• • Set BANLISTCONFIG = 10, 5, 1, 20, 120, 300

• • Set BANLISTCONFIG = 10, 5, 1, 5, 120, 300

• Make sure that non-administrators cannot edit this plugin topic. By default, this topic is write protected with an ALLOWTOPICCHANGE = TWikiAdminGroup setting.

• Scan for script eval in attachments is currently hardcoded

• Scan for script eval() and escape() is currently hardcoded

• • Set BANLISTCONFIG = 20, 5, 1, 20, 120, 300

• • Set BANLISTCONFIG = 10, 5, 1, 20, 120, 300

• Scan for script eval in attachments is currently hardcoded

• • #Set ALLOWTOPICCHANGE = TWikiAdminGroup

• • Set ALLOWTOPICCHANGE = TWikiAdminGroup
  • Set ALLOWTOPICRENAME = TWikiAdminGroup

• Filter wiki-spam on topic save based on SPAMLIST: (0 or 1)

• Filter wiki-spam on topic save and HTML file uploads based on SPAMLIST: (0 or 1)

• Comma separated list of Web.Topics to exclude from wiki-spam filtering:

• Comma separated list of Web.Topics to exclude from wiki-spam filtering on topic save:

• Write protect this Plugin topics by removing the # hash sign from the ALLOWTOPICCHANGE setting

• Write protect this Plugin topic (if not already done)

• Add the hidden form field to the registration form as described in the "Registration protection settings" section

• Add the hidden form field to the registration form as described in the "Registration protection settings" section (this is already in TWiki 4.0)

Known Issues and Limitations

• Wiki-spam filtering for HTML attachments works in TWiki 01-Sep-2004 and later.
• With TWiki 4.0.2 on some platforms, notably Solaris, attached files are uploaded with a zero file size. This is because there is a bug in how TWiki 4.0.2 handles the beforeAttachmentSaveHandler. If affected, upgrade TWiki or apply bug fix Item2390

• Dakar release only: Run the configure utility in your browser to enable the Plugin

• Add the hidden form field to the registration form as described in the "Registration protection settings" section
• From TWiki 4.0 release on: Run the configure utility in your browser to enable the Plugin

1. 1. points for registration

1. 1. Points for registration

1. 1. Points for view raw
   2. Points for other actions like view

1. 1. Points for view and other actions
   2. Points for view raw

• Protect registration: (0 to disable, or number of minutes to expire)

• Protect registration: (number of minutes to expire, 15 minutes is recommended, 0 to disable)

Black List Plugin

Black List Plugin

Description

General settings

WHITELIST, BLACKLIST and BANLIST settings

Wiki-spam filtering settings

Registration protection settings

• Protect registration: (0 to disable, or number of minutes to expire)
  • Set REGEXPIRE = 0
  • If enabled, a magic number is protecting the registration process. TWiki expects a form field with a magic number. An error message is shown if not valid or if expired. This makes it harder to register a user by a script. A hidden field needs to be added to the registration form:
    <input type="hidden" name="rx" value="%BLACKLISTPLUGIN{ action="magic" }%" />

• Message shown when using registration form incorrectly: (this message is deliberately vague)
  • Set REGMESSAGE = Registration failed, please try again.

Nofollow link setting

• • Action: Add Remove IP address 203.88.152., 203.88.155., 219.65.75.
  • Current list: 203.88.152., 203.88.155., 219.65.75.

• • Action: Add Remove IP address(es) %BLACKLISTPLUGIN{ action="" value="" }%
  • Current list: %BLACKLISTPLUGIN{ action="ban_show" }%

• • Your current score: 203.88.152., 203.88.155., 219.65.75. for IP address 38.107.179.238

• • Your current score: %BLACKLISTPLUGIN{ action="user_score" }% for IP address 38.107.179.238

• • Action: Add Remove wiki-spam regex pattern http://.*? 203.88.152., 203.88.155., 219.65.75.
  • Current list: 203.88.152., 203.88.155., 219.65.75.

• • Action: Add Remove wiki-spam regex pattern(s) http://.*? %BLACKLISTPLUGIN{ action="" value="" }%
  • Current list: %BLACKLISTPLUGIN{ action="spam_show" }%

• • Set WIKISPAMMESSAGE = Wiki-spam detected, "%WIKISPAMWORD%" is a banned word and cannot be saved. Your IP address 38.107.179.238 is black listed at the QBFreak.net web site due to suspicious activities. Please contact site administrator webmaster@qbfreak.net if you got on the list by mistake.

• • Set WIKISPAMMESSAGE = Wiki-spam detected: "%WIKISPAMWORD%" is a banned word and cannot be saved. Your IP address 38.107.179.238 is black listed at the QBFreak.net web site due to suspicious activities. Please contact site administrator webmaster@qbfreak.net if you got on the list by mistake.

• Local SPAMLIST: Manually maintained list of spam patterns
• Public wiki-spam list: Big list of wiki-spam patterns, retrieved from external web site

• Log access of blacklist and spam list activities: (0 or 1)
  • Set LOGACCESS = 1

• Access restriction:
  • #Set ALLOWTOPICCHANGE = TWikiAdminGroup

WHITELIST, BLACKLIST and BANLIST settings:

• Add a rel="nofollow" parameter to external URLs. Use this is to fight Wiki-spam. Search engines will not follow the link if a URL has a nofollow parameter, such as <a href="http://spammer.com/" rel="nofollow">. Specify topic age in hours for which the nofollow parameter should appear (set it to a value that gives you enough time to remove spam); set it to -1 to add the nofollow parameter unconditionally to external URLs; or 0 to disable: (-1, 0, 1...N)
  • Set NOFOLLOWAGE = -1

• Filter wiki-spam on topic save based on SPAMLIST: (0 or 1)
  • Set FILTERWIKISPAM = 1

• Comma separated list of Web.Topics to exclude from wiki-spam filtering:
  • Set SPAMEXCLUDETOPICS =

• Log access of users on BLACKLIST and BANLIST: (1 or 0)
  • Set LOGACCESS = 1

• Public wiki-spam list: Big list of wiki-spam patterns, retrieved from external web site (thanks to MoinMoin's AntiSpamGlobalSolution wiki-spam list)
  • Set SPAMLISTURL = http://arch.thinkmo.de/cgi-bin/spam-merge

• Access restriction
  • #Set ALLOWTOPICCHANGE = TWikiAdminGroup

• Cache refresh time (in minutes) for public wiki-merge pattern list:
  • Set SPAMLISTREFRESH = 60

• Cache refresh time (in minutes) for internal wiki-spam regular expression cache:
  • Set SPAMREGEXREFRESH = 10

• Message for users trying to save text with wiki-spam:
  • Set WIKISPAMMESSAGE = Wiki-spam detected, "%WIKISPAMWORD%" is a banned word and cannot be saved. Your IP address 38.107.179.238 is black listed at the QBFreak.net web site due to suspicious activities. Please contact site administrator webmaster@qbfreak.net if you got on the list by mistake.

Nofollow link setting:

• Add a rel="nofollow" parameter to external URLs. Use this is to fight Wiki-spam. Search engines will not follow the link if a URL has a nofollow parameter, such as <a href="http://spammer.com/" rel="nofollow">. Specify topic age in hours for which the nofollow parameter should appear (set it to a value that gives you enough time to remove spam); set it to -1 to add the nofollow parameter unconditionally to external URLs; or 0 to disable: (-1, 0, 1...N)
  • Set NOFOLLOWAGE = -1

• • Add Remove IP address 203.88.152., 203.88.155., 219.65.75.

• • Action: Add Remove IP address 203.88.152., 203.88.155., 219.65.75.

• BANLIST configuration, comma delimited list of: Points for registration, points for each save and upload, points for view raw, points for other actions like view, threshold to add to BANLIST, measured over time (in seconds)

• BANLIST configuration, comma delimited list of:
  1. points for registration
  2. Points for each save and upload
  3. Points for view raw
  4. Points for other actions like view
  5. Threshold to add to BANLIST
  6. Measured over time (in seconds)

• • Set BLACKLISTMESSAGE = You are black listed at the QBFreak.net web site due to excessive access or suspicious activities. Please contact site administrator webmaster@qbfreak.net if you got on the list by mistake. Black listed IP addresses will be submitted to major blacklist databases.

• • Set BLACKLISTMESSAGE = Your IP address 38.107.179.238 is black listed at the QBFreak.net web site due to excessive access or suspicious activities. Please contact site administrator webmaster@qbfreak.net if you got on the list by mistake.

• • Set ALLOWTOPICCHANGE = TWikiAdminGroup

• • #Set ALLOWTOPICCHANGE = TWikiAdminGroup

• Write protect this Plugin topics by removing the # hash sign from the ALLOWTOPICCHANGE setting
• Make sure pub/TWiki/BlackListPlugin/ is writable by the CGI user (typically nobody)
• Dakar release only: Run the configure utility in your browser to enable the Plugin

• Add a rel="nofollow" parameter to external URLs. Use this is to fight Wiki-spam. Search engines will not follow the link if a URL has a nofollow parameter, such as <a href="http://spammer.com/" rel="nofollow">. Specify topic age in hours for which the nofollow parameter should appear (set it to a value that gives you enough time to remove spam); set it to -1 to add the nofollow parameter unconditionally to external URLs; or 0 to disable: (-1, 0, 1...N)
  • Set NOFOLLOWAGE = -1

• BANLIST configuration, comma delimited list of: Points for registration, points for each save and upload, points for other actions like view, threshold to add to BANLIST, measured over time (in seconds)
  • Set BANLISTCONFIG = 30, 5, 1, 150, 300

• BANLIST configuration, comma delimited list of: Points for registration, points for each save and upload, points for view raw, points for other actions like view, threshold to add to BANLIST, measured over time (in seconds)
  • Set BANLISTCONFIG = 20, 5, 1, 20, 120, 300

The Plugin monitors activities by IP address and uses three IP address lists to protect the TWiki site:

• • Set BLACKLIST = 203.88.152., 219.65.75.

• • Set BLACKLIST = 203.88.152., 203.88.155., 219.65.75.

• • Set BLACKLISTMESSAGE = You are black listed at the QBFreak.net web site due to excessive access or suspicious activities. Please contact webmaster@qbfreak.net if you got on the list by mistake. Black listed IP addresses will be submitted to major blacklist databases.

• • Set BLACKLISTMESSAGE = You are black listed at the QBFreak.net web site due to excessive access or suspicious activities. Please contact site administrator webmaster@qbfreak.net if you got on the list by mistake. Black listed IP addresses will be submitted to major blacklist databases.

• • Add the IP address of a PC to BLACKLIST and access TWiki from that PC. After a one minute timeout, you should see the message "You are black listed at QBFreak.net" if accessing the view script; or an 500 Internal Server Error for other scripts.

1. 1. Using above form, add the IP address of one of your workstations to the BANLIST
   2. Access TWiki from that workstation
      • if you look at a TWiki topic (with the view script) you should see the BLACKLISTMESSAGE (defined above) after a one minute timeout
      • else, you should get an 500 Internal Server Error for other scripts
   3. On a different workstation, remove the IP address of the test workstation from the BANLIST

Known Issues

• The BANLIST does not work until you add and remove an IP address using above form

• WHITELIST: Manually maintained list of users who should never get on the BANLIST
• BLACKLIST: Manually maintained list of malicious users
• BANLIST: Automatically updated list of users with suspicious activities

Users on the BLACKLIST and BANLIST will have every page access delayed by one minute and will get an error message.

• Blacklist: (Comma delimited list of IP addresses, partial addresses OK)
  • Set BLACKLIST = 203.88.152, 219.65.75

• WHITELIST: Comma delimited list of IP addresses; possible to use partial addresses ending in a dot
  • Set WHITELIST = 127.0.0.1

• BLACKLIST: Comma delimited list of IP addresses; possible to use partial addresses ending in a dot
  • Set BLACKLIST = 203.88.152., 219.65.75.

• BANLIST: Automatically updated list of IP addresses based on BANLIST configuration
  • Add Remove IP address 203.88.152., 203.88.155., 219.65.75.
  • Current list: 203.88.152., 203.88.155., 219.65.75.

• BANLIST configuration, comma delimited list of: Points for registration, points for each save and upload, points for other actions like view, threshold to add to BANLIST, measured over time (in seconds)
  • Set BANLISTCONFIG = 30, 5, 1, 150, 300
  • Your current score: 203.88.152., 203.88.155., 219.65.75. for IP address 38.107.179.238

• Message for users on BLACKLIST and BANLIST:
  • Set BLACKLISTMESSAGE = You are black listed at the QBFreak.net web site due to excessive access or suspicious activities. Please contact webmaster@qbfreak.net if you got on the list by mistake. Black listed IP addresses will be submitted to major blacklist databases.

• Log access of users on blacklist to data/debug.txt: (1 or 0)

• Log access of users on BLACKLIST and BANLIST: (1 or 0)

Black List Plugin

This is a simple utility to keep black sheeps away from a public TWiki site. Add the IP address of a malicious user to the BLACKLIST setting. Users on that list will have every page access delayed by one minute and will get an error message.

Plugin Settings

Plugin settings are stored as preferences variables. To reference a plugin setting write %<plugin>_<setting>%, i.e. %INTERWIKIPLUGIN_SHORTDESCRIPTION%

• One line description, is shown in the TextFormattingRules topic:
  • Set SHORTDESCRIPTION = Utility to keep malicious users away from a public TWiki site

• Debug plugin: (See output in data/debug.txt)
  • Set DEBUG = 0

• Blacklist: (Comma delimited list of IP addresses, partial addresses OK)
  • Set BLACKLIST = 203.88.152, 219.65.75

• Log access of users on blacklist to data/debug.txt: (1 or 0)
  • Set LOGACCESS = 1

• Access restriction
  • Set ALLOWTOPICCHANGE = TWikiAdminGroup

Plugin Installation Instructions

Note: You do not need to install anything on the browser to use this plugin. The following instructions are for the administrator who installs the plugin on the server where TWiki is running.

• Download the ZIP file from the Plugin web (see below)
• Unzip BlackListPlugin.zip in your twiki installation directory. Content:

  File:	Description:
  data/TWiki/BlackListPlugin.txt	Plugin topic
  data/TWiki/BlackListPlugin.txt,v	Plugin topic repository
  lib/TWiki/Plugins/BlackListPlugin.pm	Plugin Perl module

• Test if the installation was successful:
  • Add the IP address of a PC to BLACKLIST and access TWiki from that PC. After a one minute timeout, you should see the message "You are black listed at QBFreak.net" if accessing the view script; or an 500 Internal Server Error for other scripts.

Plugin Info

Related Topics: TWikiPreferences, TWikiPlugins, Google blacklist directory

-- TWiki:Main/PeterThoeny - 21 Mar 2004