ViewVC Help

View File | Revision Log | Show Annotations | View Changeset | Root Listing

root/svn/hopm/trunk/README

Comparing hopm/trunk/README (file contents):
Revision 5655 by michael, Sun Mar 8 14:21:04 2015 UTC vs.
Revision 6985 by michael, Fri Dec 25 20:15:06 2015 UTC

#	Line 1 | Line 1
1		Introduction
2	<	------------
2	>	============
3
4	<	HOPM (Hybrid Open Proxy Monitor) is an open proxy monitoring bot designed for
5	<	Hybrid based ircds. The bot is designed to monitor an individual server (all
6	<	servers on the network have to run their own bot) with a local operator {}
7	<	block and monitor connections. When a client connects to the server, HOPM will
8	<	scan the connection for insecure proxies. Insecure proxies are determined by
9	<	attempting to connect the proxy back to another host (usually the IRC server in
10	<	question).
4	>	HOPM (Hybrid Open Proxy Monitor) is an open-proxy monitoring bot designed to
5	>	monitor an individual server (all servers on the network have to run their own
6	>	bot if the IRCD does not support `farconnect` user mode) with a local
7	>	operator {} block and monitor connections. When a client connects to a server,
8	>	HOPM will scan the connection for insecure proxies. Insecure proxies are
9	>	determined by attempting to connect the proxy back to another host (usually the
10	>	IRC server in question).
11
12	<	HOPM is written ground-up in C language, concept derived from wgmon. It
12	>	HOPM is written ground-up in C language and it is an improved fork of BOPM
13	>	(blitzed open proxy monitor), which is a concept derived from wgmon. It
14		improves on wgmon with HTTP support, faster scanning (it can scan clients
15	<	simultaneously), better layout (scalability), and dnsbl support.
15	>	simultaneously), better layout (scalability) and DNSBL support.
16
17
18		Requirements
19	<	------------
19	>	============
20
21	<	o An IRCd which presents connection notices in a format which HOPM
21	<	recognises (see below).
21	>	* An IRCD, which presents connection notices in a format, which HOPM recognizes;
22
23	<	o A host with full connectivity for all the ports you wish to scan. i.e. is
24	<	NOT transparently proxied -- many domestic internet connections have port 80
25	<	transparently proxied and this produces completely unpredictable results,
26	<	sometimes as severe as 100% of clients being K:lined!
23	>	* A host with full connectivity for all the ports you wish to scan. i.e. is NOT
24	>	transparently proxied -- many domestic Internet connections have port 80
25	>	transparently proxied and this produces completely unpredictable results,
26	>	sometimes as severe as 100% of clients being K:lined;
27
28	<	o A unix OS with GNU Make, a C99 compiler, etc..
28	>	* A UNIX OS with GNU make, a C99 compiler, etc.;
29
30	<	o Permission from your users to portscan them for open proxies.
30	>	* Permission from your users to portscan them for open proxies.
31
32
33		Compatibility
34	<	-------------
34	>	=============
35
36	<	ircd-hybrid 8.2.x
37	<	ircd-ratbox 3.0.x
38	<	InspIRCd 2.0.x
39	<	UnrealIRCd 3.2.x
40	<	ngIRCd 22
41	<	Bahamut 2.0.x
42	<	Charybdis 3.4.x
43	<
44	<	HOPM is designed for ircd-hybrid based ircds. It is easily suitable for any
45	<	other ircd with little modification (connregex in hopm.conf). However, if an
46	<	ircd does not send IP addresses in a connection notice, HOPM will not be
47	<	effective because the time it takes to resolve a hostname would be a
48	<	significant factor to HOPM's efficiency.
49	<
50	<
51	<	Command Line Options
52	<	--------------------
53	<
54	<	-c <name>       Config name. By default HOPM reads hopm.conf, "-c foo"
55	<	will cause HOPM to read foo.conf. The primary use for
56	<	this is to run multiple HOPMs from one directory.
36	>	* ircd-hybrid 8.2.x
37	>	* ircd-ratbox 3.0.x
38	>	* ircu 2.10.x
39	>	* InspIRCd 2.0.x
40	>	* UnrealIRCd 3.2.x, 4.0.0
41	>	* ngIRCd 22
42	>	* Bahamut 2.0.x
43	>	* Charybdis 3.4.x
44	>
45	>	HOPM is easily suitable for any other IRCD with little modification (`connregex`
46	>	in hopm.conf). However, if an IRCD does not send IP addresses in a connection
47	>	notice, HOPM will not work.
48	>
49	>
50	>	Command-line options
51	>	====================
52	>
53	>	`-c <name>`     Configuration filename. By default, HOPM reads hopm.conf,
54	>	`-c foo` will cause HOPM to read foo.conf. The primary use for
55	>	this is to run multiple HOPM from one directory.
56
57	<	-d              Debug mode. HOPM will not fork, and will write logs to stderr.
57	>	`-d`            Debug mode. HOPM will not fork and will write logs to stderr.
58		Multiple -d increase debug level.
59
60
61	<	Operator Channel Commands
62	<	-------------------------
61	>	Operator channel commands
62	>	=========================
63
64	<	botnick check <host> [scanner]  -- Manually scan host for insecure proxies and output all errors.
65	<	If scanner is not given, HOPM will scan on all scanners.
66	<	NOTE: this will NOT add a kline (or whatever) if it finds a
67	<	proxy.
64	>	`<bot> check <host> [scanner]`  Manually scans host for insecure proxies and
65	>	outputs all errors. If scanner is not given,
66	>	HOPM will scan on all scanners.NOTE: this will
67	>	NOT add a kline if it finds a proxy.
68
69	<	botnick stats                   -- Output scan stats, uptime and client connection count.
69	>	`<bot> stats`                   Outputs scan stats, uptime and connection count.
70
71	<	botnick fdstat                  -- Output some into about file descriptors in use.
71	>	`<bot> fdstat`                  Outputs info about file descriptors in use.
72
73	<	Also if several HOPMs are present in one channel they will all respond to !all,
74	<	for example !all stats.
73	>	Also, if several HOPM are present in one channel, they will all respond to !all,
74	>	for example `!all stats`.
75
76
77		Rehashing HOPM
78	<	--------------
78	>	==============
79
80	<	A /kill to HOPM will cause the process to restart, rehashing the configuration file
81	<	and ending all queued scans.
80	>	A /quote KILL on HOPM will cause the process to restart, rehashing the
81	>	configuration file and ending all queued scans.
82
83
84		Logging
85	<	-------
85	>	=======
86
87	<	Once started, HOPM logs all significant events to a file called "hopm.log"
88	<	which by default can be found at $HOME/hopm/var/hopm.log. There is also a
89	<	config option to log all proxy scans initiated, which can be quite useful if
90	<	you receive an abuse report related to portscanning.
91	<
92	<	These log files, especially the scan log, can grow quite large. It is
93	<	suggested that you arrange for these files to be rotated periodically. An
94	<	example shell script is provided in the contrib/logrotate directory. If you
95	<	prefer to use the log rotation facilities of your operating system then you
96	<	should send a USR1 signal to HOPM after moving its logfiles - this will cause
97	<	HOPM to reopen those files.
98	<
99	<
100	<	Support
101	<	-------
102	<
103	<	* Bug Reports:
104	<	- bugs@ircd-hybrid.org
105	<	* IRC contact:
106	<	- #ircd-coders on irc.ircd-hybrid.org
87	>	Once started, HOPM logs all significant events to a file called `hopm.log`,
88	>	which by default can be found at `$HOME/hopm/var/hopm.log`. There is also a
89	>	configuration option, `scanlog`, to log all proxy scans initiated, which can be
90	>	quite useful if you receive an abuse report related to portscanning.
91	>
92	>	These log files, especially the scan.log, can grow quite large. It is suggested
93	>	that you arrange for these files to be rotated periodically. You should send a
94	>	`USR1` signal to HOPM after moving its logfiles -- this will cause HOPM to
95	>	reopen those files.
96	>
97	>
98	>	Contact information
99	>	===================
100	>
101	>	* Bug reports: bugs@ircd-hybrid.org
102	>	* IRC: #ircd-coders on irc.ircd-hybrid.org
103	>	* GitHub: https://github.com/ircd-hybrid/hopm
104	>
105	>	Anonymous SVN access is also available:
106	>	Devel: `svn co svn://svn.ircd-hybrid.org/svnroot/hopm/trunk`
107	>	Stable branch (1.1.x): `svn co svn://svn.ircd-hybrid.org/svnroot/hopm/branches/1.1.x`

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines (old)
>	Changed lines (new)