freebsd at tango.lu
2020-Nov-02 07:15 UTC
FreeBSD disable any automated outgoing connections
Hello, I have these connections 4-5 am in the morning going to bytemark, cloudfare and other cloud providers: - Connections 2.0 - Payload 5.0k - Ports | Sources | Destinations | Services | Protocols | States | 443 100.0% | 192.168.1.5#1 100.0% | 104.16.45.99#2 50.0% | - 100.0% | 6 100.0% | SHR 100.0% | | | 104.16.44.99#3 50.0% | | | | This machine is an IDS it should never make outgoing connections ever. How to disable this? I have found some older mail on the list that it is some package checksum verification in periodic.conf I disabled it didn't work so I have changed the ServerName from update.FreeBSD.org to 127.0.0.1 in /etc/freebsd-update.conf something still tries to connect out.
On Nov 2, 2020, at 2:15 AM, freebsd at tango.lu wrote:> Hello, > > I have these connections 4-5 am in the morning going to bytemark, cloudfare and other cloud providers: > > - Connections 2.0 - Payload 5.0k - > Ports | Sources | Destinations | Services | Protocols | States | > 443 100.0% | 192.168.1.5#1 100.0% | 104.16.45.99#2 50.0% | - 100.0% | 6 100.0% | SHR 100.0% | > | | 104.16.44.99#3 50.0% | | | | >This is likely to be the /etc/periodic/daily/480.leapfile-ntpd daily periodic job. It checks for an updated NTP leapfile from $ntp_leapfile_sources. This periodic job defaults to "YES" in /etc/defaults/rc.conf and the default for $ntp_leapfile_sources is "https://www.ietf.org/timezones/data/leap-seconds.list". A current DNS lookup of www.ietf.org shows it uses the Cloudflare CDN.> This machine is an IDS it should never make outgoing connections ever. How to disable this?You might set "daily_ntpd_leapfile_enable=NO" in your local periodic.conf file to override the default. Alternatively, if you have a strict rule that the machine should not initiate any outbound connections, you could add a firewall rule dropping any such traffic originating there (i.e., not belonging to an established connection) going out on the external ("WAN") interface. Cheers, Paul.