I've been getting complaints on my VPS regarding attacks on different servers such as this message:
your Server/Customer with the IP: 1xx.2xx.4x.9x (1xx.2xx.4x.9x) has attacked one of our servers/partners. The attackers used the method/service: mail on: Mon, 02 May 2016 09:11:16 +1000. The time listed is from the server-time of the Blocklist-user who submitted the report. The attack was reported to the Blocklist.de-System on: Mon, 02 May 2016 01:13:41 +0200
I'm curious as to the reason this occurred firstly as I am using the server as a SOCKS5 proxy privately. The only command I entered was this:
ssh -f -N -D 0.0.0.0:1080 localhost
So my question is how is my server attacking other servers with a default setup?
(My password was generated randomly on a website with a client-side password generator, it is 16 characters long)
I'm aware that I could install ufw, but would I need to strictly block ports incoming and outgoing except port 1080 and 22?