[Sommaire] [Imprimer]

   1  <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
   2  <html>
   3  <head>
   4    <title>Geeklog Documentation - Geeklog Spam-X Plugin</title>
   5    <link rel="stylesheet" type="text/css" href="docstyle.css" title="Dev Stylesheet">
   6    <meta name="robots" content="noindex">
   7  </head>
   8  
   9  <body>
  10  <table cellpadding="2" cellspacing="2" border="0" width="100%">
  11  <tr>
  12    <td valign="top"><img src="images/newlogo.gif" alt="Geeklog Documentation" width="243" height="90" border="0"></td>
  13  </tr>
  14  <tr>
  15    <td valign="top" class="menu"><a href="index.html">Geeklog Documentation</a> - Geeklog Spam-X Plugin</td>
  16  </tr>
  17  </table>
  18  
  19  <h1>Geeklog Spam-X Plugin</h1>
  20  
  21  <p><small>(If you came here looking for Hendrickson Software Components' email spam filter of the same name, please <a href="http://www.hendricom.com/spamcontrol.htm" rel="nofollow">click here</a>.)</small></p>
  22  
  23  <h2>Introduction</h2>
  24  
  25  <p>The Geeklog Spam-X plugin was created to fight the problem of comment spam
  26  for Geeklog systems. If you are unfamiliar with comment spam you might see the
  27  <a href="http://kalsey.com/2003/11/comment_spam_manifesto/">Comment Spam
  28  Manifesto</a>.</p>
  29  
  30  <p>Spam protection in Geeklog is mostly based on the Spam-X plugin, originally
  31  developed by Tom Willet. It has a modular architecture that allows it to be
  32  extended with new modules to fight the spammer's latest tricks, should the need
  33  arise.</p>
  34  
  35  <h2><a name="checked">What is being checked for spam?</a></h2>
  36  
  37  <p>Geeklog and the Spam-X plugin will check the following for spam:</p>
  38  
  39  <ul>
  40  <li>Story submissions</li>
  41  <li>Comments</li>
  42  <li>Trackbacks and Pingbacks</li>
  43  <li>Event submissions</li>
  44  <li>Link submissions</li>
  45  <li>The text sent with the "Email story to a friend" option</li>
  46  <li>Emails sent to users via the "send email" form from their profile page</li>
  47  <li>A user's profile</li>
  48  </ul>
  49  
  50  <h2><a name="modules">Module Types</a></h2>
  51  
  52  <p>The Spam-X plugin was built to be expandable to easily adapt to changes the
  53  comment spammers might make.  There are three types of modules: <a
  54  href="#examine">Examine</a>, <a href="#action">Action</a>, and <a
  55  href="#admin">Admin</a>. A new module is contained in a file and can simply be
  56  dropped in and it will be added to the plugin.</p>
  57  
  58  <h2><a name="examine">Examine Modules</a></h2>
  59  
  60  <p>Geeklog ships with the following examine modules:</p>
  61  
  62  <ul>
  63  <li><a href="#slv">Spam Link Verification (SLV)</a></li>
  64  <li><a href="#personal">Personal Blacklist</a></li>
  65  <li><a href="#ip">IP Filter</a></li>
  66  <li><a href="#ipofurl">IP of URL Filter</a></li>
  67  <li><a href="#header">HTTP Header Filter</a></li>
  68  </ul>
  69  
  70  <h3><a name="slv">Spam Link Verification (SLV)</a></h3>
  71  
  72  <p>SLV is a centralized, server-based service that examines posts made on
  73  websites and detects when certain links show up in unusually high numbers. In
  74  other words, when a spammer starts spamming a lot of sites with the same URLs
  75  and those sites all report to SLV, the system will recognize this as a spam
  76  wave and will flag posts containing these URLs as spam.</p>
  77  
  78  <p>In other words still, it's a dynamic blacklist that automatically updates
  79  itself when a spammer starts spamming for their site. And it can only get
  80  better (in terms of accuracy and reaction speed) the more sites use it.</p>
  81  
  82  <p>SLV is a free service run by Russ Jones at <a
  83  href="http://www.linksleeve.org/">www.linksleeve.org</a>.
  84  
  85  <p><strong><a name="slvprivacy">Privacy Notice:</a></strong>
  86  It should be stressed that using SLV means that information from your site
  87  is being sent to a third party's site. In some legislations you may have to
  88  inform your users about this fact - please check with your local privacy
  89  laws.</p>
  90  
  91  <p>Sending information to an external site may also be undesirable on some
  92  setups, e.g. on a company intranet. You can disable SLV support by removing the
  93  four files <tt>SLV.Examine.class.php</tt>, <tt>SLVbase.class.php</tt>,
  94  <tt>SLVreport.Action.class.php</tt>, and <tt>SLVwhitelist.Admin.class.php</tt>
  95   from your Spam-X directory (<tt>/path/to/geeklog/plugins/spamx</tt>). Or you
  96  can simply disable the Spam-X plugin entirely (or uninstall it).</p>
  97  
  98  <p>The SLV Examine and Action modules will extract all URLs from a post and
  99  only send those to SLV (i.e. the rest of the post's content is not being sent).
 100  They also remove any links that contain your Geeklog site's URL. In case a post
 101  does not contain any external links, the modules simply do not contact SLV at
 102  all.</p>
 103  
 104  
 105  <h3><a name="personal">Personal Blacklist</a></h3>
 106  
 107  <p>The Personal Blacklist module lets you add keywords and URLs that typically
 108  exist in spam posts. When you're being hit by spam, make sure to add the URLs
 109  of those spam posts to your Personal Blacklist so that they can be filtered out
 110  automatically, should the spammer try to post them again.</p>
 111  
 112  <p>This will also help you get rid of spam that made it through, as you can
 113  then use the Mass Delete Comments and Mass Delete Trackbacks modules to easily
 114  remove large numbers of spam posts from your database.</p>
 115  
 116  <p>The Personal Blacklist also has an option to import the Geeklog <a
 117  href="config.html#desc_censorlist">censor list</a> and ban all comments which
 118  contain one of those words. This or an expanded list might be useful for a
 119  website that caters to children. Then no comments with offensive language could
 120  be posted.</p>
 121  
 122  <h3><a name="ip">IP Filter</a></h3>
 123  
 124  <p>Sometimes you will encounter spam that is coming from one or only a few IP
 125  addresses. By simply adding those IP addresses to the IP Filter module, any
 126  posts from these IPs will be blocked automatically.</p>
 127  
 128  <p>Please note that IP addresses aren't really a good filter criterion. While
 129  some ISPs and hosting services are known to host spammers, it won't help much
 130  to block an IP address by one of the well-known ISPs. Often, the spammer will
 131  get a new IP address the next time he connects to the internet, while the
 132  blocked IP address will be reused and may be used by some innocent user.</p>
 133  
 134  <h3><a name="ipofurl">IP of URL Filter</a></h3>
 135  
 136  <p>This module is only useful in a few special cases: Here you enter the IP
 137  address of a webserver that is used to host domains for which you may see spam.
 138  Some spammers have a lot of their sites on only a few webservers, so instead of
 139  adding lots of domains to your blacklist, you only add the IP addresses of
 140  those webservers. The Spam-X module will then check all the URLs in a post to
 141  see if any of these is hosted on one of those blacklisted webservers.</p>
 142  
 143  <h3><a name="header">HTTP Header Filter</a></h3>
 144  
 145  <p>This module lets you filter for certain HTTP headers. Every HTTP request
 146  sent to your site is accompanied by a series of headers identifying, for
 147  example, the browser that your visitors uses, their preferred language, and
 148  other information.</p>
 149  
 150  <p>With the Header filter module, you can block HTTP requests with certain
 151  headers. For example, some spammers are using Perl scripts to send their spam
 152  posts. The user agent (browser identification) sent by Perl scripts is usually
 153  something like "libwww-perl/5.805" (the version number may vary). So to block
 154  posts made by this user agent, you would enter:</p>
 155  <table border="0" style="width:15em">
 156  <tr><td><b>Header:</b></td><td align="left"><kbd>User-Agent</kbd></td></tr>
 157  <tr><td><b>Content:</b></td><td align="left"><kbd>^libwww-perl</kbd></td></tr>
 158  </table>
 159  <p>This would block all posts from user agents beginning with "libwww-perl".</p>
 160  
 161  
 162  <h2><a name="action">Action Modules</a></h2>
 163  
 164  <p>Once one of the <a href="#examine">examine modules</a> detects a spam post,
 165  the action modules will decide what to do with the spam. Most of the time, you
 166  will simply want to delete the post then, so this is what the <b>Delete
 167  Action</b> module does.</p>
 168  
 169  <p>As the name implies, the <b>Mail Admin Action</b> module sends an email to
 170  the site admin when a spam post is encountered. Since this can cause quite a
 171  lot of emails being sent, it is disabled by default.</p>
 172  
 173  <p>Action modules have to be enabled specifically before they are used (examine
 174  modules, on the other hand, are activated by simply dropping them into the
 175  Spam-X directory). For this, every action module has a unique number that needs
 176  to be added up with the number of the other action modules you want to enable
 177  and entered as the value for the <a href="config.html#desc_spamx">spamx config
 178  variable</a> in Geeklog's main <tt>config.php</tt> file.</p>
 179  
 180  <h3>Example</h3>
 181  
 182  <p>The Delete Action module has the value 128, while the Mail Admin Action
 183  module has the value 8. So to activate both modules, add 128 + 8 = 136 and
 184  enter that in your config.php:</p>
 185  
 186  <pre>    $_CONF['spamx'] = 136;</pre>
 187  
 188  <p>The SLV Examine module is complemented by a <strong>SLV Action</strong>
 189  module that ensures that SLV is notified of spam posts caught by other examine
 190  modules. It "piggybacks" on the Delete Action module, i.e. when you activate
 191  the Delete Action module, you'll also enable the SLV Action module.</p>
 192  
 193  
 194  <h2><a name="admin">Admin Modules</a></h2>
 195  
 196  <p>The Admin modules for the <a href="#personal">Personal Blacklist</a>, <a
 197  href="#ip">IP Filter</a>, <a href="#ipofurl">IP of URL Filter</a>, and <a
 198  href="#header">HTTP Header Filter</a> modules provide you with a form to add
 199  new entries. To delete an existing entry, simply click on it.</p>
 200  
 201  <p>With the <strong>SLV Whitelist</strong> admin module you can add URLs that
 202  you don't want to be reported to SLV. This is useful when posts on your site
 203  happen to contain certain URLs quite often but you don't want those to be
 204  considered spam by SLV.<br>Note that your site's URL (i.e. <a
 205  href="config.html#desc_site_url">$_CONF['site_url']</a>) is automatically
 206  whitelisted, so you don't need to add it here.</p>
 207  
 208  <p>The <strong>Log View</strong> module lets you inspect and clear the Spam-X
 209  logfile. The logfile contains additional information about the spam posts, e.g.
 210  which IP address they came from, the user id (if posted by a logged-in user),
 211  and which of the examine modules caught the spam post.</p>
 212  
 213  <p>In case a large number of spam posts made it through without being caught,
 214  the <strong>Mass Delete Comments</strong> and <strong>Mass Delete
 215  Trackbacks</strong> modules will help you get rid of them easily. Before you
 216  use these modules, make sure to add the URLs or keywords from those spams to
 217  your Personal Blacklist.</p>
 218  
 219  <h2><a name="mt-blacklist">Note about MT-Blacklist</a></h2>
 220  
 221  <p>MT-Blacklist was a blacklist, i.e. a listing of URLs that were used in spam
 222  posts, originally developed for Movable Type (hence the name) and maintained by
 223  Jay Allen.</p>
 224  
 225  <p>Maintaining a blacklist is a lot of work, and you're continually playing
 226  catch-up with the spammers. Therefore, Jay Allen eventually <a
 227  href="http://www.geeklog.net/article.php/mt-blacklist-discontinued">discontinued
 228  MT-Blacklist</a> on the assumption that new and better methods to detect spam
 229  are now available.</p>
 230  
 231  <p>Starting with Geeklog 1.4.1, Geeklog no longer uses MT-Blacklist. All
 232  MT-Blacklist entries are removed from the database when you upgrade to
 233  Geeklog 1.4.1 and the MT-Blacklist examine and admin modules are no longer
 234  included.</p>
 235  
 236  <h2><a name="trackback">Trackback Spam</a></h2>
 237  
 238  <p><a href="trackback.html">Trackbacks</a> are also run through Spam-X before
 239  they will be accepted by Geeklog. There are also some additional checks that
 240  can be performed on trackbacks: Geeklog can be configured to check if the site
 241  that supposedly sent the trackback actually contains a link back to your site.
 242  In addition, Geeklog can also check if the IP address of the site in the
 243  trackback URL matches the IP address that sent the trackback. Trackbacks that
 244  fail any of these tests are usually spam. Please refer to the <a
 245  href="config.html#desc_check_trackback_link">config.php documentation</a> for
 246  more information.</p>
 247  
 248  <h2><a name="config.php">Configuration File</a></h2>
 249  
 250  <p>The Spam-X plugin has its own configuration file, located at <tt>/path/to/geeklog/plugins/spamx/config.php</tt>. There you will find the following options:</p>
 251  
 252  <table>
 253  <tr><th width="25%">Variable</th>
 254      <th width="25%">Default Value</th>
 255      <th width="50%">Description</th>
 256  </tr>
 257  <tr>
 258    <td><a name="desc_action">action</a></td>
 259    <td>128</td>
 260    <td>This only exists as a fallback in case <a
 261      href="config.html#desc_spamx">$_CONF['spamx']</a> in Geeklog's main
 262      <tt>config.php</tt> is not set. I.e. <code>$_CONF['spamx']</code> takes
 263      precedence.</td>
 264  </tr>
 265  <tr class="r2">
 266    <td><a name="desc_admin_override">admin_override</a></td>
 267    <td>false</td>
 268    <td>The Spam-X plugin will filter posts by any user - even site admins. This
 269      can be a problem sometimes, e.g. when you want to post a note about spam
 270      that itself contains "spammy" URLs or keywords. When this option is set to
 271      <code>true</code> then posts made by users in the 'spamx Admin' group are
 272      not checked for spam.</td>
 273  </tr>
 274  <tr>
 275    <td><a name="desc_logging">logging</a></td>
 276    <td><code>true</code></td>
 277    <td>Whether to log recognized spam posts in the <tt>spamx.log</tt> logfile
 278      (if set to <code>true</code>) or not (<code>false</code>).</td>
 279  </tr>
 280  <tr class="r2">
 281    <td><a name="desc_notification_email">notification_email</a></td>
 282    <td><code>$_CONF['site_mail']</code></td>
 283    <td>Email address to which spam notifications are sent when the Mail Admin
 284      <a href="#action">action module</a> is enabled.</td>
 285  </tr>
 286  <tr>
 287    <td><a name="desc_timeout">timeout</a></td>
 288    <td>5</td>
 289    <td>Timeout (in seconds) for contacting external services such as SLV.</td>
 290  </tr>
 291  </table>
 292  
 293  <h2><a name="more">More Information</a></h2>
 294  
 295  <p>Further information as well as a support forum for the Spam-X plugin can be
 296  found on the <a href="http://www.pigstye.net/gplugs/staticpages/index.php/spamx" rel="nofollow">Spam-X Plugin's Homepage</a> and in the <a
 297  href="http://wiki.geeklog.net/wiki/index.php/Dealing_with_Spam">Geeklog
 298  Wiki</a>.</p>
 299  
 300  <table border="0" width="100%" class="footer">
 301  <tr valign="top">
 302    <td colspan="2"><a href="http://wiki.geeklog.net/">The Geeklog Documentation Project</a><br>
 303      All trademarks and copyrights on this page are owned by their respective owners. GeekLog is copyleft.</td>
 304  </tr>
 305  </table>
 306  
 307  </body>
 308  </html>