0

I've been getting complaints on my VPS regarding attacks on different servers such as this message:

your Server/Customer with the IP: 1xx.2xx.4x.9x (1xx.2xx.4x.9x) has attacked one of our servers/partners. The attackers used the method/service: mail on: Mon, 02 May 2016 09:11:16 +1000. The time listed is from the server-time of the Blocklist-user who submitted the report. The attack was reported to the Blocklist.de-System on: Mon, 02 May 2016 01:13:41 +0200

I'm curious as to the reason this occurred firstly as I am using the server as a SOCKS5 proxy privately. The only command I entered was this:

ssh -f -N -D 0.0.0.0:1080 localhost

So my question is how is my server attacking other servers with a default setup?

(My password was generated randomly on a website with a client-side password generator, it is 16 characters long)

I'm aware that I could install ufw, but would I need to strictly block ports incoming and outgoing except port 1080 and 22?

  • There is not enough information in that message to determine what may be going on. You can certainly review your system logs around that time, perhaps you will find something. – Michael Hampton May 2 '16 at 0:08
  • Are you running a mail server? Did you change any of its settings? Who has access to your SOCKS5 proxy? Are you sure none of those people are spammers? – David Schwartz May 2 '16 at 2:13
5

You're setting up your SSH SOCKS proxy by SSH'ing to the local machine, and telling it to listen on the unspecified address (0.0.0.0), which translates to ALL IP addresses.

If you're not configuring a firewall to control access to port 1080, then you've just set up an open proxy for anyone to (ab)use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.