Modsecurity ACL rules to stop spam

bsasninja · Apr 30, 2007

freedman · Apr 30, 2007

bsasninja said:
I was receiving a lot bounces at the Exim queue caused by spam posted in contact forms. So I setup this rule at /etc/httpd/conf/modsec.user.conf (also works for post made in guestbooks or forums)

All post containing the specified words will be refused with a 406 error.

In this case we block viagra, pharmacy, mortgage, loan, Anatrim, casino, etc words.
...

lets hope none of your hosting clients are running a financial forum.. they'll be disappointed.

I think being aggressive about spam is a great thing, but there's such a thing as too much.
ideally, you should be watching for multiple similar posts and then multiple repeated posts from the same IP's...

encouraging people to use forum software which has anti-spam features will be a much better solution.

I tend to recommend phorum ( www.phorum.org ),
there are also akismet plugins for wordpress, etc...

this way, if someone does have a forum wherein people would legitimately discuss the things you're blocking, they wont have issues.

bsasninja · Apr 30, 2007

Anyways I dont have clients running gambling, drugs, sex sites (cause i dont accept them)
and if that was the case I just disable the rules for that specific domain.

Here is a link with some handy rules to stop this types of referrer spam http://www.ilovejackdaniels.com/apache/block-referrer-spam/

Thread starter	Similar threads	Forum	Replies	Date
N	ModSecurity Vendors OWASP generates a lot of errors in APACHE	Security	20	Sep 6, 2021
	No ModSecurity™ Domain Manager in cPanel	Security	4	Aug 3, 2021
R	cPanel ModSecurity False Positives & Missing Data...	Security	7	Apr 29, 2021
S	ModSecurity is missing connections it also blocks.	Security	10	Apr 21, 2021
M	Disable ModSecurity on default vhost	Security	3	Mar 1, 2021

Search

Search

Modsecurity ACL rules to stop spam

bsasninja

Well-Known Member

freedman

Well-Known Member

bsasninja

Well-Known Member