On Nov 2, 2020, at 2:15 AM, free...@tango.lu wrote:
> Hello,
>
> I have these connections 4-5 am in the morning going to bytemark, cloudfare
> and other cloud providers:
>
> - Connections 2.0 - Payload 5.0k -
> Ports| Sources | Destinations |
> Services | Protocols | States|
> 443 100.0% | 192.168.1.5#1100.0% | 104.16.45.99#2 50.0% |
> - 100.0% | 6 100.0% | SHR100.0% |
> | | 104.16.44.99#3 50.0% |
> | | |
>
This is likely to be the /etc/periodic/daily/480.leapfile-ntpd daily periodic
job. It checks for an updated NTP leapfile from $ntp_leapfile_sources. This
periodic job defaults to "YES" in /etc/defaults/rc.conf and the default for
$ntp_leapfile_sources is
"https://www.ietf.org/timezones/data/leap-seconds.list;. A current DNS lookup
of www.ietf.org shows it uses the Cloudflare CDN.
> This machine is an IDS it should never make outgoing connections ever. How to
> disable this?
You might set "daily_ntpd_leapfile_enable=NO" in your local periodic.conf file
to override the default.
Alternatively, if you have a strict rule that the machine should not initiate
any outbound connections, you could add a firewall rule dropping any such
traffic originating there (i.e., not belonging to an established connection)
going out on the external ("WAN") interface.
Cheers,
Paul.
___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"
