On Mon, Dec 21, 2015 at 6:33 AM, Jeremy C. Reed <[email protected]> wrote:
> In November and again in December, we noticed that our commonly-used > logins stopped working. A quick look at our trac.htpasswd file showed > they were missing. We had backups and were able to add back the known > missing username:crypt lines and the logins worked again. > > The trac logging showed tens of thousands of "Created new user:" lines. > The corresponding httpd access logs showed constant traffic from several > IPs. I used IPFW packet filtering rules to deny access from around ten IPs. > Here are two examples: > > 00555 423 21432 deny tcp from 192.249.67.125 to any > 00560 6 360 deny tcp from 104.140.83.194 to any > > In a short amount of time, numerous /register requests were done. > I used my apache httpd.conf configuration to disable /register > (basically now is a 9 byte document that says "disabled"). At > different times, it was a few registration attempts every second, and > other times one every few seconds. > > With various packet filter rules, the traffic slowed down. We removed > thousands of bogus accounts from the database and from the password file. > Then I re-enabled the registrations. The problem happened again -- > noticed by lost valid entries from our trac.htpasswd. > > Here is an old example of the amount of new users being created in a > short time: > > $ grep "Created new user" log/trac.log | head -1 > 2015-12-15 13:18:01,811 Trac[api] INFO: Created new user: GreggAbernathy > $ grep "Created new user" log/trac.log | tail -1 > 2015-12-15 16:35:16,066 Trac[api] INFO: Created new user: DyanRothschild > $ grep "Created new user" log/trac.log | wc -l > 1285 > > So I disabled the /register again and manually restored some entries > in trac.htpasswd. > > The noise still comes in: > > $ grep /register /var/log/httpd-access.log | tail -5 > 104.151.207.129 - - [21/Dec/2015:13:37:13 +0000] "GET /register HTTP/1.0" > 200 9 > 198.111.214.21 - - [21/Dec/2015:13:37:14 +0000] "GET /register HTTP/1.1" > 200 9 > 104.140.70.74 - - [21/Dec/2015:14:03:06 +0000] "GET /register HTTP/1.1" > 200 9 > 212.83.154.59 - - [21/Dec/2015:14:09:24 +0000] "GET /register HTTP/1.1" > 200 9 > 117.136.234.12 - - [21/Dec/2015:14:15:38 +0000] "GET > http://kea.isc.org/register HTTP/1.1" 200 9 > > One odd thing is that there are many of the spam users getting deleted too: > > $ bzgrep "Deleted user" log/trac.log.5.bz2 | wc -l > 54 > $ bzgrep "Created new user" log/trac.log.5.bz2 | wc -l > 2128 > > Does anyone else see this automated distributed abuse? > > What are others doing to stop all these registration attempts? > Yes, we saw the issue on trac-hacks.org and bugs.jquery.com/bugs.jqueryui.com. In both cases, updating to TracSpamFilter 1.0 and integrating with the external services (i.e. Akismet, Mollom) resolved the issue. In the latter case we additionally switched to using authentication through GitHub with trac-github plugin. http://trac.edgewall.org/wiki/SpamFilter http://trac.edgewall.org/browser/plugins/1.0/spam-filter https://github.com/trac-hacks/trac-github > Has anyone had trac.htpasswd corrupted where valid entries are lost? > That sounds like an issue seen with an earlier version of AccountManagerPlugin. You may want to update to the latest 0.5dev version since the on you are running is nearly 2 years old. > Note while we have many bogus accounts, we rarely have new tickets > or wiki pages nor any updates to tickets or wikipages from the > bogus accounts. (I only see a few spammer tickets every couple months.) > > We have been using Trac for over six years. We have around 25 valid > user accounts and thousands of assumed spammer accounts. > > Our current website says Powered by Trac 1.0.4. It is on FreeBSD > with these packages: > trac-1.0.4 > trac-TracSpamFilter-0.2.1_6 > trac-accountmanager-0.5.12583_1,1 > > Jeremy C. Reed > ISC > -- You received this message because you are subscribed to the Google Groups "Trac Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/trac-users. For more options, visit https://groups.google.com/d/optout.
