Security
Difficulty: Advanced
4 min read

Portsentry: Port Scan Detection

Tutorial to install and configure Portsentry, a tool that detects port scans and blocks attackers' IP addresses.

Back to tutorials
What is Portsentry?
Portsentry is a proactive defense tool that acts as a "honeypot". It listens on TCP and UDP ports that you do not use. If an attacker attempts to connect to one of these ports (which is typical of a reconnaissance scan), Portsentry detects it immediately and can block the attacker's IP address at the firewall level.

Why use Portsentry?

  • Early detection: A port scan is often the very first step of an attack. Detecting it lets you block an attacker before they even find a real vulnerability.
  • Deterrence: Automatically blocking scanners reduces the "noise" in the logs and discourages automated attacks.
  • Lightweight: Consumes very few resources.

Prerequisites

  • A Linux server (Ubuntu/Debian, CentOS/RHEL).
  • Root access or sudo privileges.
  • A firewall such as iptables or firewalld.

Premium Content

This advanced tutorial is reserved for premium members.

9,90€ / month
  • All advanced tutorials
  • New content every week
  • Progress tracking
  • Cancel anytime
Log in Create an account

Written by

Morgann Riu

Cybersecurity and Linux administration expert. I share my knowledge through free tutorials and training to help system administrators and developers secure their infrastructures.

My profile LinkedIn GitHub

Share this tutorial

X LinkedIn WhatsApp

Did you enjoy this article?

Comments

Recommended for you

Sécurité

Snort : Détection d'intrusion réseau (NIDS)

 Sécurité

Suricata : IDS/IPS réseau haute performance

 Sécurité

iptables : Configurer un Pare-feu sur Linux

 Sécurité

UFW : Pare-feu simple pour Linux

In-depth article on the topic

Checklist Sécurité Linux

30 points essentiels pour sécuriser un serveur Linux. Recevez aussi les nouveaux tutoriels par email.

Pas de spam. Désabonnement en 1 clic.