| 2 |
|
------------ |
| 3 |
|
|
| 4 |
|
HOPM (Hybrid Open Proxy Monitor) is an open proxy monitoring bot designed for |
| 5 |
< |
Hybrid based ircds. The bot is designed to monitor an individual server (all |
| 5 |
> |
Hybrid based ircds. The bot is designed to monitor an individual server (all |
| 6 |
|
servers on the network have to run their own bot) with a local operator {} |
| 7 |
< |
block and monitor connections. When a client connects to the server, HOPM will |
| 8 |
< |
scan the connection for insecure proxies. Insecure proxies are determined by |
| 7 |
> |
block and monitor connections. When a client connects to the server, HOPM will |
| 8 |
> |
scan the connection for insecure proxies. Insecure proxies are determined by |
| 9 |
|
attempting to connect the proxy back to another host (usually the IRC server in |
| 10 |
|
question). |
| 11 |
|
|
| 12 |
< |
HOPM is written ground-up in C language, concept derived from wgmon. It |
| 12 |
> |
HOPM is written ground-up in C language, concept derived from wgmon. It |
| 13 |
|
improves on wgmon with HTTP support, faster scanning (it can scan clients |
| 14 |
|
simultaneously), better layout (scalability), and dnsbl support. |
| 15 |
|
|
| 20 |
|
o An IRCd which presents connection notices in a format which HOPM |
| 21 |
|
recognises (see below). |
| 22 |
|
|
| 23 |
< |
o A host with full connectivity for all the ports you wish to scan. i.e. is |
| 23 |
> |
o A host with full connectivity for all the ports you wish to scan. i.e. is |
| 24 |
|
NOT transparently proxied -- many domestic internet connections have port 80 |
| 25 |
|
transparently proxied and this produces completely unpredictable results, |
| 26 |
|
sometimes as severe as 100% of clients being K:lined! |
| 35 |
|
|
| 36 |
|
ircd-hybrid 8.2.1 |
| 37 |
|
|
| 38 |
< |
HOPM is designed for ircd-hybrid based ircds. It is easily suitable for any |
| 38 |
> |
HOPM is designed for ircd-hybrid based ircds. It is easily suitable for any |
| 39 |
|
other ircd with little modification (connregex in hopm.conf). However, if an |
| 40 |
|
ircd does not send IP addresses in a connection notice, HOPM will not be |
| 41 |
|
effective because the time it takes to resolve a hostname would be a |
| 45 |
|
Command Line Options |
| 46 |
|
-------------------- |
| 47 |
|
|
| 48 |
< |
-c <name> Config name. By default HOPM reads hopm.conf, "-c foo" |
| 49 |
< |
will cause HOPM to read foo.conf. The primary use for |
| 48 |
> |
-c <name> Config name. By default HOPM reads hopm.conf, "-c foo" |
| 49 |
> |
will cause HOPM to read foo.conf. The primary use for |
| 50 |
|
this is to run multiple HOPMs from one directory. |
| 51 |
|
|
| 52 |
< |
-d Debug mode. HOPM will not fork, and will write logs to stderr. |
| 52 |
> |
-d Debug mode. HOPM will not fork, and will write logs to stderr. |
| 53 |
|
Multiple -d increase debug level. |
| 54 |
|
|
| 55 |
|
|
| 80 |
|
------- |
| 81 |
|
|
| 82 |
|
Once started, HOPM logs all significant events to a file called "hopm.log" |
| 83 |
< |
which by default can be found at $HOME/hopm/var/hopm.log. There is also a |
| 83 |
> |
which by default can be found at $HOME/hopm/var/hopm.log. There is also a |
| 84 |
|
config option to log all proxy scans initiated, which can be quite useful if |
| 85 |
|
you receive an abuse report related to portscanning. |
| 86 |
|
|
| 87 |
< |
These log files, especially the scan log, can grow quite large. It is |
| 88 |
< |
suggested that you arrange for these files to be rotated periodically. An |
| 89 |
< |
example shell script is provided in the contrib/logrotate directory. If you |
| 87 |
> |
These log files, especially the scan log, can grow quite large. It is |
| 88 |
> |
suggested that you arrange for these files to be rotated periodically. An |
| 89 |
> |
example shell script is provided in the contrib/logrotate directory. If you |
| 90 |
|
prefer to use the log rotation facilities of your operating system then you |
| 91 |
|
should send a USR1 signal to HOPM after moving its logfiles - this will cause |
| 92 |
|
HOPM to reopen those files. |
