendations for how to set up Portsentry:

https://github.com/portsentry/portsentry/blob/master/exam‐ ples/portsen‐ try.conf

(it's on GitHub, go peek, it's giving helpful ✨)

---

✨ OPTIONS ✨

🎀 TCP_PORTS=“<ports>”

A comma separated list of TCP ports you want to monitor. You can specify inclusive port ranges with a dash, e.g., 10-20 to include port 10 to 20. Inclusive means both ends, no gatekeeping 🫶

💜 Example

TCP_PORTS=“10,20,30-40”

🎀 UDP_PORTS=“<ports>”

A comma separated list of UDP ports you want to monitor. You can specify inclusive port ranges with a dash, e.g., 10-20 to include port 10 to 20. Same energy as TCP, different protocol 🌈

💜 Example

UDP_PORTS=“10,20,30-40”

🎀 IGNORE_FILE=“<path to ignore file>”

Path to a file with IP addresses to ignore when logging and taking actions. Any IP/CIDR address in this file will be ignored. This is useful for ignoring local traffic or other trusted hosts. Basically the VIP list — they get in, no questions asked 😌

🎀 HISTORY_FILE=“<path to history file>”

This file contains all the IP addresses that have triggered the Portsentry detection engine in some way. If you wanna know how to actually read this thing, there's a HOWTO-Logfile:

https://github.com/portsentry/portsentry/blob/master/docs/HOWTO-Log‐ file.md

🎀 BLOCKED_FILE=“/tmp/portsentry.blocked”

When Portsentry's action mechanism is used (BLOCK_TCP and/or BLOCK_UDP is set to 1 or 2, see below), this file will contain a list of all hosts that trigger an action. If a host is matched against this file, no further action will be taken — she's already handled, bestie, we're not doing it twice 💀

Leaving this field as an empty string “” or not setting it at all will cause the action mechanism to always trigger when a scan is detected. So yeah, empty string = no memory, all vibes, every scan gets the full treatment 🔥

🎀 RESOLVE_HOST = “<1|0>”

DNS Name resolution, babes:

• Setting this to “1” will turn on DNS lookups for attacking hosts.
• Setting it to “0” (or any other value) will not perform DNS lookups.
• Default is “0”.

NOTE: Using DNS resolution can slow down the response time of Portsentry. She's doing extra homework, give her a sec 😭

🎀 BLOCK_TCP=“0|1|2” and BLOCK_UDP=“0|1|2”

This option controls how Portsentry reacts to a detected connection attempt. Three flavors, pick your fighter 👑

0 = Do not block UDP/TCP scans. The detected connection attempt is only logged. This could be useful for monitoring purposes or use of an external tool, such as fail2ban. This option is the default.

NOTE: It is highly recommended to only log connection attempts (by using: BLOCK_TCP=“0” and BLOCK_UDP=“0”) and use an external tool such as fail2ban to block the attacking host based on the log file generated by Portsentry. The reason for this is that other tools are more sophisticated. For example, fail2ban will persist the blocked host across reboots. (She remembers. Portsentry lowkey doesn't 💀)

1 = Block UDP/TCP scans. This option will block the attacking host after the scan is detected using the technique specified in the KILL_ROUTE and/or KILL_HOSTS_DENY section below. If KILL_ROUTE is defined, it will run first, followed by KILL_HOSTS_DENY if it is set. If the KILL_RUN_CMD option is set, the command will also be executed.

NOTE: These options are preserved as a legacy option for those who cannot use an external tool to block the attacking host, or have some specific use-case where this method is preferred. Respect the elders 🫶

2 = Run external command only (KILL_RUN_CMD). This option will only run the external command specified in the KILL_RUN_CMD.

🎀 KILL_ROUTE=“”

The KILL_ROUTE option is used to drop or blacklist the attacking host. This can be done in a number of ways depending on your OS. The string TARGET is replaced with the attacking host. So TARGET is the placeholder, she gets swapped in like a plot twist ✨

💜 Example

KILL_ROUTE=“/usr/local/bin/iptables -I INPUT -s TARGET -j DROP”

🎀 KILL_HOSTS_DENY=“”

This text will be dropped into the hosts.deny file for wrappers to use. Yes, the classic. Old but iconic 💅

💜 Example

KILL_HOSTS_DENY=“ALL: TARGET”

🎀 KILL_RUN_CMD=“/some/path/here/script TARGET PORT”

This is a command that can be run when Portsentry is triggered. It can be whatever you want it to be. Your world, your script, your rules 🌈

🎀 KILL_RUN_CMD_FIRST = “0|1”

The KILL_RUN_CMD_FIRST value should be set to “1” to force the command to run before the KILL_ROUTE/KILL_HOSTS_DENY is executed, and should be set to “0” to make the command run after the blocking has occurred. Order of operations, bestie — it matters 😌

🎀 SCAN_TRIGGER=“0”

Enter the number of port connects from the same host you will allow before an alarm is given. The default is 0, which will react immediately. Zero patience, zero chill, we love that for her 🔥

🎀 PORT_BANNER=“*** UNAUTHORIZED ACCESS PROHIBITED *** YOUR CONNECTION ATTEMPT HAS BEEN LOGGED.”

When Portsentry is used in “connect” mode [Legacy option] you can specify a banner to be displayed to the connecting host. Once the banner is displayed, the connection will be closed. It's giving "we saw you, and we wrote it down" 📝

---

🌟 EXAMPLES 🌟

Go view the example configuration file, it has the whole glow-up already written out:

https://github.com/portsentry/portsentry/blob/master/examples/portsen‐ try.conf

(it's the portsentry.conf example, go look, you'll be obsessed 💖)

---

🍓 FILES 🍓

• /etc/portsentry/portsentry.conf

---

🙈 BUGS 🙈

All bugs should be reported via the Portsentry GitHub issue tracker:

https://github.com/portsentry/portsentry/issues

Not me telling on bugs, but like, do it, it helps 😭

---

👑 AUTHORS 👑

Marcus Hufvudsson mh@protohuf.com — legend behavior, we thank him for his service 🫶

---

🌈 SEE ALSO 🌈

• portsentry(8)

---

💜 LICENSE 💜

Portsentry is licensed under the BSD-2-Clause license. Slay, legally ✨

---

okay that's the whole page bestie, every last flag and file path accounted for, no cap 💅 this was the portsentry.conf(8) page out of the System Manager's Manual, and yeah the footer said the same thing as the header, because manual pages love a little symmetry 🎀 mwah, go configure something iconic ✨🦋