Slashdot Mirror
Blocking Destructive Users from Websites?
billmarrs asks: "I occasionally need to block a user from using my website because they are abusing the system in some way, but the tools I have to work with for blocking them are easily circumvented. Once I identify them, I can block their IP; but they can just hang-up their modem and dial-in again to get a new IP. I can also stick cookies in their browser to identify them, but they can delete the cookies (or turn them off altogether). Are there other ways to block unwanted users from one's website?"
... moderation, meta-moderation, lameness filters, blocking ip-subnets, bitchslaps and putting [] around questionable material.
I've heard these can be quite effective.
(Just watch the moderation on this post for proof!)
---
http://slashdot.org/moderation.shtml
E-mail address-authenticated logins are probably the only real answer. Create logins that have to be activated via e-mail address. Shutdown accounts of abusers, and don't allow them to create an account with an e-mail address already in the system. Depending on what's happening with this 'abuse', you might consider creating a 'bozo' class for your logins, wherein the person _thinks_ they're still able to do things, but actually aren't. Let's say the problem is people leaving abusive or stupid messages on a webboard - well, make it so bozo'd users can still read and post messages, but noone else can see their messages but them. Just a thought...
resolve the domain name to the hostmask if possible, and ban a range of them, for example, *.ma.pool.crapnet.net
Yes, it's broad, but works. Or you can call the ISP and complain to them
-Henry
"Useless organic meatbag" -HK-47
Sometimes you can get away with a massive ban of a group of IPs.. but if your site gets a lot of hits you end up pissing off normal visitors.
If your problems stem from some kind of forum where the person is posting crap, spamming, etc. you might try requiring people to create a simple account where they need to supply a valid e-mail address.
The disadvantage to that is that having to register for an account is pretty annoying and many users won't sign up for them if they don't visit the site all the time... Other (non-registering) solutions would require you to program some advanced filters on forum posts, or having a limit on how many messages a person can post in X amount of time.
If they are using the same pattern, some URL hack, or a bunch of comments posted, or some kind of DOS.
You could write code to detectt this, then block the IP, or use a cookie based method to block them for a short time. If they try different tactics, you could modify the blocker code.
It's hard to tell if this would be a good soultion without knowing the details of what they do.
Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated up.
The thing to do is litigate. Follow the money. The abusive user may not have much to lose financially, but his/her ISP sure does.
Use tools like traceroute to detect the source of the attacks. Then use the arin whois database to find the service provider. Then SUE LIKE CRAZY.
A lot of people think the Internet is not part of the real world, so they think laws do not apply.
They are wrong. There is plenty of case law on this subject.
The point is to stop looking for technical solutions to social problems. They agree to a terms and conditions when they visit your site. Make sure they fulfil their side of the legally binding contract.
The website I hate has a 'terms of use' which all posters are legally bound by. It even goes so far as to prohibit the use of the wget client. They seem to have a heavyweight legal team there too. And so far, apart from a minor DDOS attack by a jealous rival website, they have not experienced many problems, despite the highly controversial subject matter they seem to deal with.
So to conclude: Sue their asses off.
You don't give any details of the abuse, so it makes it hard to advise specifics.
However, I'm assuming you're running some sort of service that involves a server you can program. (If this is an EZBoard being abused, which you use but don't control, you're toast.) The key is to ban the behavior, not the user. Exactly how you do that depends on the exact situation.
If someone's posting too often, make people wait at least n seconds before posting again. If they abuse that, kick the time up. And if they're posting rapid-fire, keep kicking the time up. Look into "exponential decay", it's what you're looking for. Once they cross a threshold, you may choose to ban the IP for a week and delete whatever messages were posted automatically, thus undoing the abuse automatically, which is kinda the key to this whole idea.
Think outside the "IP ban" box. What you do for other services depends. Ban behavior, not people. It's a little harder at first, but much more reliable.
Nice try, but it won't work for long.
Mr. Ska
Apache allows you to ban a netblock, you don't have to do it on a per-IP basis. For example, if the guy's always coming from 209.14.27.*, you could create a directive for your root directory like:
.htaccess file instead.
.htaccess. He set that script as his 404 error handler for a few days, and anyone who did a Nimda scan was immediately blocked from further access to the site. Of course some legit users who mistyped a link probably wound up blocked, too. I imagine by now he's cleaned out the list, so it was only a temporary inconvenience to real visitors.
(Limit GET POST)
order deny,allow
deny from 209.14.27.
(/Limit)
(Replace the parentheses with angle brackets, a la HTML.) If you can't tweak httpd.conf, put that in an
Someone else suggested automating the process, this is a good idea if you can do it. When Nimda first fired up, a friend of mine wrote a Perl script that took the remote IP and added it to the deny directive in
Your solution depends on how aggressive you want to be, and whether or not you care if a few babies get thrown out with the bathwater. Me, I'd just ban the netblock for a couple of weeks. The lusers will find another site to harass, and you can lift the ban.
Shaun
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
Not much info in your story... but here's the first thought off the top of my head (and consider that I've been up for 30+ hours). Keep track of your pesky guy's MAC address, then block the connection if it matches. No, it's not perfect since it can be changed... but assuming you're dealing with a lame-o script kiddie they might not know better, and you have less of a chance of blocking users who are legit as compared to just blocking a whole chunk of ip addresses.
Here's what I'd do: Check the MAC when you get a request (probably only for certain key pages, but you could do it for all I guess) and if the address matches your banned list, automatically ban that ip address for say... 24 hours. This way you don't accidentally lock out real users for any length of time, and it should at least slow down your pest. Granted this falls apart if your intruder knows how to change the address on your card, but you didn't say how sophisticated this all is and it's better than nothing.
Cheers
Actuaries - making accountants look interesting since 1949
if there weren't any routers on the internet.
That's as far as the MAC goes.
-Peter
Giving these guys a quick route through the posting process will allow you to slow down new comers to a crawl. If users have been reading your site for sometime then they probably have something useful to say, and it is probably worth speeding them up. I read slashdot for ages before starting to post (not that what I post is always useful).
If a newcomer does have something they really want to say, then they would be prepared to go through the hoops. Perhaps going through the password by email cycle for every post, or answering a selection of blindingly obvious but difficult to automate random questions (e.g. What colour is grass? red, green or blue).