<div dir="ltr"><div><div><div>Nice thread. in my case (tor exit node):<br><br></div>Output only security connections;<br><br>ExitPolicy accept *:22<br>ExitPolicy accept *:443<br>ExitPolicy accept *:465<br>ExitPolicy accept *:995<br>
ExitPolicy accept *:993<br>ExitPolicy reject *:* <br><br></div>Block all output like http and smtp in my netfilter (Gnu Linux);<br><br>-A OUTPUT -p tcp -m tcp --dport 80 -j DROP <br>-A OUTPUT -p tcp -m tcp --dport 110 -j DROP <br>
etc ..<br><br><span lang="en"><span>I had problems with</span> <span>portscan</span> <span>originated</span> <span>in my</span> <span>output.</span></span> <span lang="en"><span>Even without</span> <span>ExitPolicy</span> <span>accept</span></span><br>
</div><div>EX:<br><br>Dear Sir/Madam,
<p>We have detected abuse from the IP address MYIPADDRESS, which
according to a whois lookup is on your network. We would appreciate if
you would investigate your logs and take action as appropriate.</p>
<p>Log lines are given below, but please ask if you require any further information.</p>
<p>(If you are not the correct person to contact about this please
accept our apologies - your e-mail address was extracted from the whois
record by an automated process.)</p>
<p> Regards,</p>
<p>Critical Path, Inc. </p>
<p>Note: Local timezone is +0000 (GMT)
<br>Jan 15 16:03:00 65.20.0.47 pop3: Failed password from MYIPADDRESS<br>Jan 15 17:40:07 65.20.0.47 pop3: Failed password from MYIPADDRESS
<br>Jan 15 17:40:09 65.20.0.47 pop3: Failed password from MYIPADDRESS<br>Jan 15 17:40:09 65.20.0.47 pop3: Failed password from MYIPADDRESS<br>Jan 15 17:40:11 65.20.0.47 pop3: Failed password from MYIPADDRESS<br>Jan 15 17:40:14 65.20.0.47 pop3: Failed password from MYIPADDRESS<br>
Jan 15 17:40:17 65.20.0.47 pop3: Failed password from MYIPADDRESS<br>Jan 15 17:40:18 65.20.0.47 pop3: Failed password from MYIPADDRESS<br> ******************************</p>------------------------- END ------------------------------------<br>
<br><span lang="en"><span>to keep me</span> <span>in a</span> <span>comfort zone</span><span>,</span> <span>I installed</span> <span>OSSEC. </span></span>OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.<br>
</div><div><br><span lang="en"><span>example</span> <span>of my</span> <span>latest incidents:<br><br></span></span><br><span class="">OSSEC</span> HIDS Notification.<br>
2014 May 23 11:45:44<br><br>
Received From: darkstar->/var/log/messages<br>
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."<br>
Portion of the log(s):<br>
<br>
May 23 12:45:44 darkstar kernel: tor: page allocation failure. order:0, mode:0x20<br>
<br>
--END OF NOTIFICATION<br>
</div><div><br>
</div><span id="result_box" class="" lang="en"><span class="">'m Slowly</span> <span class="">creating</span> <span class="">rules</span> <span class="">(</span><span>regular</span> <span class="">expressions) to</span> <span class="">OSSEC</span><span> for the Tor message</span><span class=""> and</span> <span class="">treating</span> <span class="">facilities</span>.<span class=""></span></span><br>
<br><br><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, May 22, 2014 at 2:31 PM, Paul Staroch <span dir="ltr"><<a href="mailto:paulchen@rueckgr.at" target="_blank">paulchen@rueckgr.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Am 2014-05-22 02:23, schrieb Contra Band:<br>
> # Allow incoming 9050<br>
> iptables -A INPUT -p tcp --dport 9050 -m state --state NEW,ESTABLISHED -j ACCEPT<br>
> iptables -A OUTPUT -p tcp --sport 9050 -m state --state ESTABLISHED -j ACCEPT<br>
><br>
> # Allow outgoing 9050<br>
> iptables -A OUTPUT -p tcp --dport 9050 -m state --state NEW,ESTABLISHED -j ACCEPT<br>
> iptables -A INPUT -p tcp --sport 9050 -m state --state ESTABLISHED -j ACCEPT<br>
><br>
> # Allow incoming 9051<br>
> iptables -A INPUT -p tcp --dport 9051 -m state --state NEW,ESTABLISHED -j ACCEPT<br>
> iptables -A OUTPUT -p tcp --sport 9051 -m state --state ESTABLISHED -j ACCEPT<br>
><br>
> # Allow outgoing 9051<br>
> iptables -A OUTPUT -p tcp --dport 9051 -m state --state NEW,ESTABLISHED -j ACCEPT<br>
> iptables -A INPUT -p tcp --sport 9051 -m state --state ESTABLISHED -j ACCEPT<br>
<br>
Do you actually need remote access to ports 9050 (Socks proxy) and 9051 (control port)? By default, Tor opens these ports on the loopback interface only.<br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
Paul<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
tor-relays mailing list<br>
<a href="mailto:tor-relays@lists.torproject.org">tor-relays@lists.torproject.org</a><br>
<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div dir="ltr"><div style="margin-left:40px"><font size="1"><span style="font-family:courier new,monospace">Noilson Caio Teixeira de Araújo<br><a href="http://ncaio.ithub.com.br" target="_blank">https://ncaio.<font size="1">wordpress</font></a><a href="http://ncaio.ithub.com.br" target="_blank">.com</a><br>
<a href="http://br.linkedin.com/in/ncaio" target="_blank">https://br.linkedin.com/in/ncaio</a><br></span></font></div><div style="margin-left:40px"><span style="font-family:courier new,monospace"><a href="https://twitter.com/noilsoncaio" target="_blank"><font size="1">https://twitter.com/noilsoncaio</font></a></span><br>
</div><div style="margin-left:40px"><br></div> </div>
</div>