DNSBL/Open Proxy-Blocking

History

I've had some problems with abuse via open proxies for a time ago, and when we were banning abusers, they always found a new proxy to use and register new accounts with. Since this forum was a large type we could'nt just ban e-mails etc just like that, because this was leading to a very large amount of other banned users too.

At IRC, in the other hand, we had Open Proxy Monitors, that was banning everything that was blacklisted in some DNSBL-databases. No spammers had a chance to get in there as long they were listed in such database.

This is a plugin that blocks blacklisted hosts from some different DNSBL's. It uses the global_start-hook, a very simple handler for blocking proxies, and a vBphrase called OPM_Deny.


April 2006

The source has been rewritten a bit. The proxychecker is now using a cache that, by default, stores all ip's in a database for 6 hours. It scans some DNSBL's and can be configured to block proxies from bitmasks (defined in the plugin) which makes it a little bit more reliable, because it does'nt block everything it see).

Configuration is made from the plugin (hopefully there will be a nice admin interface in the future). Exceptions (ip's that can pass through this system even if it is a proxy) are also handled differently now.

// CHANGES
//
// 2008-09-20 (2.0.8)
//
// * Changed the routines for how to handle inclusion/exclusions
// * Splitted up plugins for 3.5/3.6 and 3.7
//
// 2007-08-05
//
// * Fixed reported bug, based on resolved hosts ending with 127
// * Changed database-tables to get rid of (hopefully) duplicate keys
// * Added resolver-function
// * Added two new block-methods available at the efnet-rbl
//
// 2006-06-28 (2.0.6/Another fix)
//
// * Proxyinclusions/exclusions didn't work properly
//
// 2006-06-28 (2.0.5/Fix only)
//
// * Fixed a bug in the $block-array that affected some of the blocking results
//
// 2006-06-28 (2.0.4)
//
// * opm.tornevall.org has a new entry for anonymizers, added support for this
// * Default value on "block everything detected" in plugin changed to "no"
//
// 2006-06-26 (2.0.3)
//
// * Created options for admincp (removed plugin-configuration)
// * Fixed a bit-bug for njabl
// * Plugin is now a function (rbl_livecheck) for external lookups
// * Added options for "only block on newuser-registrations"
//
// 2006-06-22 (2.0.3 RC)
//
// * The monitor is now a function
// * Added small compatibility with other plugins (with return)
//
// 2006-05-13
//
// * sorbs zones added (no bitmasking)
// * opm.blitzed.org removed
// * time() changed to TIMENOW
//
// 2006-04-21
// ==========
//
// * proxyinclusions
// quickly add own hosts that should be treated as a proxy
//


How does it work with other vBulletins?

This filter actually works with both 3.5 and 3.6, but for now, they will be separate versions, but for 3.5 and 3.6 you should look here and for 3.7 you should look here.


How to use the compatibility thing

If you have a plugin that you want to use together with the proxy monitor (only returns a value if a an ip-address is registered as a proxy or not) you can call the function rbl_livecheck like this (example):

PHP Code:

global $rblInstalled;

if ($rblInstalled) {
$remoteIsProxy = rbl_livecheck(1, $_SERVER['REMOTE_ADDR']);

//
// .. your code here ..
//

} 


Report bugs if you find them...



Don't forget to install it

[eoc_Jason]

I think one major thing that needs to be addressed is a low "timeout", incase a RBL becomes un-responsive. I've been so busy I haven't had a chance to look into that yet, but I know there is a PHP variable somewhere. Also there might be a better method than using the gethostbyname function, not sure.

[NuclioN]

We've installed this as a product now and hope it's working. Are there things to do after the install such as update a blacklist somewhere?

[ImportPassion]

i had to disable this. It was causing major lag on my site.

[webspider]

I was not having a lag at all but I did find a high ratio of false positives.

[C_P]

Originally Posted by webspider

I was not having a lag at all but I did find a high ratio of false positives.

DITTO here.

[eoc_Jason]

Which list were the false positives coming from? I usualy found most were coming from CBL, which I disabled that code in mine. There were IPs that were last checked / listed many, many months ago. Which you would *think* would get de-listed over time, but they wern't.

Perhaps the actual checking code should be a shutdown query, as to not lag the end-user. Then the regular check against the session table can be where it currently is.

[ImportPassion]

is there a way to just do this for new users registering?

[C_P]

Originally Posted by eoc_Jason

Which list were the false positives coming from? I usualy found most were coming from CBL, which I disabled that code in mine. There were IPs that were last checked / listed many, many months ago. Which you would *think* would get de-listed over time, but they wern't.

Perhaps the actual checking code should be a shutdown query, as to not lag the end-user. Then the regular check against the session table can be where it currently is.

eoc_Jason I used your plug in and not the one in first thread.
It rejected connections from "GoBigWest" and "Dialup.cc". Both ISPs use Level3 numbers.

Rejected IPs were

IP Address: 4.250.177.131
Hostname: dialup-4.250.177.131.Dial1.Weehawken1.Level3.net

IP Address: 4.250.138.133
Hostname: dialup-4.250.138.133.Dial1.Weehawken1.Level3.net

The Spamhaus website said that the IP's weren't listed, but other whois sites were able to correctly identify them as Level3.

[skydancer]

Originally Posted by 7thgenCivic.Com

is there a way to just do this for new users registering?

Yes, just edit the plugin and add at the top:

if (THIS_SCRIPT=='register') {

and at the bottom:

}

[cnutter]

Originally Posted by skydancer

Yes, just edit the plugin and add at the top:

if (THIS_SCRIPT=='register') {

and at the bottom:

}

Skydance so it should look like this if we only one it to check users as they register on a site?

if (THIS_SCRIPT=='register') { 

if ($vbulletin->session->vars['OPM'] == 0) { 
    OPM_proxy_check(IPADDRESS); 
} 

if ($vbulletin->session->vars['OPM'] == 2) { 
    // parse some global templates 
    eval('$gobutton = "' . fetch_template('gobutton') . '";'); 
    eval('$spacer_open = "' . fetch_template('spacer_open') . '";'); 
    eval('$spacer_close = "' . fetch_template('spacer_close') . '";'); 
    eval('$headinclude = "' . fetch_template('headinclude') . '";'); 
    eval('$header = "' . fetch_template('header') . '";'); 
    eval('$footer = "' . fetch_template('footer') . '";'); 

    eval(standard_error(fetch_error('OPM_Deny',IPADDRESS))); 
} 


function OPM_proxy_check($OPMremote) { 
    global $vbulletin, $db; 

    $cleaned['sessionhash'] = "'" . $db->escape_string($vbulletin->session->vars['dbsessionhash']) . "'"; 

    $OPMlist = array( 
        "xbl.spamhaus.org" => array(4,5,6) 
        ); 


    $OPMreverse = implode('.',array_reverse(explode('.',$OPMremote))); 

    foreach ($OPMlist as $OPMhost => $OPMcodes) { 
        $OPMresult = explode('.',gethostbyname($OPMreverse.".".$OPMhost)); 

        if($OPMresult[0] = 127 && in_array($OPMresult[3],$OPMcodes)) { 
            $db->query_write(" 
                UPDATE " . TABLE_PREFIX . "session 
                SET OPM = 2 
                WHERE " . TABLE_PREFIX . "sessionhash = $cleaned[sessionhash] 
                LIMIT 1 
            "); 
            $vbulletin->session->vars['OPM'] = 2; 
            break; 
        } 
    } 

    if ($vbulletin->session->vars['OPM'] == 0) { 
        // This IP is okay for this session 
        $db->query_write(" 
            UPDATE " . TABLE_PREFIX . "session 
            SET OPM = 1 
            WHERE " . TABLE_PREFIX . "sessionhash = $cleaned[sessionhash] 
            LIMIT 1 
        "); 
    } 

    return; 
} 
}