RE: [cobalt-security] [RaQ3] Port Sentry

["Tony" <isplists@xxxxxxxxxxxx>]

>And here is the main reason I dislike portsentry: now your friend, who
>thought his portscan was doing you a favor, can no longer access your server
>(or at least some of its resources). Portsentry can't tell the difference
>between a malicious attack or a goofball's mistake. Its zero-tolerance for
>system administrators.
>
>For a lot of hackers, portsentry makes very little difference - they can
>always come at your open services from another IP. There are other ways
>beyond a port scan to find out what services are running on your machine
>(your web site, network solutions database, email headers, etc).
>
>So, when using portsentry, what you end up with is a bunch of banned IPs
>from possibly innocent users, and a bunch of hackers that you really haven't
>stopped, at least not for long.

And the portsentry alternative to deal with 20+ scans per day is....?
Are you suggesting that running without Portsentry is better than running with it?


Tony