Site news: No referrer, no comment

by Volker Weber

If your personal firewall* blocks referrers, you can no longer post comments to the site. This is another effort to block malicious bots:

RewriteCond %{REQUEST_FILENAME} mt-cmmnt.cgi [NC]
RewriteCond %{HTTP_REFERER} !^http://vowe\.net.*$ [NC]
RewriteRule (.*) - [F,L]

Comment spam bots call cgi without going through the site. For now they are coming in with a blank referrer. Using mod_rewrite it is rather simple to divert them with a 403 return code before they hit cgi, thus avoiding any unnecessary load on the server.

Maybe I will add another rule for those smartass people that send a long string of ++++ instead of a referrer.

*) Technically you are not using a firewall but rather a local proxy server that takes requests from your browser, processes them and then relays the request to the site. Symantec calls the stripping of referrers Browser-Datenschutz in german. No idea how they call this in english.

Comments

Hi Volker,
there have been bits and pieces of defense information published on your blog. Do you have a summary? Kind of problem/solution table?
:-) stw

I guess, that would probably be read by spam bot authors pretty soon and would be a comprehensive compendium on which countermeasures to by-pass to even access a well-protected blog. In order to be one step ahead, this might not be such a good idea.

Ragnar Schierholz, 2004-12-20 09:19

I published a summary of anti-spam measures here (in German):
http://vnude.typepad.com/itfrontal/2004/12/spamschutz_in_w.html

I'm using this rule since two weeks, no more spam so far - but hundreds of HTTP 403s in my log file.

Since you have to allow the comment script's URL as a referrer (because of comment previewing), it will be easy for spambots to fake a correct referrer - they just have to insert the script address. Guess it won't take too long until "smart" spambots will exploit that weakness.

I guess in English it´s call privacy protection. :-)

I can live without previews. Personally, I find them annoying. I proof read in the edit form and I an error slips through, well, that's life.

We could enforce the referer rule by using a regex like

!^http://vowe\.net/([0-9]+)\.html$

to ensure only requests made from entry archives are accepted.

And to check for either an entry archive or the comment cgi, we could use this (untested, but should work after some testing ;) )

RewriteCond %{REQUEST_FILENAME} mt-cmmnt.cgi [NC]
RewriteCond %{HTTP_REFERER} !^http://vowe\.net/([0-9]+)\.html$ [OR]
RewriteCond %{HTTP_REFERER} !^http://vowe\.net/cgi-bin/mt-cmmnt\.cgi$ [NC]
RewriteRule (.*) - [F,L]

If not this way, mod_rewrite also provides chaining, which also could solve the problem.

Post a comment











Shall I remember this for you?




Use your full name and a working email address. Unless you want your comment to be removed. No kidding.



Recent comments

wasim akram on Free Microsoft Product Activation Code at 13:04
Mike Brown on New Amazon EC2 Micro Instances for 2 cents an hour at 13:03
Mike Brown on New Amazon EC2 Micro Instances for 2 cents an hour at 13:02
Volker Weber on Sonos 101: How to get started at 12:12
Ragnar Schierholz on Sonos 101: How to get started at 12:09
Volker Weber on Signal strength on iPhone in dBm with *3001#12345#* at 11:36
Brian O'Gorman on iOS 4.1 available at 11:19
Chris frei on Sonos 101: How to get started at 11:15
Volker Weber on Sonos 101: How to get started at 10:49
Volker Weber on Sonos 101: How to get started at 10:38
Helmut Weiss on Sonos 101: How to get started at 10:35
John Lindsay on Sonos 101: How to get started at 10:29
Robert Dahlem on This product design reminds me of ... at 10:25
Sean Cull on New Amazon EC2 Micro Instances for 2 cents an hour at 10:14
Volker Weber on iOS 4.1 available at 10:07
Felix Binsack on iOS 4.1 available at 10:04
Frank Quednau on This product design reminds me of ... at 09:54
Alexander Kluge on Signal strength on iPhone in dBm with *3001#12345#* at 09:48
Manfred Wiktorin on This product design reminds me of ... at 09:13
Ragnar Schierholz on Sonos 101: How to get started at 07:21
Volker Weber on Sonos 101: How to get started at 01:48
Volker Weber on Sonos 101: How to get started at 01:35
Armin Roth on Sonos 101: How to get started at 01:34
Armin Roth on Sonos 101: How to get started at 01:32
Declan lynch on This product design reminds me of ... at 01:22

Ceci n'est pas un blog

vowe.net is a personal website published by Volker Weber a.k.a. vowe. I am an author, consultant and systems architect based in Darmstadt, Germany.

rss Click here to subscribe

Hello

About me
Contact
Publications
Certificates
Frequently asked questions
Join the network

Twitter Updates

More >

Local time is 13:49

visitors.gif
174 visitors online

News

Other sources of news, imported into my own format to make them more accessible:

Schlagzeilen
Weather

Archives

As most of my articles roll off the front page rather quickly, I am making an archive of previous posts available here. You can also use the handy search box at the top of the page if you are looking for something particular.

Last 30 days
More archives

Got the T-shirt?

Got the T-shirt?

Systems Architecture

This site runs on an Apache web server on top of the Linux operating system. The content is managed with MovableType which is implemented in Perl. Last but not least the HTML code your browser sees is put together with PHP.

© 1992-2010 Volker Weber.
All Rights Reserved.

Impressum