1. Forum
  2. FidoNet
  3. SYNC SYSOPS

  • feature request: web security - bot protection

    From xbit ops@1:103/705 to GitLab issue in main/sbbs on Sunday, March 09, 2025 09:44:28
    open https://gitlab.synchro.net/main/sbbs/-/issues/887

    Feature request:
    Much like Sync's Control Panel > Properties > Security Tab where you can delay/throttle/block/etc, this request would give the ability to recognize bots hitting Sync's webv4 service. Many bots can be recognized with the generation of 404 errors. Example:
    https://x-bit.org/info/downloads/bots.jpg

    Rational for request:
    Bot's can somewhat takeover the web logs as they tend to be very aggressive hitting quickly throughout day.
    --- SBBSecho 3.23-Linux
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Keyop Troy@1:103/705 to GitLab note in main/sbbs on Sunday, March 09, 2025 15:16:23
    https://gitlab.synchro.net/main/sbbs/-/issues/887#note_6760

    I use fail2ban to achieve this. Follow here: https://wiki.synchro.net/howto:fail2ban

    I then added these lines to my /etc/fail2ban/jail.d/sbbs.conf jail config.

    [sbbs-web]
    enabled = true
    filter = sbbs-web
    action = iptables-allports[name=SBBS-web, protocol=all]
    logpath = /var/log/sbbs.log
    maxretry = 3
    findtime = 21600
    bantime = 21600

    and then my /etc/fail2ban/filter.d/sbbs-web.conf:

    [INCLUDES]
    before = common.conf

    [Definition]
    failregex = : web.*HTTP.*\[<HOST>\].*!ERROR:
    ignoreregex =

    Remember to do a:

    fail2ban-client reload

    to reload your new configs.
    --- SBBSecho 3.23-Linux
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From nelgin@1:103/705 to All on Sunday, March 09, 2025 18:02:07
    On Sun, 9 Mar 2025 09:44:28 -0700
    "xbit ops" (VERT) <VERT!xbit.ops@endofthelinebbs.com> wrote:
    open https://gitlab.synchro.net/main/sbbs/-/issues/887

    Feature request:
    Much like Sync's Control Panel > Properties > Security Tab where you
    can delay/throttle/block/etc, this request would give the ability to recognize bots hitting Sync's webv4 service. Many bots can be
    recognized with the generation of 404 errors. Example: https://x-bit.org/info/downloads/bots.jpg

    Rational for request:
    Bot's can somewhat takeover the web logs as they tend to be very
    aggressive hitting quickly throughout day.

    ---
    ■ Synchronet ■ Vertrauen ■ Home of Synchronet ■ [vert/cvs/bbs].synchro.net
    I find most of them adhere to robots.txt
    --
    End Of The Line BBS - Plano, TX
    telnet endofthelinebbs.com 23
    ---
    ￭ Synchronet ￭ End Of The Line BBS - endofthelinebbs.com
    --- SBBSecho 3.23-Linux
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From xbit ops@1:103/705 to GitLab note in main/sbbs on Monday, March 10, 2025 03:13:33
    https://gitlab.synchro.net/main/sbbs/-/issues/887#note_6761

    This is a *nix only solution?
    --- SBBSecho 3.23-Linux
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Keyop Troy@1:103/705 to GitLab note in main/sbbs on Monday, March 10, 2025 13:38:29
    https://gitlab.synchro.net/main/sbbs/-/issues/887#note_6762

    There appears to be something called win2ban (https://itefix.net/win2ban) and F2B (https://github.com/vokac/F2B) for windows which look similar to fail2ban for linux.
    --- SBBSecho 3.23-Linux
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)