IPS not IDS

I don't think I understand what you mean by IPS. I'll make a wild guess that IPS is an acronym for Intrusion Protection System which I'd consider a firewall to be. Could you elaborate?

You could try to use AIDE (Advanced Intrusion Detection Environment) It might be what you are looking for
You can get it here:
http://sourceforge.net/projects/aide/

Is this more like what you are looking for ?

Sorry i should have explained IPS means Intrusion PREVENTION System i used to use portsentry, basically IPS i think is quite new,  instead of just detecting an attack it will prevent it from happening and in portsentry case it blocks the incoming IP by automatically puting it in the hosts.deny file, i am not sure AIDE can do this or can it ?
I have not installed portsentry yet i was waiting for someone to tell me that there is something better out there, if not i will use portsentry. someone also recommended SNORT-INLINE and FLEXRESP but i have never used these and would need a walk thought guide on how to install and configure them.

can anyone assist me.

Portsentry can be a useful adjunct to a properly configured IPtables or other firewall. It can detect a port scan of your network and optionally cause IPtables to block the source IP. It isn't a substitue for a properly configured firewall and properly maintained servers exposed to the Internet as it can't detect an actual attack on some service running on a well known port, say like HTTP, HTTPS, FTP, etc. For that you need an intrusion detection system like Snort/ACID.

If you keep your servers with Internet exposure up to date w/respect to security vulnerabilities and have a good firewall in place it normally is sufficient to run an IDS, like Snort/ACID, to let you know what sort of attacks are being directed at you. The firewall blocks port scans anyway and an attacker is limited to attacks against those services you offer to the Internet (usually just HTTP, HTTPS, SSH, SMTP, etc). Those are well known ports and one normally is advertising them. So an attacker need not do a port scan to find them.

DoS attacks against your site usually require the assistance of your provider and their upstream partners to block. Even if you refuse to accept packets from a DoS source the attack can still consume all of your Internet bandwidth. To stop that the attacker has to be block at a router close to the source of the attack and that means tracing to attack back to the source which you can't do but network providers along the route can.

Like most things in the IT world, you have a trade-off between how much effort you have to put into the thing personally, and how much you have to pay someone else to put the effort in for you.

Snort-Inline, Flexresp, custom IPtables, Portsentry, etc. are all things that are cheap but require deep knowledge to setup. If you want to go with one of these, you'll have to do the research yourself (start with a google search), since we can't cookie-cutter them for you.

There are also several reasonably good commercial IPS systems the vendors of which will be happy to set up for you and train you in their operation. Some vendors to look at are TippingPoint (www.tippingpoint.com), NetScreen (www.netscreen.com), Captus Networks (www.captusnetworks.com), and Lucid Security (www.ipangel.com).

thanks for the web addresses but as i use linux i was hoping for a free onw like portsenrty or onw where i just make a donation.

Aide is totally free, but it might not be totally what you are looking for. but it's one step on the road to what you are looking for.

Is Aide prevention or just detection, I have seen comments from Linux security buffs that prevention is worth 10 times more than detection would you all agree ?

thanks for the advice until the next time bye

Well since this is my first post! (yeey) im not sure is this thread is closed, or if comments are still read.

I have used linux based firewalls for quite a while now, and at the moment i have approx 30 boxes in different locations. I have looked at snort, portsentry and lots of other solutions, but after a while i landed on a program called psad. I very seldom see psad mentioned in discussions like this, and i try to talk about it every time i get a chance, due to my complete satisfaction with the program.

Some things about psad:

1.Psad is extremly easy to configure, you will have it up and running in 5 minutes (once you get the hang of it)
2.Detection for tcp syn, fin, null, and xmas scans as well as udp scans
3.it uses snort rules
4.Email alerts
5.Auto-blocking of scanning ip addresses via iptables and/or tcpwrappers based on scan danger level
6.dshield reporting

Thats just to mention some..

It works great for me, and hopefully you will find it interesting too. You can read more at: http://www.cipherdyne.com/psad/

Best Regards,
Kenneth

i like what your telling me i shall give it a try, Its sounds like just what i have been looking for