apache anti spam measures

S

shnelson

Limp Gawd
Joined
Feb 10, 2012
Messages
145
Does anyone have an effective method of blocking a majority of spammers from within apache?

I noticed there's a spamhaus module that appears to be deprecated, which is a shame because I think it's exactly what I need.

I'm basically trying to protect a VPS running apache from spammers being able to register on a multitude of CMS/forums etc.

There's a slick IPTABLES script to pull DROP lists, but I don't think that's inclusive enough based on what I'm seeing come through for IP ranges...
 
People find this annoying but I managed to eliminate spam on many websites with reCaptcha.
 
reCaptcha helped, but it was quickly circumvented. Seems most similar methods are pretty worthless these days.

90% of my spam comes from China, with the remainder in Russia and very seldom from other places. I'd be completely happy shutting them out completely, and that's my intent. Only problem is doing it without inflating overhead resources :(
 
There is something called Spamtrawler that may be along the lines of what you are looking for. It not only allows you to use block lists, but it allows blocking by country, ip address, user name, email, and by behavior. If you use it with the SQLite database, it's very resource friendly.

http://www.spamtrawler.net
 
shnelson said:
reCaptcha helped, but it was quickly circumvented. Seems most similar methods are pretty worthless these days.

90% of my spam comes from China, with the remainder in Russia and very seldom from other places. I'd be completely happy shutting them out completely, and that's my intent. Only problem is doing it without inflating overhead resources :(
Click to expand...

Block the entire ip range of china through iptables. Advertisers don't value them much either anyways, so you won't lose much revenue if that's a possible concern.
 
PornoSatan said:
Block the entire ip range of china through iptables. Advertisers don't value them much either anyways, so you won't lose much revenue if that's a possible concern.
Click to expand...

This is my intent - but I'm looking for a dynamic/spamhaus approach vs a large number of manual entries.

Can I create a flat file for iptables to read that contains the blacklisted IPs?
 
If you seek more options into securing your web box, you should check fail2ban also.

Nice trick for the iptables !
 
I have a fairly broad array of applications that I need to protect, those plugins look great for a targeted install but I really need it to be agnostic of the application.

After further research and test implementation last night, I scrapped the plan to bloat my IPTABLES. Instead, I stumbled upon mod_geoip for apache and gave it a shot.

Working well so far. I added it to my apache configuration, then started playing around with .htaccess within the individual sites:

Code: 
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^A1$
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^CN$
RewriteCond %{ENV:GEOIP_COUNTRY_CODE} ^IN$
RewriteCond %{REQUEST_URI} !^/error_page\.html$
RewriteRule ^(.*)$ http://www.domain.com/error_page.html [R,L]

Anyone coming from an anonymous proxy, China or India is now greeted with a big nasty warning that their IP isn't trusted. Luckily most of my sites are localized the US, so I'm not losing any quality traffic with this in place.


What's been more disturbing for me now is watching all of the attempted URL injections on one of my busier sites, of which the sources are in the US (Kansas mostly). Time to look into modsecurity?
 
Cyberrad, can you tell me a little bit more about your experience with project Artillery? The download page is pretty obscure...
 
It isn't a spam blocking program. So it does not exactly fit what you requested but it does the trick in adding an incredible amount of protection. You install it and it runs as a service. Think of it like a honeypot. When someone tries to access your VPS in a manner other then intended (port specific) they are blocked via iptables. You can also configure it to block the IPs that the rest of the users have detected. What would you like to know?
 
That summarizes it well for me, thanks!

Probably going to be my next step in securing some of my servers, though I've had no indication of trouble in this area I'm sure it's a vulnerability now that traffic is increasing.
 
I enabled Moderation on the websites I am hosting, and I added in SweetCaptcha which uses pictures and not words. You have to move the correct item from left to right to gain access. It can be circumvented, but it means a real human has to do it. It cut down the spam that I was having to moderate by around 90%.
 
When I ran forums I just added a line in the registration that says "Please input the answer to 3 x 3". If the value didn't equal 9 then the registration failed. I got the idea from VIP code that someone wrote for phpbb forums.
 
You must log in or register to reply here.
Back
Top