I've been running a Tor node for a couple of days (until I hit my bandwidth limit and got charged lots more), now I'm blacklisted by Spamhaus.

I decided not to run as an exit node by commenting #ExitPolicy accept *:*, however on Aug 9th I got blacklisted and can't send email to almost anyone around the globe. My server has no open relay and I ran every kind of test possible.

The only list that currently lists me is CBL:

This IP is infected with, or is NATting for a machine infected with s_ddos_dirtjumper

 Note: If you wish to look up this bot name via the web, remove the "s_" before you do your search.

This was detected by observing this IP attempting to make contact to a s_ddos_dirtjumper Command and Control server, with contents unique to s_ddos_dirtjumper C&C command protocols.

To find these infections, search for TCP/IP connections going to IP address or, usually destination port 80 or 443, but you should look for all ports.

These infections are rated as a "severe threat" by Microsoft. It is a trojan downloader, and can download and execute ANY software on the infected computer.

You will need to find and eradicate the infection before delisting the IP address. 

Reading the description, it looks like somebody was using Tor to anonymize that botnet's traffic and used my node as exit.

The problem is that I commented the ExitPolicy accept line, so I should be only relaying traffic internal to the Tor network.

My machine shouldn't be infected because it runs Linux and SSH is well secured.

What could be the problem? Is Tor my configuration wrong?

closed as off topic by Sven, Tim Brigham, user62491, EEAA, Michael Hampton Aug 13 '12 at 21:11

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.


From the documentation:

The default exit policy allows access to many popular services (e.g. web browsing), but restricts some due to abuse potential (e.g. mail) and some since the Tor network can't handle the load (e.g. default file-sharing ports).

To run a pure relay (i.e. no exits) you need to explicitly deny this:

ExitPolicy reject *:*
  1. This is off-topic here. SF is for pro admins, and a pro admin wouldn't run a tor node on a production machine, for the exact reason you experience right now.

  2. What makes you think that just commenting out a config file line will create the behaviour you want? A short read about ExitPolicies told me the default is to allow quite a lot of stuff. If you want to disallow, you need reject statements.

  3. My machine shouldn't be infected because it runs Linux and SSH is well secured. Really? Are you serious?

  • Part 2 partially explains the problem. I had all of the other reject statements, that line was only the final (I should rephrase). I believed that Tor policies were restrictive (if you don't allow, it's rejected), perhaps it's not so. And, please mind that in part 3 I said "should". I gathered some information and this trojan looks like being for Windows. Second, I know that often servers get hijacked via SSH. I did some checks and I believe I haven't been. – usr-local-ΕΨΗΕΛΩΝ Aug 13 '12 at 18:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.