Integration with vBulletin - vB Bad Behavior

/**
* vB Bad Behavior is free software; you can redistribute it and/or modify it under
* the terms of the GNU Lesser General Public License as published by the Free
* Software Foundation; either version 3 of the License, or (at your option) any
* later version.
*
* This program is distributed in the hope that it will be useful, but WITHOUT ANY
* WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
* PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
*/

What is vB Bad Behavior?
This is an integration of the Bad Behavior software with vBulletin.

What is Bad Behavior?
Bad Behavior is a PHP-based solution for blocking link spam and the robots which deliver it. Bad Behavior complements other link spam solutions by acting as a gatekeeper, preventing spammers from ever delivering their junk, and in many cases, from ever reading your site in the first place. This keeps your site's load down, makes your site logs cleaner, and can help prevent denial of service conditions caused by spammers.

Visit http://bad-behavior.ioerror.us/ for more.

Features
For more information on the features of Bad Behavior (and subsequently this mod) please go to Bad Behavior's site:

http://bad-behavior.ioerror.us/documentation/benefits/

For features related to the mod itself, please take a look at the screenshots.

This mod should work with the entire 3.x series (well, beginning with 3.5), but it's only been tested on 3.8.x. I'm not sure if this works on vB 4.x yet, as I've not tested it - but if you try it out, let me know!

Installation
1. Extract the contents of the zip file.
2. Upload the contents of the `upload` folder to your forum root.
3. Enter your AdminCP and go to Plugins & Products > Manage Products > [Add/Import Product]
4. Import the product using the `product-vb_badbehavior.xml` file.
5. Configure the mod in AdminCP -> vBulletin Options -> vBulletin Options -> vB Bad Behavior Options

Upgrading

vB Bad Behavior
In many cases, all you'll need to do to upgrade is follow the installation instructions above.

The only difference, will be you'll need to allow the files to overwrite. Also, when re-importing the product file, you'll need to set "Allow Overwrite" to "Yes".

Bad Behavior
Bad Behavior's files are at `/includes/bad-behavior/`. If you wish to update manually go to:

http://bad-behavior.ioerror.us/download/

And download the latest development version. Extract the zip, and upload the contents of `bad-behavior` to `/includes/bad-behavior/` allowing the files to overwrite.

Versions
The current version of Bad Behavior this mod is using is: v2.2.14
The current version of Bad Behavior (development) is: v2.2.14

Changelog
Version 1.0.13, 04/23/2013

• Bad Behavior upgraded to 2.2.14

Version 1.0.12, 12/21/2012 -- Released: 02/05/2013

• Bad Behavior upgraded to 2.2.13
• Added some more ranges to whitelist.ini

Version 1.0.10, 09/09/2012

• Bad Behavior upgraded to 2.2.10

Version 1.0.9, 06/17/2012

• Bad Behavior upgraded to 2.2.7

Version 1.0.8, 06/12/2012

• Bad Behavior upgraded to 2.2.6
• New Setting: EU Cookie

Version 1.0.7, 05/04/2012

• Bad Behavior upgraded to 2.2.3
• Cron/Scheduled Task for automatic log pruning added.

Version 1.0.6, 01/04/2012

• Bad Behavior upgraded to 2.1.15

Version 1.0.5, 05/26/2011

• Added option for bypassing users/members.
• If the visitor is a user, and is in usergroup 5, 6, or 7 (admin/mod/super mod) - Bad Behavior is bypassed.
• Modified bad-behavior core to check for Google Web Preview
  • file edited: /includes/bad-behavior/core.inc.php
• Added a link beside the IP address in the log for WhoIs.

Version 1.0.4, 04/28/2011

• Bad Behavior upgraded to 2.1.13 (fixes search engine block issues)
• Added Paypal/Paypal IPN IP address to the whitelist.
• Added payment gateway file names to the whitelist.

Version 1.0.3, 04/21/2011

• Fix #1: Pruning log doesn't work.
• Fix #3: POST more than two days after GET (added support for BB's javascript)
• Fix #5: Cannot modify header information error (suppressed error in BB's function)
• Implemented #6: Filter per key (new admincp option to list keys not to be shown in log)
• Implemented #9: Show link to member profile (if userid is found in headers, link to profile)

Version 1.0.2, 04/10/2011

• Updated /includes/functions_vb_badbehavior.php to:
  • disable Reverse Proxy if Reverse Proxy Addresses are empty
  • distinguish SQL queries using "SET", for example: SET @@session.wait_timeout = 90 - which is used by BB
  • set "offsite_forms" to false by default, as it's not really needed in vB IMHO, and it can cause problems with certain setups
  • cleaned up the bb2_read_settings() function and fixed a typo in one of the vbulletin options calls
• Updated /includes/whitelist.ini to include the following GOOGLE ranges:
  • 74.125.0.0/16
  • 216.239.32.0/19
  • 209.85.128.0/17
  • 66.102.0.0/20
• Updated /admincp/vb_badbehavior.php
  • Log pruning was pruning all logs, despite what was entered for number of days

Version 1.0.1, 04/06/2011

• Bad Behavior upgraded to 2.1.12
• Changed files:
  • /includes/bad-behavior/core.inc.php
  • /includes/bad-behavior/searchengine.inc.php
• "Verbose" admin option now set to "No" by default.

Version 1.0.0, 04/05/2011

• Initial release.

Screenshots
Screenshots can now be seen at: http://www.secondversion.com/images/vb/vb_badbehavior/

I was running out of room for attachments here on vB.org


Development

https://github.com/ericsizemore/vb_b...ree/master/vb3


Only those who "Mark As Installed" will receive support for this modification.

[Lee G]

This will be a good starting point
http://www.thespainforum.com/f379/ba...cklist-306359/

PM me on there if you find you become instantly moderated
I moderate some countries straight off

If you use it, white list all the google ips etc. Just to be safe

My own black list changes on a daily basis

What I also do know is keep an eye on my logs
Project honey pot is good. But I catch a lot that have not been caught yet
Today I had one moron hit 42 times from different ips on a banned user agent that were not listed there
All they have to do is rotate the user agents and they are happily scraping your content

I also work on the idea of banning some agents that they use a lot and at the same time, might block a genuine hit or three in the process. I had a case where I was taking 200 bad hits a day on one agent and five good ones. It was a no brainer to ban it

Things like Opera auto update. If a person aint got the brains to update opera, they aint got the brains to use a forum

[viper357]

Will this mod block people that browse from work through company proxies?

[carsafety]

Originally Posted by Lee G

This will be a good starting point
http://www.thespainforum.com/f379/ba...cklist-306359/

PM me on there if you find you become instantly moderated
I moderate some countries straight off

If you use it, white list all the google ips etc. Just to be safe

My own black list changes on a daily basis

What I also do know is keep an eye on my logs
Project honey pot is good. But I catch a lot that have not been caught yet
Today I had one moron hit 42 times from different ips on a banned user agent that were not listed there
All they have to do is rotate the user agents and they are happily scraping your content

I also work on the idea of banning some agents that they use a lot and at the same time, might block a genuine hit or three in the process. I had a case where I was taking 200 bad hits a day on one agent and five good ones. It was a no brainer to ban it

Things like Opera auto update. If a person aint got the brains to update opera, they aint got the brains to use a forum

Where do I find the logs? I don't see a log file anywhere obvious.

Also, aren't the Google IPs inherently whitelisted or do I have to go in and add them?

Sorry for the dumb questions, just trying to get this thing set up to a modest level of security without a lot of time I have to spend researching or editing.

[carsafety]

Originally Posted by Simon Lloyd

Eric, from my point of view a post count check would be great as, like all forums running this, there will have been many that signed up a long time ago that are bots....etc, so i'd like to say "Is Member AND Has PostCount >...."

+1

My new registrations are pretty well filtered, so I'd like to allow members to bypass on day one in case they can login from a mobile device, for example, but not from a work computer. It's the old registrations that may pose a problem and I'd guess 99% of questionable old accounts have 0 posts.

[Lee G]

Originally Posted by carsafety

Where do I find the logs? I don't see a log file anywhere obvious.

Also, aren't the Google IPs inherently whitelisted or do I have to go in and add them?

Sorry for the dumb questions, just trying to get this thing set up to a modest level of security without a lot of time I have to spend researching or editing.

In your admin cp

Go to Statistics & Logs

And you will see the bb logs there vB Bad Behavior Logs

[carsafety]

Originally Posted by Lee G

In your admin cp

Go to Statistics & Logs

And you will see the bb logs there vB Bad Behavior Logs

Duh! Thanks!

5300 entries in under 2 days.

Many are from User-Agent: Mozilla/5.0 (compatible; AMZNKAssocBot/4.0)

I'm guessing this one might be legit and part of my Amazon Associates program. What is the correct syntax to white list this please?

[Lee G]

You can white list that user agent
In the white list file, you will see how to do it

Using the user agent you posted, add this

PHP Code:

useragent[] = "Mozilla/5.0 (compatible; AMZNKAssocBot/4.0)" 


To the white list after

PHP Code:

; User agents are matched by exact match only.

[useragent] 


[carsafety]

Originally Posted by Lee G

You can white list that user agent
In the white list file, you will see how to do it

Using the user agent you posted, add this

PHP Code:

useragent[] = "Mozilla/5.0 (compatible; AMZNKAssocBot/4.0)" 


To the white list after

PHP Code:

; User agents are matched by exact match only.

[useragent] 


Thanks!

Couldn't find the whitelist file before as I was looking in the bad behavor folder, but I found it in the parent directory.

I think I got the range of IPs whitelisted too and they seem authentic as they are in Seattle.

I like how some user agents are disguised as Google Bot, even though they appear not to be Google at all.

[Lee G]

You will be surprised how many fake google bots are about
Some seo software runs a google view of things and also pretend to be google
Great way of finding your competition sniffing round your site

Something to watch out for and this happend to me last week

Some agents get blocked
I got hit about 1000 times in under an hour
All the guy did was set his scraper to rotate through a lot of agents
It was one of the most elaborate hits I have seen so far
The guy was still hitting while I added his ip to my htaccess and then the fire wall

I have also found that Project Honeypot gets busy and sometimes you might not get an ip blocked thats on their black list

I feel guilty with my war against the morons that hit me all day long with xrummer
All that money they have spent on it, we should happily let them have all our content

[Eric]

Thanks Lee and Alfa for helping out with answering questions, etc. My mind has been occupied by college and trying to find a job. Unemployment is rough so my only income right now is any online work I can find. I am trying to support my mods as much as I can, but hope folks understand other things may be a higher priority.