48 lines
2.3 KiB
Text
48 lines
2.3 KiB
Text
# ports-whitelist.conf — operator override for *intentionally* open public ports
|
|
#
|
|
# Monitoring is outside-in only (TCP connect from the internet). Anything odd that
|
|
# is still open and not listed here stays suspicious — many weird ports ⇒ look closer.
|
|
# This file does not invent internal topology; it only silences known-good public opens.
|
|
#
|
|
# Format: host_or_pattern port[,port…] [# note]
|
|
# Patterns: exact FQDN | *.example.com | * (any host)
|
|
# Baseline already allows 80/443 on all hosts, and mail ports on mail-catalog hosts.
|
|
# Override path: TALER_PORTS_WHITELIST=/path/to/file
|
|
#
|
|
# Whitelisted ports must NOT raise orange/red on the stack card.
|
|
|
|
# --- hacktivism public edge (observed / intentional WAN services) ---
|
|
# 22 ssh · 8080 Tor OR · 9200 Forgejo git-SSH (public; not treated as Elasticsearch here)
|
|
*.hacktivism.ch 22,8080,9200
|
|
hacktivism.ch 22,8080,9200
|
|
|
|
# Common intentional SSH on public edges:
|
|
*.taler.net 22
|
|
*.taler-ops.ch 22
|
|
*.lefrancpaysan.ch 22
|
|
*.taler-systems.com 22
|
|
*.gnunet.org 22
|
|
*.anastasis.lu 22
|
|
*.infomaniak.ch 22
|
|
anastasis.lu 22,25,143,465,587,993
|
|
taler-systems.com 22
|
|
gnunet.org 22
|
|
|
|
# Shared mail/edge ports often co-hosted on public FQDNs (soft noise otherwise):
|
|
*.taler.net 25,143,465,587,993,8080
|
|
*.test.taler.net 25,143,465,587,993,8080
|
|
firefly.gnunet.org 22,25,143,465,587,993,9418
|
|
pixel.taler-systems.com 22,25,143,465,587,993
|
|
mail.anastasis.lu 22,25,143,465,587,993
|
|
|
|
# Firefly git daemon (admin-log firefly/14-git-daemon.txt · ListenStream=9418)
|
|
git.taler.net 22,9418
|
|
git.gnunet.org 22,9418
|
|
|
|
# VeciGate WAN edge (vecigate-admin-log · public A 212.51.151.254)
|
|
# 80/443 baseline; 8080 Tor OR; 9200 Forgejo git-SSH; 2323x host SSH DNAT;
|
|
# 1789/1790 Nym; tortuna companion 23230 + 52323 (nat README)
|
|
212.51.151.254 22,8080,9200,1789,1790,23230,23235,23236,23237,23238,52323
|
|
|
|
# Optional — add more as you confirm intentional opens:
|
|
# lefrancpaysan.ch 21
|