Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For Linux, what is the best program/daemon out there that would detect, block, and report computers scanning the server's ports, sequentially or randomly, for SSH, MySQL, popular web-based administering systems, and other security-sensible services that were moved from their default ports?

share|improve this question

closed as off topic by MadHatter, MDMarra, Brent Pabst, Dave M, mdpc Nov 14 '12 at 17:07

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Product recommendations are explicitly off-topic for SF (and, I'm told, other SE sites); sorry. – MadHatter Nov 14 '12 at 15:26
yeah this is true. But to answer the question in a general way, there are many programs out there that are run onto of iptables and will add blocked ip into ip iptables. smoothwall or csf are many out there. I personally use CSF. – Sc0rian Nov 14 '12 at 15:44
up vote 1 down vote accepted

ConfigServer Services is a set perl modules/Scripts/daemons, which effectively provide you with port scanning ability, detect it, report and and block it with number of ways to tweak its options.

I personally recommend it for small scale servers.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.