General MoBlock thread

[chinaski]

Hello jre,

Thank you for your answer.

I have realized I had set this machine as LAMP server just before this started.

I think this was the "problem".

Or better the fact I left Apache and MySQL on default auto start settings.

After stopping services and preventing them from autostart with

sudo update-rc.d -f service_name remove

no more connections are logged if p2p software is off.

Sorry to bother you for my stupidity

[chinaski]

I have found out those connections are blocked if Skype is on

today at 6:24pm I have shut Skype down, and I have reopened it right now:

Mon Jun 14 18:24:13| OUT: netdirekt e. K,hits: 2,DST: 89.149.253.183
Mon Jun 14 18:24:16| OUT: MCNC,hits: 3,DST: 152.2.71.239
Mon Jun 14 18:24:17| OUT: University of Michigan,hits: 3,DST: 141.211.98.176
Mon Jun 14 18:24:17| OUT: netdirekt e. K,hits: 3,DST: 89.149.253.183
Tue Jun 15 00:04:47| OUT: SUNET/NORDUnet,hits: 18,DST: 130.238.141.52
Tue Jun 15 00:04:48| OUT: Dzirciema iela 16, Riga, LV-1007,hits: 3,DST: 159.148.163.249
Tue Jun 15 00:04:48| OUT: University of Maribor,hits: 2,DST: 164.8.3.50
Tue Jun 15 00:04:49| OUT: Communications Networking Services,hits: 5,DST: 212.8.163.76
Tue Jun 15 00:04:50| OUT: Sony Network Taiwan Limited,hits: 4,DST: 61.64.138.162
Tue Jun 15 00:04:50| OUT: ELTEL,hits: 1,DST: 89.112.59.195
Tue Jun 15 00:04:50| OUT: Proxad Static DSL,hits: 10,DST: 82.246.178.227
Tue Jun 15 00:04:50| OUT: Chalmers University Network,hits: 1,DST: 129.16.137.104

why is Skype trying to connect to such hosts?

[ewan86]

Setting up Moblock and Mobloquer as a non technical person was hard going but I think it is done fairly correctly though I only partially understood what I did and which lists I should use.

Anyway question: Should I enable blocklists in transmission when I have moblock running??? will this enhance or degrade security??

Thanks for your hard work on this

[jre]

The correct list setting depends on your needs. My advice is to visit iblocklist.com and read the description. Generally I don't recommend to use too many lists. The default setting in my packages is already nearly paranoid.

If you don't have any whitelistings there is no point in using a blocklist in transmission, but it won't hurt either. If you have whitelistings (e.g. for http port 80) then you might gain a little additional security by using a blocklist in transmission.
If you use only blocklists in transmission, but not moblock at all, then your system will loose its "stealth" mode. Further I don't know if you can combine several blocklists in transmission, and how the updates are handled. So I strongly suggest to use at least moblock.

Perhaps the FAQ at https://help.ubuntu.com/community/MoBlock helps you further.

[ewan86]

Thanks so much for your speedy response. I have both running and I think I stuck with the standard blocklists so I should be fine!

I did open the ports for AMSN (and who knows what else Idid!!) so it would work but I don't think that is the same as whitelisting.

Anyway thats brilliant I will leave them both running if there is no conflict.

[jre]

"whitelisting" is opening the ports, or allowing traffic on those ports.
In most cases you will only whitelist outgoing TCP ports (WHITE_TCP_OUT), which allows you to use other services on the internet.
I don't know what is needed for AMSN - here it might be that you need to whitelist incoming (TCP) traffic, too.

You can verify your config with "blockcontrol show_config". Every variable is documented in /usr/lib/blockcontrol/blockcontrol.defaults. If you need to correct changes, but can't do it in mobloquer, then you have to edit /etc/blockcontrol/blockcontrol.conf.

[Origin_Unknown]

Hi Guys / Girls

I'm having a bit of a problem getting moblocker to start and I'm hoping someone can help! I've been through the guide @ http://help.ubuntu.com/community/MoBlock, done the install and gone through the configuration but when the app tries to start i get the following message in terminal'

mediacenter@MediaCenter:~$ sudo aptitude install moblock blockcontrol mobloquer
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initialising package states... Done
The following NEW packages will be installed:
blockcontrol libnetfilter-queue1{a} libnfnetlink0{a} moblock mobloquer
0 packages upgraded, 5 newly installed, 0 to remove and 0 not upgraded.
Need to get 0B/409kB of archives. After unpacking 1,327kB will be used.
Do you want to continue? [Y/n/?] y
Writing extended state information... Done
Preconfiguring packages ...
Selecting previously deselected package libnfnetlink0.
(Reading database ... 144228 files and directories currently installed.)
Unpacking libnfnetlink0 (from .../libnfnetlink0_1.0.0-1_i386.deb) ...
Selecting previously deselected package libnetfilter-queue1.
Unpacking libnetfilter-queue1 (from .../libnetfilter-queue1_0.0.17-1_i386.deb) ...
Selecting previously deselected package moblock.
Unpacking moblock (from .../moblock_0.9~rc2-24~lucid_i386.deb) ...
Selecting previously deselected package blockcontrol.
Unpacking blockcontrol (from .../blockcontrol_1.6.12-1~lucid_all.deb) ...
Selecting previously deselected package mobloquer.
Unpacking mobloquer (from .../mobloquer_0.6+svn20090817+3-1~lucid_i386.deb) ...
Processing triggers for man-db ...
Processing triggers for ureadahead ...
Processing triggers for desktop-file-utils ...
Processing triggers for python-gmenu ...
Rebuilding /usr/share/applications/desktop.en_GB.utf8.cache...
Processing triggers for python-support ...
Setting up libnfnetlink0 (1.0.0-1) ...

Setting up libnetfilter-queue1 (0.0.17-1) ...

Setting up moblock (0.9~rc2-24~lucid) ...
Setting up blockcontrol (1.6.12-1~lucid) ...

moblock will soon be started ...
If any blocklists are missing, they will be downloaded. This may take several
minutes. Please be patient and don't abort. If you want to follow the update
process, then do in another terminal a
tail -f /var/log/blockcontrol.log
The lists are saved to /var/spool/blockcontrol/.
The installation of blockcontrol will fail, if starting moblock fails. So if
downloading the blocklists fails temporarily, the installation will fail.
To workaround this, you can turn the automatic starting of moblock off by setting
in /etc/blockcontrol/blockcontrol.conf:
INIT="0"
Please be patient ...
* Starting IP block daemon moblock [fail]
invoke-rc.d: initscript blockcontrol, action "start" failed.
dpkg: error processing blockcontrol (--configure):
subprocess installed post-installation script returned error exit status 9
dpkg: dependency problems prevent configuration of mobloquer:
mobloquer depends on blockcontrol; however:
Package blockcontrol is not configured yet.
dpkg: error processing mobloquer (--configure):
dependency problems - leaving unconfigured
Processing triggers for libc-bin ...
No apport report written because the error message indicates it's a follow-up error from a previous failure.
ldconfig deferred processing now taking place
Errors were encountered while processing:
blockcontrol
mobloquer
E: Sub-process /usr/bin/dpkg returned an error code (1)
A package failed to install. Trying to recover:
Setting up blockcontrol (1.6.12-1~lucid) ...

moblock will soon be started ...
If any blocklists are missing, they will be downloaded. This may take several
minutes. Please be patient and don't abort. If you want to follow the update
process, then do in another terminal a
tail -f /var/log/blockcontrol.log
The lists are saved to /var/spool/blockcontrol/.
The installation of blockcontrol will fail, if starting moblock fails. So if
downloading the blocklists fails temporarily, the installation will fail.
To workaround this, you can turn the automatic starting of moblock off by setting
in /etc/blockcontrol/blockcontrol.conf:
INIT="0"
Please be patient ...
* Starting IP block daemon moblock [fail]
invoke-rc.d: initscript blockcontrol, action "start" failed.
dpkg: error processing blockcontrol (--configure):
subprocess installed post-installation script returned error exit status 9
dpkg: dependency problems prevent configuration of mobloquer:
mobloquer depends on blockcontrol; however:
Package blockcontrol is not configured yet.
dpkg: error processing mobloquer (--configure):
dependency problems - leaving unconfigured
Errors were encountered while processing:
blockcontrol
mobloquer
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initialising package states... Done
Writing extended state information... Done

so obviously the program isn't started yet so I open the Mobloquer GUI, click manage and see some messages saying (log file isn't working so I'm having to type this)

Building blocklist... Updating Bluetack_level1...done.
Extracting Bluetack_Level1, detected gz...
gzip: /var/spool/blockcontrol/Bluetack_Level1/downloaded/Bluetack_Level1: Invalid compressed data--crc error
*Error 9:Failed to extract Bluetack_Level1.
*Removing /var/spool/blockcontrol/Bluetack_Level1/downloaded/Bluetack_Level1.
*Check your configuration in /etc/blockcontrol/blocklists.list and try a new blockcontrol update

the current selections on the list are;

#list.iblocklist.com/lists/atma/atma
#list.iblocklist.com/lists/bluetack/ads-trackers-and-bad-pr0n
list.iblocklist.com/lists/bluetack/bad-peers
#list.iblocklist.com/lists/bluetack/bogon
list.iblocklist.com/lists/bluetack/dshield
#list.iblocklist.com/lists/bluetack/edu
#list.iblocklist.com/lists/bluetack/for-non-lan-computers
#list.iblocklist.com/lists/bluetack/forum-spam
list.iblocklist.com/lists/bluetack/hijacked
#list.iblocklist.com/lists/bluetack/iana-multicast
#list.iblocklist.com/lists/bluetack/iana-private
#list.iblocklist.com/lists/bluetack/iana-reserved
list.iblocklist.com/lists/bluetack/level-1
#list.iblocklist.com/lists/bluetack/level-2
#list.iblocklist.com/lists/bluetack/level-3
list.iblocklist.com/lists/bluetack/microsoft
list.iblocklist.com/lists/bluetack/proxy
#list.iblocklist.com/lists/bluetack/range-test
list.iblocklist.com/lists/bluetack/spider
#list.iblocklist.com/lists/bluetack/spyware
#list.iblocklist.com/lists/bluetack/web-exploit
#list.iblocklist.com/lists/bluetack/webexploit-forumspam
#list.iblocklist.com/lists/cidr-report/bogon
#list.iblocklist.com/lists/dchubad/faker
#list.iblocklist.com/lists/dchubad/hacker
#list.iblocklist.com/lists/dchubad/pedophiles
#list.iblocklist.com/lists/dchubad/spammer
#list.iblocklist.com/lists/nexus23/ipfilterx
#list.iblocklist.com/lists/peerblock/rapidshare
#list.iblocklist.com/lists/spamhaus/drop
list.iblocklist.com/lists/tbg/bogon
list.iblocklist.com/lists/tbg/business-isps
list.iblocklist.com/lists/tbg/educational-institutions
list.iblocklist.com/lists/tbg/general-corporate-ranges
list.iblocklist.com/lists/tbg/hijacked
list.iblocklist.com/lists/tbg/primary-threats
list.iblocklist.com/lists/tbg/search-engines

#locallist /etc/blockcontrol/custom-blocklist.p2p

I've removed Bluetack_Level` and then moblocker updates everything down to 'TBH_Educational_Instuitions so I remove that, general-corperate-ranges and tbg/primary-threats then finally moblock starts...

is there any reason those 4 stop moblocker from starting at all? should it not just skip past and say they arnt updated? or is it because its a first time install and i've not downloaded those lists yet?

[jre]

Yes, this is intended behaviour: MoBlock refuses to start if any configured blocklist is not available. But if an update of a list fails, it just uses the last available version of that list. I decided that this way, so that users get aware of the fact that a list is missing (while it is acceptable that an old version is used).

BTW, I just tried your blocklists.list and all lists were available.

[Origin_Unknown]

Yes, this is intended behaviour: MoBlock refuses to start if any configured blocklist is not available. But if an update of a list fails, it just uses the last available version of that list. I decided that this way, so that users get aware of the fact that a list is missing (while it is acceptable that an old version is used).

BTW, I just tried your blocklists.list and all lists were available.

thanks for the reply - i guess mine was failing to start then because i didnt have a previous available version. it's interesting that mine wouldn't update - perhaps ill try again now and see

[Origin_Unknown]

I've just tried it again and i keep getting the same behavior even if i manually add the list from iblocklist.com - i also get the same issue on another machine i have with ubuntu 10.04.1 installed on