From owner-freebsd-stable@freebsd.org Mon Nov 9 15:54:44 2020 Return-Path: Delivered-To: freebsd-stable@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 37A164668E1 for ; Mon, 9 Nov 2020 15:54:44 +0000 (UTC) (envelope-from paul@gromit.dlib.vt.edu) Received: from gromit.dlib.vt.edu (gromit.dlib.vt.edu [128.173.49.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "gromit.dlib.vt.edu", Issuer "Chumby Certificate Authority" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4CVFtW462Lz3FT4 for ; Mon, 9 Nov 2020 15:54:43 +0000 (UTC) (envelope-from paul@gromit.dlib.vt.edu) Received: from mather.gromit23.net (unknown [73.99.214.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by gromit.dlib.vt.edu (Postfix) with ESMTPSA id ED6341A9; Mon, 9 Nov 2020 10:54:42 -0500 (EST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.4\)) Subject: Re: FreeBSD disable any automated outgoing connections From: Paul Mather In-Reply-To: <06ef76eeff11b6bd6c0964dbf8256d40@tango.lu> Date: Mon, 9 Nov 2020 10:54:42 -0500 Cc: freebsd-stable@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <06ef76eeff11b6bd6c0964dbf8256d40@tango.lu> To: freebsd@tango.lu X-Mailer: Apple Mail (2.3608.120.23.2.4) X-Rspamd-Queue-Id: 4CVFtW462Lz3FT4 X-Spamd-Bar: - Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=fail reason="No valid SPF, No valid DKIM" header.from=vt.edu (policy=none); spf=none (mx1.freebsd.org: domain of paul@gromit.dlib.vt.edu has no SPF policy when checking 128.173.49.70) smtp.mailfrom=paul@gromit.dlib.vt.edu X-Spamd-Result: default: False [-1.06 / 15.00]; RCVD_TLS_ALL(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; FREEFALL_USER(0.00)[paul]; FROM_HAS_DN(0.00)[]; RBL_DBL_DONT_QUERY_IPS(0.00)[128.173.49.70:from]; MV_CASE(0.50)[]; MID_RHS_MATCH_FROM(0.00)[]; MIME_GOOD(-0.10)[text/plain]; TO_DN_NONE(0.00)[]; ARC_NA(0.00)[]; NEURAL_SPAM_SHORT(0.44)[0.438]; SPAMHAUS_ZRD(0.00)[128.173.49.70:from:127.0.2.255]; RECEIVED_SPAMHAUS_PBL(0.00)[73.99.214.146:received]; TO_MATCH_ENVRCPT_SOME(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; RCPT_COUNT_TWO(0.00)[2]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; R_SPF_NA(0.00)[no SPF record]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:1312, ipnet:128.173.0.0/16, country:US]; RCVD_COUNT_TWO(0.00)[2]; MAILMAN_DEST(0.00)[freebsd-stable]; DMARC_POLICY_SOFTFAIL(0.10)[vt.edu : No valid SPF, No valid DKIM,none] X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Nov 2020 15:54:44 -0000 On Nov 2, 2020, at 2:15 AM, freebsd@tango.lu wrote: > Hello, >=20 > I have these connections 4-5 am in the morning going to bytemark, = cloudfare and other cloud providers: >=20 > - Connections 2.0 - Payload 5.0k - > Ports | Sources | Destinations = | Services | Protocols | States | > 443 100.0% | 192.168.1.5#1 100.0% | 104.16.45.99#2 = 50.0% | - 100.0% | 6 100.0% | SHR 100.0% | > | | 104.16.44.99#3 = 50.0% | | | | >=20 This is likely to be the /etc/periodic/daily/480.leapfile-ntpd daily = periodic job. It checks for an updated NTP leapfile from = $ntp_leapfile_sources. This periodic job defaults to "YES" in = /etc/defaults/rc.conf and the default for $ntp_leapfile_sources is = "https://www.ietf.org/timezones/data/leap-seconds.list". A current DNS = lookup of www.ietf.org shows it uses the Cloudflare CDN. > This machine is an IDS it should never make outgoing connections ever. = How to disable this? You might set "daily_ntpd_leapfile_enable=3DNO" in your local = periodic.conf file to override the default. Alternatively, if you have a strict rule that the machine should not = initiate any outbound connections, you could add a firewall rule = dropping any such traffic originating there (i.e., not belonging to an = established connection) going out on the external ("WAN") interface. Cheers, Paul.