Log in

View Full Version : Block repeat downloads by IP or account?


Greebo
05-08-2006, 11:17 AM
We had a recent situation where a number of IPs were downloading the same attachment over and over again. While I believe some were legit (we had been referenced on a popular site), I also believe we got targeted by a DOS attempt, because the same file was being downloded in some cases by 0 post uers again, and again, and again. 27 Gigs in 2 days and we're a small forum with a 500G/mo limit.

I don't want to restrict guest attachment downloads completely - but I have for now, and am also forcing free email users to manually request access before getting permission to download attachments. But what I'd really like is a hack to restrict the amount of bandwidth a single IP and/or account can use. I'd like to restrict accounts from d/l the same attachment more than once every, oh, 5 minutes, and the same restriction on IP addresses.

Anyone know of any defensive hacks that would help with this?

Thanks much!
Chuck

home9000
06-22-2006, 03:26 PM
This hack will be helpfull for all

berayiwu5
06-22-2006, 09:21 PM
Links and Downloads Manager has implemented an option to restrict the number of times a user can download an attachment. Actually, it was I who requested the developer to include that option. See my exchange with AndrewD:

https://vborg.vbsupport.ru/showthread.php?p=924597&highlight=berayiwu5#post924597

By the way, AndrewD is a very nice guy. He even PM-ed me when he first implemented that option:
"The new version of LD, 2.1.6,..., includes an optional extra to allow you to limit the number of times a document can be downloaded by a given user.

This is provided as an optional 'plugin' in the extras/limit_useraccess subdiretory of the zip. You'll need to read the instructions in that directory - it's not installed by default." (That was back in March. It might now include more options.)

I haven't got the time to try that option just yet. I don't know if it could also block repeat downloads by IP address. But I'm sure you can do it by user account.