##### ### ## ### ######## ### ## ### ###TM ####### ####### ####### ######## ####### ####### ####### ### ### ### ### ### ### ### ### ### ## ## ## ## ## ### ## ## ## ## ## ### ### ### ## ### ### ### ## ### ## ####### ####### ## ######## ### ####### ## ####### ##### ### ## ######## ### ### ## ## ##### Anti-Hammer Pro protect your valuable server resources for genuine clients.. (c) 2004->tomorrow! cor + corz.org ;o) Thanks to everyone who gave feedback on the betas! Itstory.. 0.9.8.2 + Improved checking for malformed referer information. 0.9.8 + SEO-Aware "magic" index requests. 0.9.7.* + Added the ability to disable access for bad URL's, like /etc/passwd + Added ability to validate User Agent strings, to protect against known bad bots, spiders and so forth. + You can now also disallow access to client who send an empty user agent string. + Added ability to ban IP Addresses from a simple IP Address list. 0.9.6 + Added the ability to validate referers and white/black list good and bad referers. There's a couple of new preferences (it's always worth checking new versions of software for new preferences!) and a fair chunk of new code. Search from the top for 'validate_referers' for all the juicy details. ~ Fixed a bug where new visitors could have their hammer count set to /almost/ the first trigger level. 0.9.5 ~ Minor fix for potentially logging error. 0.9.4 Enter Anti-Hammer Pro.. + The Data set used to create the individual client ID's can now be easily configured (a simple list). You can use everything (the default), or else identify clients by a smaller set of data, even a single element, i.e. the IP address, which could be useful in a number of situations. + Improved documentation. ~ Minor clean-ups and fixes. -=- -=- -=- -=- -=- -=- -=- -=- -=- -=- -=- -=- -=- -=- -=- -=- -=- -=- 0.9.3.2 The end of the line for Ant-Hammer FREE! + You now have the option to perform a quick DNS lookup of the IP Address of bad clients, and have this added to the logging. This was already enabled, you now have the option to *disable* it, if required. + Anti-Hammer now send a valid "Retry-After" header, which is set to the client's current hammer delay + 1 second. + Added a link to the Anti-Hammer page, should lessen the wtf-factor. 0.9.2 + You can now choose whether to allow your specified clients (aka "exemptions") to either completely bypass anti-hammer (current exemption method).. $anti_hammer['allow_bots'] = true; Or else specify an integer, representing a hammer_time, in 1/100th Second, which will apply to *only* these clients.. $anti_hammer['allow_bots'] = 50; This setting would enable your specified clients to hammer the site at a rate of two hits-per-second, but no faster. Effectively, we now have two hammer rates, one for known good clients, and one for everyone else. 0.9 + Good bots & spiders can now be allowed to bypass the hammer. This is achieved through the use of standard spider IP lists, as published here.. http://www.iplists.com/ along with a simple ini file, detailing which user-agent links to which IP list. A working ini, and more details, will be included in the preference section (above), as well as the release. 0.8.* + Anti-Hammer now sends a proper 503 (service temporarily unavailable) message, rather than a 200 OK message. This will be useful in situations where valid bots are temporarily hammering, and is more correct in this scenario. The reource *will* be back, if they cut out the crazy hammering! If you are running under cgi/*suexec (non-module), the extra required header is automatically sent. In use, this causes many bots to back-off immediately. Excellent! ~ Improved the ban resetting (which needs to work independantly of the Garbage collection mechanism). After the ban time, the client's cut-off is wiped, and their start time set to *now*, just like a new client, however, their hammer_count is set to one hammer below the first trigger level. In other words, a single hammer gets them the NO Hammer! page; and to the final page quicker than new clients. Even if you use rolling triggers, Anti_hammer will still use the first ban level to calculate this number, so set that to whatever you want. ~ ban_times and ban_levels have been renamed to waiting_times and trigger_levels, to avoid confusion with the ban_time (for the new total cut-off). These also make more sense, as they are not bans, simply delays. 0.7.* + Added rolling ban times. Rather than have set limits which the client can cross, this simply increments the ban time with each and every hammer attempt. 1-2-3-4-5-6-7.. etc. cut-off still functions as before for each system (rolling or preset levels). This was, in fact, the original system, which I replaced with the level presets early on, but it's kinda fun, and the code is simple. ~ Removed the file-tools.php include statement, and put the functions directly into here (slightly renamed). I figure anyone smart enough to be including my file-tools, will be smart enough to figure out how to put that back, if required. + More things are configurable, like the page title. Why not! 0.6.* + Added capability to work with clients who do not accept, or have chosen not to accept (read: disabled) cookies. Basically, we write a "fake" session. The fake session uses a serialized array in a flat file, just like regular php sessions, and is created before they even get receive their first page. From that point on, they are known (by Anti-Hammer) by this ID. The name of the client's session ID file is the session ID itself; an MD5 of all the known usable client data concatenated together. ~ php session usage is still available as an option, if required. + Added Garbage Collection for the fake session files. Both how often this happens (every 'so-many' requests), and how old is considered "stale", are configurable. + Ban time is now configurable (in hours). Remember to ensure that Garbage Collection isn't happening before this time. + Added penultimate message for cut-off. You get one *final* warning! ~ Cleaned-up the code regarding sessions. We now make a clean break, converting whichever type of session data into a local array, and then work with that. At the end, we write the pertinent data back to whichever type of session is being utilized (built-in or php). 0.5.* + You can now configure a cut-off point. When the number of violations reaches this number, their pages simply die. This is disabled by default. This point is, of course, configurable. (actually, I got called away in the middle of this, so I'll need to check how far I got!) 0.4.* + Added user preferences for lots of the settings, voilation levels, times, etc. Added error checking for these, so they should be fairly foolproof (good movie, by the way, "Foolproof", 2003). 0.3.* + Added configurable protection skipping for certain file types (usually associated files and such). This replaces a nasty hack that lived at the top of the script. + Added skipping for generated images, too (GD images, etc.). This can also be used to skip other tpyes. See the preferences for more details. + Added configurable messages. I'll likely put this out eventually, it's kinda useful. 0.2.* + Added ignored areas, for chat scripts and such. places where either hammering is allowed, or is dealt with by the local script. */