StopForumSpam.com -> iptables

[Snorkasaurus]

In a recent post here viking60 mentioned SFS and I decided to go have a look at it. I found this post in their forums which shows how to automagically download their list and block spammers using .htaccess files, but as someone points out in the thread, .htaccess is a slow and resource intensive way to do that. Not too long ago I started playing with ipset (and iptables) to block large lists of IP's and ranges - and thought that it might work well for SFS too. Here's what I came up with...

Start with the dependencies:

Code: Select all

apt-get install zip unzip ipset

Then add this to your existing iptables firewall script:

Code: Select all

ipset create sfs_block hash:net
iptables -I FORWARD -p tcp --dport 80:443 -m set --match-set sfs_block src -j DROP

Then a script that updates the ipset:

Code: Select all

ipset destroy tempset
ipset create tempset hash:net
cd /tmp
wget -N http://www.stopforumspam.com/downloads/listed_ip_7.zip
unzip listed_ip_7.zip
sed 's:^:add tempset :' listed_ip_7.txt > listed_ip_7_importfile.txt
ipset restore < listed_ip_7_importfile.txt
rm listed_ip_7_importfile.txt
ipset swap tempset sfs_block

The script can just be cron'ed daily to keep it reasonably updated... hopefully someone will find that helpful. :-)

NOTE: I selected a number of IP's from the list and whois'ed them to see what I would find. Some of them were hosting providers (infected webapps and plugins no doubt) so I would suggest not blocking them from legitimate services that may be running in a hosted environment (like SMTP for example).

S.

[viking60]

Great stuff I did not know that I could download the "hall of shame" aka listed_ip_7.zip
Keep it coming.
checking it out now...

O yes that works just fine
Here is what I did.
I installed ipset
and tried to check things out with

Code: Select all

ipset list

At this point I got an unknown command error so I remembered that I probably would have to do it as root

Code: Select all

sudo ipset list

Which worked and pretty much had nothing to show. So we need to be root for these operations.
Then I used your tip to create my own/your list and called it sfs_block - as you did.
I made a file which I called sfsblock.sh and put your script in there and chmoded it

Code: Select all

sudo chmod +x+r sfsblock.sh

and ran it like this

Code: Select all

sudo ./sfsblock.sh

That went through so time to check the result again:

Code: Select all

sudo ipset list

and the result:

Code: Select all

Name: sfs_block
Type: hash:net
Header: family inet hashsize 16384 maxelem 65536
Size in memory: 878232
References: 1
Members:
223.82.149.209
178.33.35.224
23.94.19.175
175.44.5.157
198.27.98.23
198.50.174.130
36.72.2.141
23.107.182.241
117.139.111.82
117.26.84.18
46.148.31.241
110.85.74.170
188.208.7.13
198.50.253.42
109.169.5.182
115.62.226.10
198.2.222.205
213.169.128.51
: and on and on and on it goes


Just to make it less scary for others to try:
You can remove your list or set with

Code: Select all

sudo ipset destroy sfs_block

If you want to go back to square one.

[Snorkasaurus]

I did not know that I could download the "hall of shame"

I found their downloads page which has a few different lists you can download. Some are updated hourly while others are daily... and a number of them have limits on how frequently you can download them. I also really like their "always going to be free" policy.

S.

[viking60]

Yes I like their approach and I am also responsible for reporting some of the spammers listed there, I am proud to say.
This approach is somewhat drastic though - because it shuts out the IP from the server.
There can be lots and lots of decent people being shut out with that approach. But I must admit that I did cut of many Chinese IP's from my server back when we had the Chinese spam wave.

These days India is the main spamming sinner so I am really considering to discriminate IP ranges from them too..

[Snorkasaurus]

and I am also responsible for reporting some of the spammers listed there, I am proud to say.

This approach is somewhat drastic though - because it shuts out the IP from the server.

Perhaps I am a little jaded and angry... I like the drastic approach. :-)

admit that I did cut of many Chinese IP's from my server back when we had the Chinese spam wave.
These days India is the main spamming sinner so I am really considering to discriminate IP ranges from them too..

Blocking entire countries is actually where my ipset adventure started, now I also have sets for "bad people", "misidentified Bingbot", and "hosted servers". I am a monster.

S.

[viking60]

Spoken like a true berserk - so you got upgraded.
You will need to re-upload your avatar though - sorry about that

[Snorkasaurus]

Spoken like a true berserk - so you got upgraded.

Booyeah! :-)

You will need to re-upload your avatar though - sorry about that

I kind of like the new guy, I think I'll leave him for a bit.

Thanks v60!
S.