/* BOPM sample configuration */ options { pidfile = "/home/MYSHELLUSER/bopm/bopm.pid"; # negcache = 3600; dns_fdlimit = 64; # scanlog = "/some/path/scan.log"; }; IRC { # vhost = "0.0.0.0"; nick = "BOPMNICK"; realname = "Blitzed Open Proxy Monitor"; username = "bopm"; server = "SERVERIP"; port = 6667; nickserv = "privmsg nickserv :identify NICKSERVPASS"; oper = "OPERUSER OPERPASS"; mode = "+sH +c-h"; away = "I'm a bot. Your messages will be ignored."; channel { name = "#bopm"; }; connregex = "\\*\\*\\* Notice -- Client connecting: ([^ ]+) \\(([^@]+)@([^\\)]+)\\) \\[([0-9\\.]+)\\].*"; kline = "os akill add +7d Open Proxy found on your host. Please visit www.blitzed.org/proxy?ip=%i for more information."; perform = "PROTOCTL HCN"; }; OPM { blacklist { name = "ircbl.ahbl.org"; type = "A record reply"; ban_unknown = yes; reply { 2 = "Open proxy"; }; kline = "os akill add +7d *@%i DNSBL listed. Check ircnet.com/cgi-bin/bl.cgi?ip=%i for removal."; }; blacklist { name = "cbl.abuseat.org"; type = "A record reply"; reply { 2 = "Open proxy"; }; ban_unknown = yes; kline = "os akill add +7d *@%i DNSBL listed. Check ircnet.com/cgi-bin/bl.cgi?ip=%i for removal."; }; blacklist { name = "tor.dnsbl.sectoor.de"; type = "A record reply"; reply { 1 = "Tor exit server"; }; ban_unknown = yes; kline = "os akill add +7d *@%i Tor exit server detected. Visit www.sectoor.de/tor.php?ip=%i for info."; }; blacklist { name = "tor.kewlio.net.uk"; type = "A record reply"; reply { 100 = "Tor exit server"; }; ban_unknown = yes; kline = "os akill add +7d *@%i Tor exit server detected."; }; blacklist { name = "tor.ahbl.org"; type = "A record reply"; reply { 2 = "Tor exit server"; }; ban_unknown = yes; kline = "os akill add +7d *@%i Tor exit server detected."; }; blacklist { name = "rbl.efnet.org"; type = "A record reply"; reply { 1 = "Open proxy"; 2 = "Trojan spreader"; 3 = "Trojan infected client"; 4 = "TOR exit server"; 5 = "Drones / Flooding"; }; ban_unknown = yes; kline = "os akill add +7d *@%i DNSBL listed. Check ircnet.com/cgi-bin/bl.cgi?ip=%i for removal."; }; /* example: NJABL - please read http://www.njabl.org/use.html before * uncommenting */ # blacklist { # name = "dnsbl.njabl.org"; # type = "A record reply"; # reply { # 9 = "Open proxy"; # }; # ban_unknown = yes; # kline = "os akill add +7d Open proxy found on your host, please visit www.njabl.org/cgi-bin/lookup.cgi?query=%i"; # }; # dnsbl_from = "mybopm@myserver.org"; # dnsbl_to = "bopm@reports.blitzed.org"; # sendmail = "/usr/sbin/sendmail"; }; scanner { /* * Unique name of this scanner. This is used further down in the * user {} blocks to decide which users get affected by which * scanners. */ name="default"; /* * HTTP CONNECT - very common proxy protocol supported by widely known * software such as Squid and Apache. The most common sort of * insecure proxy and found on a multitude of weird ports too. Offers * transparent two way TCP connections. */ protocol = HTTP:80; protocol = HTTP:8080; protocol = HTTP:3128; protocol = HTTP:6588; /* * SOCKS4/5 - well known proxy protocols, probably the second most * common for insecure proxies, also offers transparent two way TCP * connections. Fortunately largely confined to port 1080. */ protocol = SOCKS4:1080; protocol = SOCKS5:1080; /* * Cisco routers with a default password (yes, it really does happen). * Also pretty much anything else that will let you telnet to anywhere * else on the internet. Fortunately these are always on port 23. */ protocol = ROUTER:23; /* * WinGate is commercial windows proxy software which is now not so * common, but still to be found, and helpfully presents an interface * that can be used to telnet out, on port 23. */ protocol = WINGATE:23; /* * The HTTP POST protocol, often dismissed when writing the access * controls for proxies, but sadly can still be used to abused. * Offers only the opportunity to send a single block of data, but * enough of them at once can still make for a devastating flood. * Found on the same ports that HTTP CONNECT proxies inhabit. * * Note that if your ircd has "ping cookies" then clients from HTTP * POST proxies cannot actually ever get onto your network anyway. If * you leave the checks in then you'll still find some (because some * people IRC from boxes that run them), but if you use BOPM purely as * a protective measure and you have ping cookies, you need not scan * for HTTP POST. */ protocol = HTTPPOST:80; # vhost = "127.0.0.1"; fd = 512; max_read = 4096; /* * Amount of time (in seconds) before a test is considered timed out. * Again, all but the poorest slowest proxies will be detected within * 30 seconds, and this helps keep resource usage low. */ timeout = 30; /* * Target IP to tell the proxy to connect to * * !!! THIS MUST BE CHANGED !!! * * You cannot instruct the proxy to connect to itself! The easiest * thing to do would be to set this to the IP of your ircd and then * keep the default target_strings. * * Please use an IP that is publically reachable from anywhere on the * Internet, because you have no way of knowing where the insecure * proxies will be located. Just because you and your BOPM can * connect to your ircd on some private IP like 192.168.0.1, does not * mean that the insecure proxies out there on the Internet will be * able to. And if they never connect, you will never detect them. * * Remember to change this setting for every scanner you configure. * */ target_ip = "SERVERIP"; /* * Target port to tell the proxy to connect to. This is usually * something like 6667. Basically any client-usable port. */ target_port = 6667; /* * Target string we check for in the data read back by the scanner. * This should be some string out of the data that your ircd usually * sends on connect. The example below will work on most * hybrid/bahamut ircds. Multiple target strings are allowed. * * NOTE: Try to keep the number of target strings to a minimum. Two * should be fine. One for normal connections and one for throttled * connections. Comment out any others for efficiency. */ /* Usually first line sent to client on connection to ircd. * If your ircd supports a more specific line (see below), * using it will reduce false positives. */ target_string = "*** Looking up your hostname..."; /* Some ircds give a source for the NOTICE AUTH (bahamut for example). * It is recommended you use the following instead of the generic * "*** Looking up your hostname..." if your ircd supports it. * This will reduce the chances of false positives. */ # target_string = ":server.yournetwork.org NOTICE AUTH :*** Looking up your hostname..."; /* If you try to connect too fast, you'll be throttled by your own * ircd. Here's what a hybrid throttle message looks like: */ target_string = "ERROR :Trying to reconnect too fast."; /* And the same for bahamut (comment this out if you're not using bahamut): */ target_string = "ERROR :Your host is trying to (re)connect too fast -- throttled."; }; scanner { name = "extended"; protocol = HTTP:81; protocol = HTTP:8000; protocol = HTTP:8001; protocol = HTTP:8081; protocol = HTTPPOST:81; protocol = HTTPPOST:6588; protocol = HTTPPOST:4480; protocol = HTTPPOST:8000; protocol = HTTPPOST:8001; protocol = HTTPPOST:8080; protocol = HTTPPOST:8081; protocol = SOCKS4:4914; protocol = SOCKS4:6826; protocol = SOCKS4:7198; protocol = SOCKS4:7366; protocol = SOCKS4:9036; protocol = SOCKS5:4438; protocol = SOCKS5:5104; protocol = SOCKS5:5113; protocol = SOCKS5:5262; protocol = SOCKS5:5634; protocol = SOCKS5:6552; protocol = SOCKS5:6561; protocol = SOCKS5:7464; protocol = SOCKS5:7810; protocol = SOCKS5:8130; protocol = SOCKS5:8148; protocol = SOCKS5:8520; protocol = SOCKS5:8814; protocol = SOCKS5:9100; protocol = SOCKS5:9186; protocol = SOCKS5:9447; protocol = SOCKS5:9578; fd = 400; /* If required you can add settings such as target_ip here * they will override the defaults set in the first scanner * for this and subsequent scanners defined in the config file * This affects the following options: * fd, vhost, target_ip, target_port, target_string, timeout and * max_read. */ }; /* * User blocks define what scanners will be used to scan which hostmasks. When * a user connects they will be scanned on every scanner {} (above) that * matches their host. */ user { /* * Users matching this host mask will be scanned with all the * protocols in the scanner named. */ mask = "*!*@*"; scanner = "default"; }; user { /* Connections without ident will match on a vast number of connections * very few proxies run ident though */ # mask = "*!~*@*"; mask = "*!squid@*"; mask = "*!nobody@*"; mask = "*!www-data@*"; mask = "*!cache@*"; mask = "*!CacheFlowS@*"; mask = "*!*@*www*"; mask = "*!*@*proxy*"; mask = "*!*@*cache*"; scanner = "extended"; }; /* * Exempt hosts matching certain strings from any form of scanning or dnsbl. * BOPM will check each string against both the hostname and the IP address of * the user. * * There are very few valid reasons to actually use "exempt". BOPM should * never get false positives, and we would like to know very much if it does. * One possible scenario is that the machine BOPM runs from is specifically * authorized to use certain hosts as proxies, and users from those hosts use * your network. In this case, without exempt, BOPM will scan these hosts, * find itself able to use them as proxies, and ban them. */ exempt { mask = "*!*@127.0.0.1"; };