Also, I'm not a programmer, but I was thinking the initial telnet connect L>challenge (captcha) code idea would be better because it would automatically L>stop "all" automated bots without using an ip.can. You can see it on A2K BBS L>Example below:

----------------------------
Code: 12345
Enter the above code above to proceed:
--------------------------------

That's what Steve Winn, developer of Virtual Advanced (VADV32)
software, had set up.

It was a random 6 digit string, in a VScript called CAPTCHA.V -- if
they failed to enter the correct string, they NEVER got the first logon
or other message screen about the BBS, and their IP address was BLOCKED
by a set value, set by the Sysop (I had mine set at 24 hours <G>).

I don't know if Digital Man would add something like this (CAPTCHA) to Synchronet, but if he did, that'd be an extra deterrent to these bots.
Version 3.17 already will temporarily block an IP for a connect that
exceeds the number of MaxCurrentConnects (mine is set at 2). Accounts
like GUEST are EXEMPT from this.

Daryl

---
* OLX 1.53 * Why's the man who invests all your money called a broker?
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Re: Guests logging in from "s
By: Daryl Stout to LITH on Sun Jul 16 2017 08:28:00

Also, I'm not a programmer, but I was thinking the initial telnet
connect challenge (captcha) code idea would be better because it would
automatically stop "all" automated bots without using an ip.can. You
can see it on A2K BBS Example below:

----------------------------
Code: 12345
Enter the above code above to proceed:
--------------------------------

That's what Steve Winn, developer of Virtual Advanced (VADV32)
software, had set up.

You know ROB.

This is where ZUUL. the gatekeeper and keymaster would come in handy. pass the encyrpted info here or atleast randomized passwords or something.

that would keep the bots from even being able to go into login/logon.js

--

Tim Smith (KK4QBN)
KK4QBN BBS

---
* Synchronet * KK4QBN - kk4qbn.synchro.net - 7064229538 - Chatsworth GA USA
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Version 3.17 already will temporarily block an IP for a connect that
exceeds the number of MaxCurrentConnects (mine is set at 2). Accounts
like GUEST are EXEMPT from this

Yesterday, I had 13 logins and only two legit ones. The rest were the guest/"shell" and such. It would be nice to have a way to stop these from logging in. If 3.17 has any extra features, then I will look into upgrading.. Thanks for the info.

---
* Synchronet * www.asirta.com + Retro Music / Games / Gear + radio.asirta.com
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Denn,

test it, it's pretty funny to get bombed by all those lines of text and the DG>system actually drops the connection before all the text is displayed.

Talk about "disconnect user with line noise". <G>

Daryl

---
* OLX 1.53 * You'll have no other Sysop before me (just kidding).
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)

That's what Steve Winn, developer of Virtual Advanced (VADV32)
software, had set up.

You know ROB.

This is where ZUUL. the gatekeeper and keymaster would come in handy. pass t K>encyrpted info here or atleast randomized passwords or something.

that would keep the bots from even being able to go into login/logon.js

Well, it's copyrighted, and mainly for use by VADV32 Sysops
only...it's really no good to anyone else.

But, the concept of a random CAPTCHA code, then to block these idiots
for say, 24 hours, might give them the hint...although the bots would
just assume the BBS is offline, and keep trying.

I saw the default temporary block IP value at 10 minutes?? Is it
practical to increase that to 24 hours, or is that too extreme??

Daryl

---
* OLX 1.53 * You'll win the lottery, & spend the winnings on The Sysop
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Daryl Stout wrote to DENN GRAY <=-

@VIA: VERT/TBOLT
@MSGID: <596C1DC8.526.dove-syncops@wx1der.dyndns.org>
@REPLY: <596BD99F.517.dove-syncops@outwestbbs.com>
@TZ: c168
Denn,

test it, it's pretty funny to get bombed by all those lines of text and the
system actually drops the connection before all the text is displayed.

Talk about "disconnect user with line noise". <G>

lol

Daryl

---
= OLX 1.53 = You'll have no other Sysop before me (just kidding).
= Synchronet = The Thunderbolt BBS - wx1der.dyndns.org

... Gone crazy, be back later, please leave message.
--- MultiMail/Linux v0.50
* Synchronet * Richard's Fun House - telnet://richardf.ddns.net
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Re: Guests logging in from "s
By: Daryl Stout to DENN GRAY on Sun Jul 16 2017 09:11 pm

test it, it's pretty funny to get bombed by all those lines of text
and the system actually drops the connection before all the text is
displayed.

Talk about "disconnect user with line noise". <G>

I decided to put 500 taglines in the badip.can instead.
I doubt it matters what is in there as long as they get a good text bombing.
It dosn't take long for them to give up after being blocked now.

"... Ever caught yourself reading taglines and skipping messages?"

---
* Synchronet * the Outwest BBS - outwestbbs.com Telnet - outwestbbs.com:23
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Re: Guests logging in from "s
By: Daryl Stout to KK4QBN on Sun Jul 16 2017 21:14:00

This is where ZUUL. the gatekeeper and keymaster would come in handy.
pass t encyrpted info here or atleast randomized passwords or
something.
that would keep the bots from even being able to go into
login/logon.js

Well, it's copyrighted, and mainly for use by VADV32 Sysops
only...it's really no good to anyone else.

But, the concept of a random CAPTCHA code, then to block these idiots
for say, 24 hours, might give them the hint...although the bots would
just assume the BBS is offline, and keep trying.

I was'nt speaking of Captcha, Only Zuul!

--

Tim Smith (KK4QBN)
KK4QBN BBS

---
* Synchronet * KK4QBN - kk4qbn.synchro.net - 7064229538 - Chatsworth GA USA
* Origin: Vertrauen - vert.synchro.net (1:103/705)

I was'nt speaking of Captcha, Only Zuul!

I know of Captcha and Zulu, but not Zuul.

Daryl

---
* OLX 1.53 * 12 Steps Chocolate Diet: 12 or less steps from chocolate.
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Daryl Stout wrote to KK4QBN <=-

@VIA: VERT/TBOLT
@MSGID: <596D664D.545.dove-syncops@wx1der.dyndns.org>
@REPLY: <596D23D3.2471.dove-syncops@kk4qbn.synchro.net>
@TZ: c168

I was'nt speaking of Captcha, Only Zuul!

I know of Captcha and Zulu, but not Zuul.

you never watched ghostbusters? Zuul is the demigod

Daryl

---
* OLX 1.53 * 12 Steps Chocolate Diet: 12 or less steps from chocolate.
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org

... MultiMail, the new multi-platform, multi-format offline reader!
--- MultiMail/Win32 v0.49
* Synchronet * Richard's Fun House - telnet://richardf.ddns.net
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Richard,

you never watched ghostbusters? Zuul is the demigod

The only thing I knew about Ghostbusters was the theme...never watched
it.

Daryl

---
* OLX 1.53 * 50 Days in the Saddle - By Capt. O. Blubalz
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Re: Guests logging in from "s
By: Daryl Stout to KK4QBN on Mon Jul 17 2017 20:27:00

I was'nt speaking of Captcha, Only Zuul!

I know of Captcha and Zulu, but not Zuul.

Zuul is written into the synchronet code, I believe to see if a specific terminal software was dialing in, hence before the Synchronet ver 3.1X copright pops up, syncronet ask "Are you they keymaster", and the client would answer, "Are you the gatekeeper"

I cant remember exactly what it was for.. maybe Rob will chime in on it :)

--

Tim Smith (KK4QBN)
KK4QBN BBS

---
* Synchronet * KK4QBN - kk4qbn.synchro.net - 7064229538 - Chatsworth GA USA
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Re: Guests logging in from "s
By: KK4QBN to Daryl Stout on Wed Jul 19 2017 10:58 am

Re: Guests logging in from "s
By: Daryl Stout to KK4QBN on Mon Jul 17 2017 20:27:00

I was'nt speaking of Captcha, Only Zuul!

I know of Captcha and Zulu, but not Zuul.

Zuul is written into the synchronet code, I believe to see if a specific terminal software was dialing in, hence before the Synchronet ver 3.1X copright pops up, syncronet ask "Are you they keymaster", and the client would answer, "Are you the gatekeeper"

I cant remember exactly what it was for.. maybe Rob will chime in on it :)

It's a pet project of Deuce. That was his "handshake". :-)

digital man

Synchronet "Real Fact" #27:
Rob Swindell (digital man) was born approximately 4 hours before the Unix epoch.
Norco, CA WX: 72.1oF, 70.0% humidity, 3 mph SSE wind, 0.00 inches rain/24hrs --- SBBSecho 3.01-Win32
* Origin: Vertrauen - vert.synchro.net (1:103/705)

I thought I saw some recent posts regarding this on Dove-Net, but now I don't N>see them.. Recently I've noticed a lot of Guest logins on my BBS with the N>location specified as "shell" or "sh". They don't seem to be doing any harm, N>but I'm wondering if there might be any cause for concern? It seems they mig N>be trying to run a command shell ('sh' etc.) to gain access, but that's just N>going into the location prompt during login, so I don't think it's going to d N>anything harmful. I've never seen any bots doing this until recently though. N>My BBS has been getting a lot of these Guest/shell logins lately, from many N>different IP addresses.

First, I forgot to add that to my name.can file -- thanks. The file is filling up with data. :P

Second, as Digital Man noted, "these are likely bots looking for a
Unix style prompt...but if they successfully logged in as 'root',
'admin', etc., they wouldn't know what to do...as they're looking for a
Unix Shell prompt, to further get into the system, and the Synchronet
command shell doesn't offer that...but they don't know that".

I use the login.js file in \sbbs\exec to block these twits.

Users specifically have to know they can log in as Guest, which makes me wond N>if people are starting to write attack scripts for Synchronet BBSes? I'm als N>using a login matrix with a lightbar menu, so people would have to specifical N>choose the option from the menu to use a guest account.. Unless they don't N>have ANSI, in which my BBS should revert to a more plain text login.

I'm using the AceMatrix logon, but don't have a Guest Logon option on
there. What they do is just logon as Guest, without a password. I've
noticed that SBBS will ask for the real name, email, and location "for
the BBS records". I even note on the matrix screen, that one can "logon
as GUEST, for a LIMITED view of the BBS...and that no password is
needed". But, I have to wonder if some of these even know how to read.
The newspaper is on an elementary school reading level, for crying out
loud.

I even got a message from the Guest account recently where someone asked me h N>to create a new user account. This makes me think there may be something mor N>than dumb scripts attacking BBSes now.

I knew a (now former) Sysop from the San Franciso Bay area years ago,
who had no idea what the AUTOEXEC and CONFIG files were for on her
system. I'm not sure if she was "blond" or not. <G>

Daryl

---
* OLX 1.53 * The Weather Is Here...Wish You Were Beautiful.
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Tim,

it is the Mirai bot, it gains access using the guest username, and sh, shell, K>admin, and other "popular" usernames are also passed and just happen to fill K>the field of "what is your location" question on guest sighn in.

I rarely check the guest logon info that is entered. I feel if they
want to contact me, they can email Feedback To Sysop.

all of these attempts I've seen try to pass 4 or 5 usernames, then just give K>up, I presume when whatever these bots are looking for is not found.

My heart bleeds. :P

Mirai does'nt know of BBS systems obviously, and hoepfully no one will decide K>that it should.

No kidding.

Daryl, WX1DER

---
* OLX 1.53 * A seminar on Time Travel will be held two weeks ago.
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)

Tim,

Thats pretty much what I was thinking too.. I did notice that something (not K>using any Mirai signature) but acting just like it gained access with the gue K>account and posted something on my postit wall that is in my login sequence K>before it went away. strangest thing I have seen, let me try to find the K>message.

I went ahead and changed the EZWall access (with the EZLogon Bulletins
deal) to access level of 50 or higher. So, that should keep guests from
seeing it.

Daryl

---
* OLX 1.53 * My day's ruined when I put my left sock on my right foot.
* Synchronet * The Thunderbolt BBS - wx1der.dyndns.org
* Origin: Vertrauen - vert.synchro.net (1:103/705)