[2.0.18] Block Open Proxy Registrants

All new MODs released in our MOD Database will be announced in here. All support for released MODs needs to take place in here. No new MODs will be accepted into the MOD Database for phpBB2
Forum rules
READ: phpBB.com Board-Wide Rules and Regulations

On February 1, 2009 this forum will be set to read only as part of retiring of phpBB2.

Rating:

Excellent!
50
63%
Very Good
11
14%
Good
8
10%
Fair
1
1%
Poor
9
11%
 
Total votes: 79

BikerBabo
Registered User
Posts: 16
Joined: Tue Feb 24, 2004 12:29 pm

Re: [2.0.18] Block Open Proxy Registrants

Post by BikerBabo »

TerraFrost wrote: If they're encountering the problem at login, then this MOD, quite simply, isn't to blame.

The problem was resolved the moment I removed the MOD. Draw your own conclusions.
TerraFrost wrote:
I have no idea either, but my server logs confirm it.

Your server logs confirm that they're getting an "unable to scan for proxies" error message? All my own server logs log is the HTTP request, not including POST data, or COOKIE data.

No, my server logs confirm that the user triggered the MOD when merely trying to login, and the logs further confirm that the same user logged in successfully immediately afterwards via a proxy website.
TerraFrost wrote: Your understanding is correct. There's no way, without modification, for this to be triggered during the login process.

If you say so. I'm curious what other explanation there might be for the source of an error that says 'error scanning for proxies', if it's not the proxy scanning MOD that, upon removal, caused the problem to be resolved.

I'm no expert, but to me it's pretty straightforward: Proxy Scanning MOD = proxy scanning error; NO Proxy Scanning MOD = NO proxy scanning error. Conclusion: the Proxy Scanning MOD caused the proxy scanning error to occur, somehow. I personally like that better than the "magic missile spell" theory.

TerraFrost
Former Team Member
Posts: 5957
Joined: Sun Dec 26, 2004 3:40 am
Location: Austin, TX

Re: [2.0.18] Block Open Proxy Registrants

Post by TerraFrost »

Here are the modifications this MOD makes to files phpBB includes by default:

Code: Select all

#
#-----[ OPEN ]------------------------------------------
#
includes/constants.php
#
#-----[ FIND ]------------------------------------------
#
define('VOTE_USERS_TABLE', $table_prefix.'vote_voters');
#
#-----[ AFTER, ADD ]------------------------------------
#
define('PROXY_TABLE', $table_prefix.'proxies');

define('PROXY_ERROR',99);
define('PROXY_TRANSPARE',65);
define('PROXY_ANONYMOUS',66);
define('PROXY_HIGH_ANON',67);
Maybe that's blocking people! Doesn't look like it could, to me, but hey, what do I know?

Code: Select all

#
#-----[ OPEN ]------------------------------------------
#
language/lang_english/lang_main.php
#
#-----[ FIND ]------------------------------------------
#
$lang['A_critical_error'] = 'A Critical Error Occurred';
#
#-----[ AFTER, ADD ]------------------------------------
#
$lang['proxy_detected'] = 'Open %s HTTP Proxy Server Detected on Port %d.';
$lang['proxy_reg_block'] = 'Registration attempt blocked.';
$lang['proxy_t0'] = 'Transparent';
$lang['proxy_t1'] = 'Anonymous';
$lang['proxy_t2'] = 'High Anonymity';
...or maybe this is blocking people! I mean, it's either got to be this or the above. The other two files that this MOD modifies - lang_admin.php and usercp_register.php - aren't included when people login.

I also apologize if I sound harsh. It's just that I don't see how what you're saying is possible, as explained above - not unless you've made modifications, as stipulated in my earlier post, that you've not told me about.

pbechoman
Registered User
Posts: 1
Joined: Tue May 22, 2007 1:33 pm

Re: [2.0.18] Block Open Proxy Registrants

Post by pbechoman »

I agree with the above comments regarding open proxies. My experience shows that all the registration attacks I had on one of my forums were from a few people with the aid of proxies! You ban an IP they go use another one. I found out that they use proxies because they have a good reason to hide their walkabouts.

Keep in mind that most open proxies are mis-configured proxies. They stay open until their users just find connection to internet extremely slow, complain to the admin, he realises he's got the door open to everyone, then shuts it. Hence there are loads of lists that are updated on a daily basis. People who search for them, know about them and use them, they are not your average user that just browses about for the latest news.

Again it really depends on the forum you are running. If you are running ie. a forum that discusses politics on a rough country that opposes the freedom of speech, disabling open proxies virtually means killing your traffic so don't use this MOD.

Do not forget internet can be a very hostile environment so it is a good practise to try and cover yourself and your online community. Most forums like mine can live just fine without open proxy connections.

mtylerb
Registered User
Posts: 50
Joined: Mon Nov 28, 2005 5:33 am
Location: Edmonton, AB
Contact:

Re: [2.0.18] Block Open Proxy Registrants

Post by mtylerb »

I'm having an issue with constantly getting a Connection Timeout (0) report. I have scanned hundreds of IP's (including ones I've found on Open Proxy IP lists) and they all give the same report. Does this rely on another webpage? I'm not too familiar with how this mod works, but it seems to me there should be more happening. The dnsbl scan usually finds 1+ reports for most of the IP's I've scanned. Anyone?

TerraFrost
Former Team Member
Posts: 5957
Joined: Sun Dec 26, 2004 3:40 am
Location: Austin, TX

Re: [2.0.18] Block Open Proxy Registrants

Post by TerraFrost »

mtylerb wrote:I'm having an issue with constantly getting a Connection Timeout (0) report. I have scanned hundreds of IP's (including ones I've found on Open Proxy IP lists) and they all give the same report. Does this rely on another webpage? I'm not too familiar with how this mod works, but it seems to me there should be more happening. The dnsbl scan usually finds 1+ reports for most of the IP's I've scanned. Anyone?
Your server is probably configured in a way that prevents this MOD from working. Clicking on the Debug Panel will open it up and provide you with more info. Could you tell me what it says?

As for how it works... it doesn't rely on another webpage... what it does is that it (connect.php) attempts to use an IP address as a proxy. It tries to connect to a serve.php. serve.php looks at the headers of the HTTP request and outputs the proxy type. connect.php reads this and logs it.

mtylerb
Registered User
Posts: 50
Joined: Mon Nov 28, 2005 5:33 am
Location: Edmonton, AB
Contact:

Re: [2.0.18] Block Open Proxy Registrants

Post by mtylerb »

Block Open Proxy wrote:Block Open Proxy Registrants

Scans for proxies on the specified ports. Debug information can be found by clicking on the "Debug Information" text.

Click Here to return to the previous page.
Check IP Address wrote:Checking 66.191.48.131...
Hostname: 66-191-48-131.dhcp.gnvl.sc.charter.com

Connection Timeout (0)

DNSBL Entries: [0] [1]
Debug Information wrote:Sample HTTP Request 1

GET /proxy/connect.php?address=66.191.48.131&port=3128 HTTP/1.0
Host: labourtalk.org
User-Agent: Labourtalk.org Proxy Check
Connection: close

Sample HTTP Request 2

301 Moved Permanently

Moved Permanently
The document has moved here.

Suggestions:

Sample SQL Query

Execution Time: 0.00ms
Powered by phpBB 2.0.22 © 2001 phpBB Group
This is pretty much exactly how the page looks after clicking the "Submit" button. Hope there's something useful there for you, seems to not be taking much time at all, but if there's another setting I need to change somewhere, let me know. As an additional note, I have it set to scan ports: 80, 2301, 3128, 5903, 6588, 8000, 8080. Thanks in advance.

TerraFrost
Former Team Member
Posts: 5957
Joined: Sun Dec 26, 2004 3:40 am
Location: Austin, TX

Re: [2.0.18] Block Open Proxy Registrants

Post by TerraFrost »

Say your website is domain.tld. It could be set up such that all requests to http://www.domain.tld get redirected to domain.tld. It sounds like that may be what's happening here - that your server's domain is equal to domain.tld when it should be http://www.domain.tld or vice versa.

mtylerb
Registered User
Posts: 50
Joined: Mon Nov 28, 2005 5:33 am
Location: Edmonton, AB
Contact:

Re: [2.0.18] Block Open Proxy Registrants

Post by mtylerb »

You rock, thanks for the help! I just changed the board's domain configuration to "www.labourtalk.org" instead of "labourtalk.org" and it worked perfectly. Thanks again!

fanh
Registered User
Posts: 37
Joined: Sun Mar 26, 2006 10:29 pm

Re: [2.0.18] Block Open Proxy Registrants

Post by fanh »

Jeg installed "Block Open Proxy Registrants" and have a list of IP address. I have a remark that there were blocked 3 IP-addresses but there were 2 IP-addresses, that can be registered in the Users List.

Image

Do you I have idea why did MOD not block all 5 IP-addresses ?

TerraFrost
Former Team Member
Posts: 5957
Joined: Sun Dec 26, 2004 3:40 am
Location: Austin, TX

Re: [2.0.18] Block Open Proxy Registrants

Post by TerraFrost »

Do you I have idea why did MOD not block all 5 IP-addresses ?
Probably has something to do with the fact that the port and type fields are blank. Not just for the ones it didn't block, but for all of them. It shouldn't be blank. Since it is, I'd be interested in seeing what the Debug Panel says. If it doesn't say anything useful, then the next best thing would be to install the MOD I wrote as a successor to this MOD - IP Unmasker. If I'm to spend time debugging something, I'd rather debug that then this.

mtylerb
Registered User
Posts: 50
Joined: Mon Nov 28, 2005 5:33 am
Location: Edmonton, AB
Contact:

Re: [2.0.18] Block Open Proxy Registrants

Post by mtylerb »

That looks like the full list. The script shows IP addresses confirmed as Open Proxies on the main page where all the settings are shown. It's on the very bottom,

Image

The other list shown is a list of ALL IP addresses scanned, whether or not they were confirmed as proxies.

Image

Hope that makes sense and helps a little.

TerraFrost
Former Team Member
Posts: 5957
Joined: Sun Dec 26, 2004 3:40 am
Location: Austin, TX

Re: [2.0.18] Block Open Proxy Registrants

Post by TerraFrost »

Let's start over. You have five IP addresses you believe to be proxies. 210.8.199.105, 125.234.71.244, 222.253.93.144, 203.162.3.146, and 83.108.150.50. Why do you believe these IP addresses to be proxies? If this MOD detected them as proxies, it should show their port and type in their respective rows. The fact that some IP addresses do not appear with Ports or Types does not mean that all are supposed to.

Given this, I'm interested in what the Debug Panel says for those various proxies. You can find the Debug panel by checking those IP addresses for open proxies.

Also, in the "mini list", the Type is not displayed. It should be. This suggests something is not working correctly and again makes me currious what the Debug panel says.

So if you could post what it says, I would appreciate that. I can't guarantee that I'll be able to resolve this issue with that information, but I won't know unless I have it...

fanh
Registered User
Posts: 37
Joined: Sun Mar 26, 2006 10:29 pm

Re: [2.0.18] Block Open Proxy Registrants

Post by fanh »

Image
I got a new IP with port : 6588. Is It a proxy ?
The IPs, that were showed in the list, is it IPs from them, who tried to register to mit forum ?
I have intalled IP-Unmasker and I hope to get their real IP-addresses.
Can IP-Unmasker work with both the registered member and new registrants ?

mtylerb
Registered User
Posts: 50
Joined: Mon Nov 28, 2005 5:33 am
Location: Edmonton, AB
Contact:

Re: [2.0.18] Block Open Proxy Registrants

Post by mtylerb »

Port 6588, at least the one listed in your list, was open on 201.37.243.44. That would be the reason it is next to it. However, there is no type, something I've actually been noticing on my board also.

TerraFrost
Former Team Member
Posts: 5957
Joined: Sun Dec 26, 2004 3:40 am
Location: Austin, TX

Re: [2.0.18] Block Open Proxy Registrants

Post by TerraFrost »

fanh wrote:Image
I got a new IP with port : 6588. Is It a proxy ?
Since it isn't displaying the Type, I really have no clue. In order to have such a clue, I'd have to know why the type wasn't displaying, and... well, like I said earlier, if I'm to do debugging, I'd rather not do it on a MOD I consider to be deprecated.
I have intalled IP-Unmasker and I hope to get their real IP-addresses.
Can IP-Unmasker work with both the registered member and new registrants ?
It works with everyone. It "fires up" when someone visits the board, regardless of whether or not they register or whatever.

Post Reply

Return to “[2.0.x] MOD Database Releases”