In November and again in December, we noticed that our commonly-used
logins stopped working. A quick look at our trac.htpasswd file showed
they were missing. We had backups and were able to add back the known
missing username:crypt lines and the logins worked again.
The trac logging showed tens of thousands of "Created new user:" lines.
The corresponding httpd access logs showed constant traffic from several
IPs. I used IPFW packet filtering rules to deny access from around ten IPs.
Here are two examples:
00555 423 21432 deny tcp from 192.249.67.125 to any
00560 6 360 deny tcp from 104.140.83.194 to any
In a short amount of time, numerous /register requests were done.
I used my apache httpd.conf configuration to disable /register
(basically now is a 9 byte document that says "disabled"). At
different times, it was a few registration attempts every second, and
other times one every few seconds.
With various packet filter rules, the traffic slowed down. We removed
thousands of bogus accounts from the database and from the password file.
Then I re-enabled the registrations. The problem happened again --
noticed by lost valid entries from our trac.htpasswd.
Here is an old example of the amount of new users being created in a
short time:
$ grep "Created new user" log/trac.log | head -1
2015-12-15 13:18:01,811 Trac[api] INFO: Created new user: GreggAbernathy
$ grep "Created new user" log/trac.log | tail -1
2015-12-15 16:35:16,066 Trac[api] INFO: Created new user: DyanRothschild
$ grep "Created new user" log/trac.log | wc -l
1285
So I disabled the /register again and manually restored some entries
in trac.htpasswd.
The noise still comes in:
$ grep /register /var/log/httpd-access.log | tail -5
104.151.207.129 - - [21/Dec/2015:13:37:13 +0000] "GET /register HTTP/1.0" 200 9
198.111.214.21 - - [21/Dec/2015:13:37:14 +0000] "GET /register HTTP/1.1" 200 9
104.140.70.74 - - [21/Dec/2015:14:03:06 +0000] "GET /register HTTP/1.1" 200 9
212.83.154.59 - - [21/Dec/2015:14:09:24 +0000] "GET /register HTTP/1.1" 200 9
117.136.234.12 - - [21/Dec/2015:14:15:38 +0000] "GET
http://kea.isc.org/register HTTP/1.1" 200 9
One odd thing is that there are many of the spam users getting deleted too:
$ bzgrep "Deleted user" log/trac.log.5.bz2 | wc -l
54
$ bzgrep "Created new user" log/trac.log.5.bz2 | wc -l
2128
Does anyone else see this automated distributed abuse?
What are others doing to stop all these registration attempts?
Has anyone had trac.htpasswd corrupted where valid entries are lost?
Note while we have many bogus accounts, we rarely have new tickets
or wiki pages nor any updates to tickets or wikipages from the
bogus accounts. (I only see a few spammer tickets every couple months.)
We have been using Trac for over six years. We have around 25 valid
user accounts and thousands of assumed spammer accounts.
Our current website says Powered by Trac 1.0.4. It is on FreeBSD
with these packages:
trac-1.0.4
trac-TracSpamFilter-0.2.1_6
trac-accountmanager-0.5.12583_1,1
Jeremy C. Reed
ISC
