[Eric]

Originally Posted by Trac

The user anonymous has been granted the permission TICKET_MODIFY.

You should be able to now.

And thanks for going into a little bit more detail on those for me

Originally Posted by Alfa1

I do not seem to have commenting or editing functionality on trac. So here goes:

Send registered member explanation how to resolve blacklisting
Yes, an email would be more effective than a PM.

Trace IP directly from the log.
In the log hotlink the IP of the user. The link should point to a whois for the user. For example /admincp/usertools.php?do=gethost&ip=xx.xx.xx.xx
Or a better whois service like http://who.is/whois-ip/ip-address/xx.xx.xx.xx/

Alert the admin which members have been blocked by BB and why.

Such notification should be sent max once per X days and should list all blocked members since the last notification.
It would be useful to include some additional information like join date, post count and usergroup of the member. This makes it easier to see if the user is a legitimate user.

[Simon Lloyd]

Eric, as always, really appreciate the reply, this user is one of my more valuable ones so need to get this resolved. I have asked them to clear their cookies next time they log in, however this is happening to them from 3 different machines, this person is one of two actual members to be caught up although there are many "users awaiting confirmation" getting caught although i can't decipher how many of these are genuine or not without going through the many thousands of entries one by one and checking their IP's against Project Honeypot.

I do appreciate everything you are trying to do to resolve this.

[Alfa1]

Originally Posted by Eric

It's possible they are picked up as spiders visited before BB is ran.

I use Paul M's Track Guest Visits to monitor spiders.

Originally Posted by Eric

You should be able to now.

And thanks for going into a little bit more detail on those for me

Could you give the user Alfa1 permission? I have an account at trac.

Some brainstorming:
An important factor in regards to bots being malicious or not, is if they respect robots.txt or not. If I want to block a bot, the first thing I do is disallow it in robots.txt
If after a week I still find it on my site (and therefore the bot has not respected robots.txt), then I blacklist the bot in BB.

I wonder if it would be a good idea to automatically blacklist bots that disrespect robots.txt ?


Does anyone (especially error10) know if the spiderlist.xml provided by Mosh is complete enough for the purposes of keeping an eye on malicious bots?
See: http://www.wolfshead-solutions.com/display-spiders

[Simon Lloyd]

Hi Eric, an update on the blocked users, it seems that they are getting as far as the login, they get the vb welcome message on logon, nothing at all from BB but after the welcome screen they are shown as though they have not logged on i.e username and password boxes remain blank and they remain in the "Unregistered/Not logged on" usergroup, however BB shows the results i have previously posted?

[Eric]

Originally Posted by Simon Lloyd

Hi Eric, an update on the blocked users, it seems that they are getting as far as the login, they get the vb welcome message on logon, nothing at all from BB but after the welcome screen they are shown as though they have not logged on i.e username and password boxes remain blank and they remain in the "Unregistered/Not logged on" usergroup, however BB shows the results i have previously posted?

Hmm. I'll be releasing an update soon that will allow you to skip members in the BB processing. If you want to try it out (** UNTESTED AS OF YET **) http://trac.assembla.com/vb-bad-beha...adbehavior.xml

[Simon Lloyd]

Thanks Eric, installed, i have cleared my logs and will download them as a csv after around 5 days, you're quite welcome to have it for your analysis.

[Simon Lloyd]

Eric, the user has reported back:

Tried from home computer. Different result. Got the following:
Unable to add cookies, header already sent.
File: /home/thecodec/public_html/forumz/global.php(1091) : eval()'d code
Line: 95

[Simon Lloyd]

In fact just noticed that that is showing all the time at the top of the forum so i have reverted back to bb1.0.4

[tpearl5]

While one of my moderators was removing a thread she got this vbulletin message on login.php?do=login:

"Your submission could not be processed because a security token was missing"

[Simon Lloyd]

Hi Eric, i still cannot get your new beta version working so am running the previous update, hwoever we have finally got to the bottom of that valued user not being able to log on with the help firstly of Trend Micro HouseCall free online scan found a lot of malware on her PC, it had also crippled her useragent string which we discovered by getting to go here http://user-agents.my-addr.com/user_...gent_types.php and see what it said her useragent was whilst there, now for some reason in the forum here useragent showed as

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.6; .NET CLR 1.1.4322; .NET CLR

but on visiting that site its showed

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.6; .NET CLR 1.1.4322; .NET CLR 2.0.50727;http://www.hyperpromote.com/tags/sho...code%3D666098; BVGDT=21600; pBVPU=yes; InfoPath.3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

so there was much more to the string and it had been corrupted, even though i was whitelisting all her IPs it was still denying her. Now we know what the issue is we need to find out how to fix her UA string.

Thanks for your help

[Eric]

Originally Posted by Simon Lloyd

Eric, the user has reported back:

Originally Posted by Simon Lloyd

In fact just noticed that that is showing all the time at the top of the forum so i have reverted back to bb1.0.4

Argh, looks like a rogue ')' in the plugin code, will fix.

Originally Posted by tpearl5

While one of my moderators was removing a thread she got this vbulletin message on login.php?do=login:

"Your submission could not be processed because a security token was missing"

This mod doesn't mess with the security token, so I am not sure why they would get that error.

Originally Posted by Simon Lloyd

Hi Eric, i still cannot get your new beta version working so am running the previous update, hwoever we have finally got to the bottom of that valued user not being able to log on with the help firstly of Trend Micro HouseCall free online scan found a lot of malware on her PC, it had also crippled her useragent string which we discovered by getting to go here http://user-agents.my-addr.com/user_...gent_types.php and see what it said her useragent was whilst there, now for some reason in the forum here useragent showed as but on visiting that site its showed so there was much more to the string and it had been corrupted, even though i was whitelisting all her IPs it was still denying her. Now we know what the issue is we need to find out how to fix her UA string.

Thanks for your help

Ahh, that explains it. For MSIE, I think you can fix the user agent by editing the registry. I'll look into that for you.

[Eric]

Originally Posted by Alfa1

I use Paul M's Track Guest Visits to monitor spiders.


Could you give the user Alfa1 permission? I have an account at trac.

Some brainstorming:
An important factor in regards to bots being malicious or not, is if they respect robots.txt or not. If I want to block a bot, the first thing I do is disallow it in robots.txt
If after a week I still find it on my site (and therefore the bot has not respected robots.txt), then I blacklist the bot in BB.

I wonder if it would be a good idea to automatically blacklist bots that disrespect robots.txt ?


Does anyone (especially error10) know if the spiderlist.xml provided by Mosh is complete enough for the purposes of keeping an eye on malicious bots?
See: http://www.wolfshead-solutions.com/display-spiders

Did you register? I don't think assembla allows registration, didn't see any accounts. Anonymous and registered users have the permission now either way though.

As far as blocking bots who disrespect robots.txt - I have an idea for that.

[Eric]

Originally Posted by Lee G

Just checked my logs and another google bot got caught

User agent
Mozilla/5.0 (en-us) AppleWebKit/525.13 (KHTML, like Gecko; Google Web Preview) Version/3.1 Safari/525.13

ip
66.249.82.129

Full ip range
66.249.64.0/19

And another google ip range for google to whitelist
64.233.160.0/19

Bot from ip 64.233.172.18 got caught

Bad Behavior Core will need to be updated to work around this it looks like. It checks for "Googlebot", not just "Google". Will email error10

[Alfa1]

Originally Posted by Eric

Did you register? I don't think assembla allows registration, didn't see any accounts. Anonymous and registered users have the permission now either way though.

As far as blocking bots who disrespect robots.txt - I have an idea for that.

Yes, I registered. I am afraid that I have permission to reopen and edit tickets. See: http://trac.assembla.com/vb-bad-behavior/ticket/4

Im glad that to see that 1.0.5 has Setting to make registered users bypass BB implemented.

[Lee G]

Hi Eric
Is there any news on the updates for this
Id the stop forum spam integration still going ahead or has that idea been shelved