SpamTrawler Integration

[[R] NuclearGeneral]

SpamTrawler Traffic Management and Security Suite - Integration

 

Founded in 2010 we have been working with customers using a wide range of CMS, Social Networking and Blogging platforms like SocialEngine, Wordpress and PHPfox.

Over these years SpamTrawler has evolved from a simple "IP and Country blacklist" into a fully featured product assisting administrators with a variety of otherwise tedious and frustrating daily tasks.

The suite consists of various reporting, filter and scan functionalities which help administrators keeping their websites clean from undesired traffic/content (spam) and unapproved file-system modifications.

While some of our customers have already been using SpamTrawler with their IPB powered websites, we have decided it is now time to release an official hook providing a convenient way of integration and control.

This hook integrates an existing SpamTrawler installation into your instance of IPB.

 

Please find a short overview of the functionality included with SpamTrawler below.

 

Statistics

SpamTrawler’s admin dashboard contains a variety of charts and statistics giving administrators a deep insight into how the firewall is performing.

 

 

Firewall

Enables administrators to shape traffic to their requirements and prevent access to known and emerging offenders.

 

The firewall consists of the following pre-integrated filters:

• URL Parameter
• Country (Allow and Deny mode, possibility to use either MaxMind or IP2Location databses)
• IP (Local black-/grey-/whitelist as well as a community maintained blacklist)
• IP Ranges (Local Black-/Whitelist)
• Hostname (Black-/Whitelist)
• Organization (MaxMind IP2Organization database required)
• Character Set (Chinese, Japanese, Cyrillic)
• Honeypot Fields (Monitors hidden form fields for content)
• User agent
• Referrer
• Username
• Intrusion Detection (Based on PHPIDS)
• Email (Local and community maintained blacklist and limiting of digits)
• ProjectHoneypot
• DNSBL
• URLBL
• Google SafeBrowsing
• Hooks (Pre-packed hooks: Stop Forum Spam & CleanTalk)
• Selective Captcha (Can be activated/deactivated by filter and or GeoLocation)

Actions to be taken by the firewall for blocked visitors can be chosen from:

• Exit (With freely definable exit message via WYSIWYG editor including placeholders)
• Redirect
• SetConstant (In order to process blocked users by custom functionality in the respective host system)
• 403 Error (Access Denied)

Server Overload Protection

SpamTrawler provides an overload protection feature to protect the web server from overload situations. A typical form of overload protection/load regulation is to reject further requests when the load increases.

Available actions are:

• Exit (With freely definable exit message via WYSIWYG editor)
• Redirect
• Skip SpamTrawler (Firewall is not executed)

 

Maintenance Mode

Enables administrators to set an exit message or redirect visitors to a freely definable URL for all sites protected by the same SpamTrawler installation.

 

 

File Integrity

Enables administrators to continuously monitor and assess file system integrity preventing unwanted modifications, deletions and additions.

 

The "File Integrity Section" consists of the following functionality:

• File System Signatures (Create and Compare)
• Find Files by Content
• Find Files by Name
• Find Files Modified within the last 24 hours
• Check Permissions
• Virus Scanner (ClamAV wrapper)
• Malware Scanner (Linux Malware Detect wrapper)

These functionalities can be used wither manually from within the SpamTrawler admin panel or automated via cron jobs using SpamTrawler’s API

 

Maps

Gives a geographical traffic overview using Google Maps

 

 

A few words on performance

SpamTrawler is in use on approximately 900 websites some of which receiving large amounts of traffic without known performance issues.

This is due to the extensive use of caching mechanisms keeping database interaction and latency at a minimum.

Once filtered, subsequent visits do not require database interaction for a freely definable amount of time (Cache Timeout)

 

Caching can be configured to use any of the following back ends:

• FileSystem (Standard)
• Memcached (Enables usage in load balanced environments)
• APC
• XCache
• SQLite
• Blackhole (No Caching, can be used in load balanced environments)

 

Support Note

This hook as well as SpamTrawler are supported via our forums and support ticket system.

 

View the full article at IPS Resources