Miscellaneous Hacks - Check Proxy RBL on New User Registration.

Check Proxy RBL on New User Registration Version 4.1

Version 4.1 includes remains unchanged from version 4.0 with the exception of a code fix to deal with an SQL injection security hole in the code.

What does this hack do?

Hooking in at register_addmember_process and register_addmember_complete this hack compares the IP address of the person registering with the Realtime Block List(s) of your choice. Based on your configuration the RBL Checker will then perform one of these actions:

1. Nothing, the registration continues as normal.
2. Registration continues as normal, but the user is automatically moved into the "Pending Moderation" group of your choice.
3. Registration continues as normal, but the user is automatically permanently banned.
4. Registration is blocked, an error message is displayed to the user.

Please Note: It is strongly recommended that you configure PM or Thread based notification so that you may monitor registrations that are from IPs that are a positive hit on the RBL. Especially if you configure the checker to allow registrations to complete normally.

These options are configurable in AdminCP > Options > DM-RBL Check on Registration.


Why Block Proxies?

Banned and Spammers users often get around IP bans by simply using an open proxy - of which there are thousands - to get around the IP ban. Very few legitimate users slow their surfing by using an anonymous proxy.


How do you Install?

1. Create a user from which PMs, Posts, etc. will be generated.
2. In your adminCP obtain values for the "banned" and "pending moderation" groupIDs (Defaults are 8 and 4).
3. Install the attached product.

IMPORTANT NOTE:You must specify a username if you plan on configuring the AUTOBAN or NOTIFICATION options. Otherwise you WILL get errors.


What is the default config?
By default the RBLChecker will check the IP of a new registration, allow registration to complete, but add the new user to the "COPPA Members Awaiting Moderation" usergroup. You can then approve/reject those members depending on whether you think they are/aren't spammers/trolls.

You can modify the settings in the AdminCP to Ban or Block as you like.


Hack History:

Version 4.1
- Fixed SQL Injection security hole.
- Fixed some minor typos in automatically generated messages.

Version 4.0
- Added ability to specify error reported on blocks.
- Added ability to specify ban reason and custom title.
- Added ability to move users to "pending moderation" group if registration is allowed.
- Updated list of RBLs checked based on testing with lists of "anonymous" proxies.
- Fixed IP address of Notification Posts equalling IP of blocked user. (Now Notification IP = 1.2.3.4)

Version 3.2
- Fixed typo causing blocked registrations to be reported as allowed.

Version 3.1
- change in variable name in v3.0 broke RBL checking. Corrected error.
- match notification now includes the name of the RBL that matches the IP.

Version 3.0
- plugin now fires at "register_addmember_process" allowing the user to completely fill in the form.
- Added the ability to specify more than one RBL.
- Added option to specify whether registration is blocked or allowed to complete.
- Added option to automatically ban registrations that are allowed to complete but have a positive IP match.
- Added option to specify user who is "notifier".
- Added option to specify a forum where a notification thread will be created.
- Added option to supress notification PM / Thread when an IP matches blacklist or known proxy list.
- Added customized error codes for notifications - notification now indicates whether a registration IP has matched the RBL, blacklist, or predefined list of anonymizers.
- Reworded Phrases.
- Removed 10.x.x.x IP from known proxy/anonymizer list.

version 2.0
- Added configuration options under vboptions > DM-RBL Check on Registration.
- Added PM on Block.
- Added option to select RBL.
- Added Custom Whitelist.
- Added Custom Blacklist.
- Added list of free proxies.
- Changed default RBL to sbl-xbl.spamhaus.org
- Added option to enable/disable checking.

version 1.0
- added plugin to check against opm.tornevall.org
- added custom phrase to be reported as error on registration start.


Using this Hack?
If you install this hack please click "Installed" to receive updates.

If you find this hack useful you can always hit that paypal button too...

[DaNIEL MeNTED]

Hey guys... sorry I haven't replied in a while. Moved jobs + a new baby and I've been insanely busy...

Before the month is over I will try and code a new version that addresses everyone's requests...

[bitdefuser]

Originally Posted by DaNIEL MeNTED

Hey guys... sorry I haven't replied in a while. Moved jobs + a new baby and I've been insanely busy...

Before the month is over I will try and code a new version that addresses everyone's requests...

Welcome back!
If your not busy any more, please try to add the following:

Suggestions:
Allowing us to enter a ban reason in the settings of the AdminCP.
Option to disable site viewing. (Simply blocks the user from the site.)

[Damien001]

Originally Posted by DaNIEL MeNTED

Hey guys... sorry I haven't replied in a while. Moved jobs + a new baby and I've been insanely busy...

Before the month is over I will try and code a new version that addresses everyone's requests...

congrats on the new job and baby

cool to see this imrpoved a bit more, it nearly perfect as it is. Just cut down the work if it ran the check after all the other checks are passed. Also put less strain on the database


since incorpating nospam and this addon we not had any spam

[DaNIEL MeNTED]

can anyone running nospam check the plugin and see where it hooks and what # its running at?

[Damien001]

<hookname>register_addmember_process</hookname>

it use multiple hooks as it protect multiple areas.

on area it also protect unless the person has signed in in the contact us page.

Any chance this program protecting that as well.

Damien

any many thanks

[DaNIEL MeNTED]

Originally Posted by Damien001

<hookname>register_addmember_process</hookname>

it use multiple hooks as it protect multiple areas.

on area it also protect unless the person has signed in in the contact us page.

Any chance this program protecting that as well.

Damien

any many thanks

There should also be an "Execution Order" # on that page...

[DaNIEL MeNTED]

Well, what started as a 5 line hack has - IMHO - reached the point where I think the feature set is quite significant.

I have fixed -
. reporting errors.
. the post IP = blocked IP issue (it is now 1.2.3.4)

I have made the following feature changes -
. added ability to specify error message someone sees when blocked.
. added ability to specify the group to add banned accounts to.
. added ability to specify a reason for being banned.
. added ability to specify a custom title for banned users.
. added the ability to place users in COPPA Users Awaiting Moderation queue - or another moderation queue.
- updated reporting to reflect new features.
. changed adminCP options order / titles / etc. to clean things up.
. changed the RBLs - # used, order, etc.

Basically, as I am testing it, out of the box the configuration will be:

Allow users to register, do not ban them, but place them in the moderation group.

If you enable banning it will automatically skip the moderation part.

If you choose to block registration it will never get far enough to mod/ban because the account isn't created.

I've finished those dev changes and am testing - I still need someone to tell me the hook order for those other hacks so I can have the checker fire AFTER they do... otherwise I should be uploading a new file within the week.

[Damien001]

<plugin active="1" executionorder="1">
<title>Check if NoSpam! question has been answered correctly</title>
<hookname>register_addmember_process</hookname>

the plug in also covers searchs
new post by un reg users
searches by un reg users
contact us by un reg users

if you need any of the hooks for those or other hooks in nospam let me know and i will do my best

[DaNIEL MeNTED]

Originally Posted by Damien001

this mod would be 100 times more effective if it ran the proxy check after confirming that the person details are correct.

i.e. that the image verification word is valid, that if the person using NoSpam that the anwser is valid and that the email address has not been banned

damien

Just to clear this up - it does.

The hook of the plugin (there's now actually 2...) so the hook of the RBL checking plugin is at register_addmember_process... This is to allow blocking of registration. If you don't have blocking turned on then the first plugin still does the check and generates notifications...

The 2nd plugin needs to fire after the new member has been added to the DB so it runs at register_addmember_complete. Depending on the options selected it either bans or flags the new member for moderation.

[bitdefuser]

Thanks for the update!
Edit: Is there a way so that it will completely block them out? Even from the home page? So, that they have no access whatsoever? (Like, as soon as the user comes on the website, it will check the IP) Or is that just too many queries?