Stuff…

What development board to use? is a nice little article covering dev boards from $0-$150 price range.   Found the site and link on http://biobug.org/.  Thanks Will.

In post WordPress trackback spam I setup some rudimentry mod_security rules to block duplicate trackback spam attempts from known spammer IPs.  This stopped quite a few since implementation: 1449 in one day.

However, I’m still getting a lot of trackback comment spam.

Following the experiences from the blog post below I’m going to add some more mod_security rules to check RBLs on POST’ed queries.

• Blocking comment spam using Mod Security

Start with the following rule and will add more later.

SecRule REQUEST_METHOD “^post$” “log,deny,chain,msg:’LOCAL comment spammer at rbl cbl.abuseat.org’”
SecRule REMOTE_ADDR “@rbl cbl.abuseat.org”

Didn’t want to add the RBL to all queries as the will slow down each page load so we focus on POST queries to start with.

Start receiving 1000′s of trackback spam comments on previous post articles.  Very annoying considering we were receiving lots of emails for each of these.

Decided to install mod_security and block and IP that does the trackbacks and will also add some RBL look ups later on.

Installed mod_security with:

apt-get install libapache-mod-security mod-security-common

Used parts from:

• http://www.howtoforge.com/apache_mod_security
• http://www.atomicorp.com/wiki/index.php/Atomic_ModSecurity_Rules
• http://www.gotroot.com/mod_security+rules

Used pmFromFile example listed here:

• http://www.modsecurity.org/documentation/modsecurity-apache/2.5.12/html-multipage/operators.html

Got the spammers IP address with:

mysql -D wp_db -Ns -e ‘select distinct comment_author_IP from wp_comments where comment_approved = 0′ > ip_blacklist.txt

There were over 1200 duplicate IP posts so we used distinct to make each IP unique in our list.

Created a new mod security .conf file containing:

SecAction “phase:1,pass,nolog,setvar:tx.remote_addr=/%{REMOTE_ADDR}/”

SecRule TX:REMOTE_ADDR “@pmFromFile ip_blacklist.txt” “deny,status:403

SecAction “phase:1,pass,nolog,setvar:tx.remote_addr=/%{REMOTE_ADDR}/”SecRule TX:REMOTE_ADDR “@pmFromFile ip_blacklist.txt” “deny,status:403

And then deleted all the trackback comment posts that were not approved with:

delete from wp_comments WHERE comment_approved =”0″

Links for deleting comments:

• http://gnoted.com/how-to-delete-all-pending-comments-in-one-click-wordpress/
• http://www.blogopreneur.com/2009/04/08/mass-delete-pending-comments-from-wordpress/

Going to look at the other RBLs to see if it is worth utilising them but don’t want to impact page load time.

So far in about 30 minutes 38 trackback spam comments have been blocked.

Another list of ways to combat spam:

• http://codex.wordpress.org/Combating_Comment_Spam

It seems like the Plesk developers have decided to do the following during the upgrade process, which, seems like a bad idea:

===> Installing Apache Server

Trying to stop service httpd… done

Copying apache files… done

===> Installing Quotas

Trying to change quota limits… done

Run quotacheck. This may take some time.

quotacheck: Scanning /dev/md1 [/]

Received a number of issues running a PHP site under FastCGI on Plesk 9.5.3 / CentOS 5.5 64 bit.  Saw a number of errors in the error log:

[warn] (103)Software caused connection abort: mod_fcgid: ap_pass_brigade failed in handle_request function
[warn] (110)Connection timed out: mod_fcgid: ap_pass_brigade failed in handle_request function
[warn] mod_fcgid: can’t apply process slot for …/index.php

It looked like only 5 php-cgi processes were running (max) so increased this to 25 in the /etc/httpd/conf.d/fcgid.conf file:

# cat /etc/httpd/conf.d/fcgid.conf

# added by psa-mod-fcgid-configurator

LoadModule fcgid_module /usr/lib64/httpd/modules/mod_fcgid.so

<IfModule mod_fcgid.c>

SocketPath /var/lib/httpd/fcgid/sock

</IfModule>

# added by psa-mod-fcgid-configurator

<IfModule mod_fcgid.c>

IdleTimeout 3600

ProcessLifeTime 7200

MaxProcessCount 64

DefaultMaxClassProcessCount 25

IPCConnectTimeout 300

IPCCommTimeout 60

DefaultInitEnv RAILS_ENV production

</IfModule>