Unreal 3.2 not detecting the connections
[email protected] Wed, 22 Jul 2009 02:24:33 -0400
| Newsgroups | gmane.network.irc.bopm |
|---|---|
| Message-ID | <[email protected]> |
Hi.
I am using Unreal 3.2 and its not detecting the connections. Can you =20
please tell me how I can fix this problem?
Thanks
Phil
Unreal3.2.8.1.
bopm.conf
[phil@taylorassociate etc]$ more bopm.conf
/*
BOPM sample configuration
*/
options {
/*
* Full path and filename for storing the process ID of the running
* BOPM.
*/
=09pidfile =3D "/home/phil/bopm/bopm.pid";
=09/*
=09 * How many seconds to store the IP address of hosts which are
=09 * confirmed (by previous scans) to be secure. New users from these
=09 * IP addresses will not be scanned again until this amount of time
=09 * has passed. IT IS STRONGLY RECOMMENDED THAT YOU DO NOT USE THIS
=09 * DIRECTIVE, but it is provided due to demand.
=09 *
=09 * The main reason for not using this feature is that anyone capable
=09 * of running a proxy can get abusers onto your network - all they
=09 * need do is shut the proxy down, connect themselves, restart the
=09 * proxy, and tell their friends to come flood.
=09 *
=09 * Keep this directive commented out to disable negative caching.
=09 */
#=09negcache =3D 3600;
=09/*
=09 * Amount of file descriptors to allocate to asynchronous DNS. 64
=09 * should be plenty for almost anyone - previous versions of BOPM only
=09 * did one at a time!
=09 */
=09dns_fdlimit =3D 64;
=09/*
=09 * Put the full path and filename of a logfile here if you wish to log
=09 * every scan done. Normally BOPM only logs successfully detected
=09 * proxies in the bopm.log, but you may get abuse reports to your ISP
=09 * about portscanning. Being able to show that it was BOPM that did
=09 * the scan in question can be useful. Leave commented for no
=09 * logging.
=09 */
=09scanlog =3D "/home/phil/bopm/scan.log";
};
IRC {
=09/*
=09 * IP to bind to for the IRC connection. You only need to use this if
=09 * you wish BOPM to use a particular interface (virtual host, IP
=09 * alias, ...) when connecting to the IRC server. There is another
=09 * "vhost" setting in the scan {} block below for the actual
=09 * portscans. Note that this directive expects an IP address, not a
=09 * hostname. Please leave this commented out if you do not
=09 * understand what it does, as most people don't need it.
=09 */
=09vhost =3D "74.208.185.33";
=09/*
=09 * Nickname for BOPM to use.
=09 */
=09nick =3D "bopm";
=09/*
=09 * Text to appear in the "realname" field of BOPM's /whois output.
=09 */
=09realname =3D "Blitzed Open Proxy Monitor";
=09/*
=09 * If you don't have an identd running, what username to use.
=09 */
=09username =3D "phil";
=09/*
=09 * Hostname (or IP) of the IRC server which BOPM will monitor
=09 * connections on.
=09 */
=09server =3D "irc.cyberchatnet.com";
=09/*
=09 * Password used to connect to the IRC server (PASS)
=09 */
#=09password =3D "****";
=09/*
=09 * Port of the above server to connect to. This is what BOPM uses to
=09 * get onto IRC itself, it is nothing to do with what ports/protocols
=09 * are scanned, nor do you need to list every port your ircd listens
=09 * on.
=09 */
=09port =3D 5556;
=09/*
=09 * Command to execute to identify to NickServ (if your network uses
=09 * it). This is the raw IRC command text, and the below example
=09 * corresponds to "/msg nickserv identify password" in a client. If
=09 * you don't understand, just edit "password" in the line below to be
=09 * your BOPM's nick password. Leave commented out if you don't need
=09 * to identify to NickServ.
=09 */
#=09nickserv =3D "privmsg nickserv :identify password";
=09/*
=09 * The username and password needed for BOPM to oper up.
=09 */
=09oper =3D "bopm ****";
=09/*
=09 * Mode string that BOPM needs to set on itself as soon as it opers
=09 * up. This needs to include the mode for seeing connection notices,
=09 * otherwise BOPM won't scan anyone (that's usually umode +c). It's
=09 * often also a good idea to remove any helper modes so that users
=09 * don't try to talk to the BOPM.
=09 *
=09 * REMEMBER THAT IRCU AND LATER VERSIONS OF UNREAL DO NOT USE A SIMPLE
=09 * +c !!
=09 */
#=09mode =3D "+c-h";
=09/* Example for Bahamut; +F gives BOPM relaxed flood limits */
#=09mode =3D "+Fc-h";
=09mode =3D "+s +cF";
=09/*
=09 * If this is set then BOPM will use it as an /away message as soon as
=09 * it connects.
=09 */
=09away =3D "I'm a bot. Your messages will be ignored.";
=09/*
=09 * Info about channels you wish BOPM to join in order to accept
=09 * commands. BOPM will also print messages in these channels every
=09 * time it detects a proxy. Only IRC operators can command BOPM to do
=09 * anything, but some of the things BOPM reports to these channels
=09 * could be soncidered sensitive, so it's best not to put BOPM into
=09 * public channels.
=09 */
=09channel {
=09 /*
=09 * Channel name. Local ("&") channels are supported if your ircd
=09 * supports them.
=09 */
=09 name =3D "#bopm";
=09 /*
=09 * If BOPM will need to use a key to enter this channel, this is
=09 * where you specify it.
=09 */
=09 key =3D "Bopm1900";
=09 /*
=09 * If you use ChanServ then maybe you want to set the channel
=09 * invite-only and have each BOPM do "/msg ChanServ invite" to get
=09 * itself in. Leave commented if you don't, or if this makes no
=09 * sense to you.
=09 */
#=09 invite =3D "privmsg chanserv :invite #bopm";
=09};
=09/*
=09 * You can define a bunch of channels if you want:
=09 *
=09 * channel { name =3D "#other"; }; channel { name=3D"#channel"; }
=09 */
=09/*
=09 * connregex is a POSIX regular expression used to parse connection
=09 * (+c) notices from the ircd. The complexity of the expression should
=09 * be kept to a minimum.
=09 *
=09 * Items in order MUST be: nick user host IP
=09 *
=09 * BOPM will not work with ircds which do not send an IP in the
=09 * connection notice.
=09 *
=09 * This is fairly complicated stuff, and the consequences of getting
=09 * it wrong are the BOPM does not scan anyone. Unless you know
=09 * absolutely what you are doing, please just uncomment the example
=09 * below that best matches the type of ircd you use.
=09 *
=09 * !!! NOTE !!! If a connregex for your ircd does not appear here and the
=09 * hybrid connregex does not appear to work, check the BOPM FAQ at
=09 * http://wiki.blitzed.org/BOPM before contacting our lists for help.
=09 *
=09 */
=09/* Hybrid / Bahamut / Unreal (in HCN mode) */
#=09connregex =3D "\\*\\*\\* Notice -- Client connecting: ([^ ]+) =20
\\(([^@]+)@([^\\)]+)\\) \\[([0-9\\.]+)\\].*";
=09connregex =3D "\\*\\*\\* Notice -- Client connecting.*: ([^ ]+) =20
\\(([^@]+)@([^\\)]+)\\) \\[([0-9\\.]+)\\].*";
=09/*
=09 * Ultimate ircd - note the control-B characters around Connect/Exit,
=09 * that is because that text appears in bold in the actual connect
=09 * notice. Be very careful when editing this, do it as you would put
=09 * bold characters into IRC MOTDs.
=09 */
#=09connregex =3D "\\*\\*\\* =02Connect/Exit=02 -- from [^:]+: Client =20
connecting on port [0-9]+: ([^ ]+) \\(([^@]+)@([^\\)
]+)\\) \\[([0-9\\.]+)\\].*";
=09/*
=09 * SorIRCd 1.3.4+ / StarIRCd 5.26+.
=09 */
#=09connregex =3D "\\*\\*\\* Notice -- Client connecting on port [0-9]+: =20
([^ ]+) \\(([^@]+)@([^\\)]+)\\) \\[([0-9\\.
]+)\\].*";
=09/*
=09 * "kline" controls the command used when an open proxy is confirmed.
=09 * We suggest applying a temporary (no more than a few hours) KLINE =20
on the host.
=09 *
=09 * <WARNING>
* Make sure if you need to change this string you also change the
* kline command for every DNSBL you enable below.
=09 *
* Also note that some servers do not allow you to include =20
':' characters
* inside the KLINE message (e.g. for a http:// address).
=09 *
=09 * Users rewriting this message into something that isn't even a valid
=09 * IRC command is the single most common cause of support requests and
=09 * therefore WE WILL NOT SUPPORT YOU UNLESS YOU USE ONE OF THE EXAMPLE
=09 * KLINE COMMANDS BELOW.
=09 * </WARNING>
=09 *
=09 * That said, should you wish to customise this text, several
=09 * printf-like placeholders are available:
=09 *
=09 * %n User's nick
=09 * %u User's username
=09 * %h User's irc hostname
=09 * %i User's IP address
=09 *
=09 */
=09kline =3D "KLINE *@%h :Open Proxy found on your host. Please visit =20
www.blitzed.org/proxy?ip=3D%i for more informat
ion.";
=09/* A GLINE example for IRCu: */
kline =3D "GLINE +*@%i 1800 :Open proxy found on your host. =20
Please visit www.blitzed.org/proxy?ip=3D%i for more inf
ormation.";
/* An AKILL example for services with OperServ
* Your BOPM must have permission to AKILL for this to work! */
# kline =3D "PRIVMSG OpenServ :AKILL +3h *@%h Open proxy found on =20
your host. Please visit www.blitzed.org/proxy?ip
=3D%i for more information.";
=09/*
=09 * Text to send on connection, these can be stacked and will be sent =20
in this order
=09 *
=09 * !!! UNREAL USERS PLEASE NOTE !!!
=09 * Unreal users will need PROTOCTL HCN to force hybrid connect
=09 * notices.
=09 *
=09 * Yes Unreal users! That means you! That means you need the line
=09 * below! See that thing at the start of the line? That's what we
=09 * call a comment! Remove it to UNcomment the line.
=09 */
perform =3D "PROTOCTL HCN";
};
/*
* OPM Block defines blacklists and information required to report new prox=
ies
* to a dns blacklist. DNS-based blacklists store IP addresses in a DNS zo=
ne
* file. There are several blacklist that list IP addresses known to be ope=
n
* proxies or other forms of IRC abuse. By checking against these blacklist=
s,
* BOPMs are able to ban known sources of abuse without completely =20
scanning them.
*/
OPM {
=09/*
=09 * Blacklist zones to check IPs against. If you would rather not
=09 * trust a remotely managed blacklist, you could set up your own, or
=09 * leave these commented out in which case every user will be
=09 * scanned. The use of at least one open proxy DNSBL is recommended
* however.
*
* Blitzed is not associated with any of these DNSBLs, please check
* the policies of each blacklist you use to check you are comforta=
ble
* with using them to block access to your server (and that you are
* allowed to use them).
=09 */
/* DroneBL - http://dronebl.org */
=09blacklist {
=09 /* The DNS name of the blacklist */
=09 name =3D "dnsbl.dronebl.org";
#
#=09 /*
#=09 * There are only two values that are valid for this
#=09 * "A record bitmask" and "A record reply"
#=09 * These options affect how the values specified to reply
#=09 * below will be interpreted, a bitmask is where the reply
#=09 * values are 2^n and more than one is added up, a reply is
#=09 * simply where the last octet of the IP is that number.
#=09 * If you are not sure then the values set for dnsbl.dronebl.org
#=09 * will work without any changes.
#=09 */
#=09 type =3D "A record reply";
#
#=09 /* Kline types not listed in the reply list below.
# *
#=09 * For DNSBLs that are not IRC specific and you just wish to kline
# * certain types this can be disabled.
#=09 */
=09 ban_unknown =3D yes;
=09 /* The actual values returned by the dnsbl.dronebl.org blacklist
=09 * As documented at http://www.dronebl.org/howtouse.do */
=09 reply {
2 =3D "Sample";
3 =3D "IRC Drone";
4 =3D "Tor";
5 =3D "Bottler";
6 =3D "Unknown spambot or drone";
7 =3D "DDOS Drone";
8 =3D "SOCKS Proxy";
9 =3D "HTTP Proxy";
10 =3D "ProxyChain";
255 =3D "Unknown";
=09 };
=09 /* The kline message sent for this specific blacklist, remember to put
=09 * the removal method in this.
=09 */
=09 kline =3D "KLINE *@%h :You have a host listed in the DroneBL. For =20
more information, visit http://dronebl.org/
lookup_branded.do?ip=3D%i&network=3DNetwork";
=09};
/* ircbl.ahbl.org - see http://ahbl.org/docs/ircbl
* http://oldwww.temp.ahbl.org/docs/ircbl.php */
blacklist {
name =3D "ircbl.ahbl.org";
type =3D "A record reply";
ban_unknown =3D no;
reply {
2 =3D "Open proxy";
};
kline =3D "KLINE *@%h :Listed in ircbl.ahbl.org. See =20
http://ahbl.org/removals";
};
/* tor.dnsbl.sectoor.de - http://www.sectoor.de/tor.php */
blacklist {
name =3D "tor.dnsbl.sectoor.de";
type =3D "A record reply";
reply {
1 =3D "Tor exit server";
};
ban_unknown =3D no;
kline =3D "KLINE *@%h :Tor exit server detected. See =20
www.sectoor.de/tor.php?ip=3D%i";
};
/* rbl.efnet.org - http://rbl.efnet.org/ */
blacklist {
name =3D "rbl.efnet.org";
type =3D "A record reply";
reply {
1 =3D "Open proxy";
2 =3D "Trojan spreader";
3 =3D "Trojan infected client";
4 =3D "TOR exit server";
5 =3D "Drones / Flooding";
};
ban_unknown =3D yes;
kline =3D "KLINE *@%h :Listed in rbl.efnet.org. See =20
rbl.efnet.org/?i=3D%i";
};
=09/* example: NJABL - please read http://www.njabl.org/use.html before
=09 * uncommenting */
=09 blacklist {
=09 name =3D "dnsbl.njabl.org";
=09 type =3D "A record reply";
=09 reply {
=09 9 =3D "Open proxy";
=09 };
=09 ban_unknown =3D no;
=09 kline =3D "KLINE *@%h :Open proxy found on your host, please visit =
=20
www.njabl.org/cgi-bin/lookup.cgi?query=3D%i
";
=09};
=09/*
=09 * You can report the insecure proxies you find to a DNSBL also!
=09 * The remaining directives in this section are only needed if you
=09 * intend to do this. Reports are sent by email, one email per IP
=09 * address. The format does support multiple addresses in one email,
=09 * but we don't know of any servers that are detecting enough insecure
=09 * proxies for this to be really necessary.
=09 */
=09/*
=09 * Email address to send reports FROM. If you intend to send reports,
=09 * please pick an email address that we can actually send mail to
=09 * should we ever need to contact you.
=09 */
#=09dnsbl_from =3D "[email protected]";
=09/*
=09 * Email address to send reports TO.
* For example DroneBL:
=09 */
#=09dnsbl_to =3D "[email protected]";
=09/*
=09 * Full path to your sendmail binary. Even if your system does not
=09 * use sendmail, it probably does have a binary called "sendmail"
=09 * present in /usr/sbin or /usr/lib. If you don't set this, no
=09 * proxies will be reported.
=09 */
#=09sendmail =3D "/usr/sbin/sendmail";
};
/*
* The short explanation:
*
* This is where you define what ports/protocols to check for. You can hav=
e
* multiple scanner blocks and then choose which users will get scanned by
* which scanners further down.
*
* The long explanation:
*
* Scanner defines a virtual scanner. For each user being scanned, a scann=
er
* will use a file descriptor (and subsequent connection) for each protocol=
.
* Once connecting it will negotiate the proxy to connect to
* target_ip:target_port (target_ip MUST be an IP).
*
* Once connected, any data passed through the proxy will be checked to see=
if
* target_string is contained within that data. If it is the proxy is
* considered open. If the connection is closed at any point before
* target_string is matched, or if at least max_read bytes are read from th=
e
* connection, the negotiation is considered failed.
*/
scanner {
=09/*
=09 * Unique name of this scanner. This is used further down in the
=09 * user {} blocks to decide which users get affected by which
=09 * scanners.
=09 */
=09name=3D"default";
=09/*
=09 * HTTP CONNECT - very common proxy protocol supported by widely known
=09 * software such as Squid and Apache. The most common sort of
=09 * insecure proxy and found on a multitude of weird ports too. Offers
=09 * transparent two way TCP connections.
=09 */
=09protocol =3D HTTP:80;
=09protocol =3D HTTP:8080;
=09protocol =3D HTTP:3128;
=09protocol =3D HTTP:6588;
=09/*
=09 * SOCKS4/5 - well known proxy protocols, probably the second most
=09 * common for insecure proxies, also offers transparent two way TCP
=09 * connections. Fortunately largely confined to port 1080.
=09 */
=09protocol =3D SOCKS4:1080;
=09protocol =3D SOCKS5:1080;
=09/*
=09 * Cisco routers with a default password (yes, it really does happen).
=09 * Also pretty much anything else that will let you telnet to anywhere
=09 * else on the internet. Fortunately these are always on port 23.
=09 */
=09protocol =3D ROUTER:23;
=09/*
=09 * WinGate is commercial windows proxy software which is now not so
=09 * common, but still to be found, and helpfully presents an interface
--More--(68%)
I have this set in the conf file
perform =3D "PROTOCTL HCN";
Here is the ircd.conf
oper bopm {
class me;
from {
userhost *@74.208.185.33;
};
password "****";
flags
{
netadmin;
services-admin;
can_gkline;
global;
can_rehash;
can_die;
can_wallops;
can_globops;
can_localroute;
can_globalroute;
can_localkill;
can_globalkill;
can_kline;
can_zline;
can_unkline;
can_localnotice;
can_globalnotice;
can_zline;
get_umodew;
get_host;
can_override;
};
snomask +c+F;
};