You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@openoffice.apache.org by Dean Webber <de...@student.uq.edu.au> on 2026/02/01 06:02:08 UTC
Re: Unable to access on forums and wiki
> I’ve used a new tool from ASF Infra to block a couple of data centers with bad connection requests.
It would be interesting to know how this is achieved,
One way is to use AS (autonomous system, very large network or group of networks with a single routing policy) blocking.
This can be achieved using local tools, and creating a blocklist, or hardware firewalls.
I would recommend blocking AS24940, AS16276, AS14061, AS51167, AS16509, AS8075, AS396982, AS136907.
You can generate lists using, bgpq4, to generate lists that you can use, supporting a wide output for hardware.
Or you can define output format, such as bgpq4 -F "%n\\n" AS24940.
From the above list, "bgpq4 -F "%n\\n" AS24940 AS16276 AS14061 AS16509 AS8075 AS396982 AS136907 > output" gives a file with 36 945 address. Even just using these tools to see where this traffic is coming from is helpful.
There are many autonomous systems that should be filtered, or monitored.
I also asked a question recently to Brave (Kit), and it replied with an answer from the public email archive in very recent history. It would be worth investigating where the traffic comes from, as what the intention of the connection.
If it is a web scraper, you could feed it to a tarpit, https://arstechnica.com/tech-policy/2025/01/ai-haters-build-tarpits-to-trap-and-trick-ai-scrapers-that-ignore-robots-txt/. This has varying levels of success.
Otherwise, BGP filtering will allow you to get rid of a bunch of bad connections. Some should be outright blocked, others can be monitored for abuse, and rejected upon x request in a given time.
All the best.
________________________________
From: Dave Fisher <wa...@apache.org>
Sent: 30 January 2026 02:53
To: dev <de...@openoffice.apache.org>
Subject: Re: Unable to access on forums and wiki
I’ve used a new tool from ASF Infra to block a couple of data centers with bad connection requests.
I then restarted the services.
The site appears to be better.
> On Jan 29, 2026, at 12:40 AM, Dick Groskamp <di...@apache.org> wrote:
>
> And again today.
>
> On 2026/01/08 07:37:04 club.acsi@free.fr wrote:
>> Since this morning, access was very slow
>>
>> But now, I got timeout
>>
>> Thanks to restore it
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Unable to access on forums and wiki
Posted by Dave Fisher <wa...@apache.org>.
I have tightened up and separated php pooling so that wiki and forums are separated.
Trouble is caused by back pressure from the database. It turns out that forum session tables needed a specific index created and while they are cleaned up there is an overuse on the Hungarian forum which was causing contention.
I plan to setup blocking for aggressive spiders in the apache configuration tomorrow.
Here is the list:
# Known aggressive bots
SetEnvIfNoCase User-Agent "Bytespider" bad_bot
SetEnvIfNoCase User-Agent "MJ12bot" bad_bot
SetEnvIfNoCase User-Agent "AhrefsBot" bad_bot
SetEnvIfNoCase User-Agent "SemrushBot" bad_bot
Let me know if you know others to add.
Let’s see what the next 24 hours brings.
Best,
Dave
> On Feb 1, 2026, at 1:42 PM, Dave Fisher <wa...@apache.org> wrote:
>
>
>
>> On Jan 31, 2026, at 10:02 PM, Dean Webber <de...@student.uq.edu.au> wrote:
>>
>>> I’ve used a new tool from ASF Infra to block a couple of data centers with bad connection requests.
>>
>> It would be interesting to know how this is achieved,
>> One way is to use AS (autonomous system, very large network or group of networks with a single routing policy) blocking.
>> This can be achieved using local tools, and creating a blocklist, or hardware firewalls.
>>
>> I would recommend blocking AS24940, AS16276, AS14061, AS51167, AS16509, AS8075, AS396982, AS136907.
>> You can generate lists using, bgpq4, to generate lists that you can use, supporting a wide output for hardware.
>> Or you can define output format, such as bgpq4 -F "%n\\n" AS24940.
>>
>> From the above list, "bgpq4 -F "%n\\n" AS24940 AS16276 AS14061 AS16509 AS8075 AS396982 AS136907 > output" gives a file with 36 945 address. Even just using these tools to see where this traffic is coming from is helpful.
>
> If you wish to help then please share more details about this output on sysadmin@openoffice.apache.org and I can at least see if we see these ip in the logs.
>
>> There are many autonomous systems that should be filtered, or monitored.
>
> We do have deny lists and can support manual changes to these filters.
>
>> I also asked a question recently to Brave (Kit), and it replied with an answer from the public email archive in very recent history. It would be worth investigating where the traffic comes from, as what the intention of the connection.
>>
>> If it is a web scraper, you could feed it to a tarpit, https://arstechnica.com/tech-policy/2025/01/ai-haters-build-tarpits-to-trap-and-trick-ai-scrapers-that-ignore-robots-txt/. This has varying levels of success.
>
> For me just setting up a tarpit is a personal “tarpit”.
>
>>
>> Otherwise, BGP filtering will allow you to get rid of a bunch of bad connections. Some should be outright blocked, others can be monitored for abuse, and rejected upon x request in a given time.
>
> The tuning I am working on is starting to stop bad requests before they get to the php layer.
>
> Last year I put aggressive IP blocking in place and we have a large deny list (and a small allowlist) built over time.
>
> The latest set of trouble has included slow loris connections and that is mitigated. Otherwise we have the usual scanners trying phpBB style requests w/o knowing our unique organization.
>
> I’ll need to revisit the deny list process (python code that counts IPs in access logs) to include looks in the error logs for specific errors which should show bad actors more quickly.
>
> Best,
> Dave
>
>>
>> All the best.
>>
>> ________________________________
>> From: Dave Fisher <wa...@apache.org>
>> Sent: 30 January 2026 02:53
>> To: dev <de...@openoffice.apache.org>
>> Subject: Re: Unable to access on forums and wiki
>>
>> I’ve used a new tool from ASF Infra to block a couple of data centers with bad connection requests.
>>
>> I then restarted the services.
>>
>> The site appears to be better.
>>
>>> On Jan 29, 2026, at 12:40 AM, Dick Groskamp <di...@apache.org> wrote:
>>>
>>> And again today.
>>>
>>> On 2026/01/08 07:37:04 club.acsi@free.fr wrote:
>>>> Since this morning, access was very slow
>>>>
>>>> But now, I got timeout
>>>>
>>>> Thanks to restore it
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Unable to access on forums and wiki
Posted by Dave Fisher <wa...@apache.org>.
> On Jan 31, 2026, at 10:02 PM, Dean Webber <de...@student.uq.edu.au> wrote:
>
>> I’ve used a new tool from ASF Infra to block a couple of data centers with bad connection requests.
>
> It would be interesting to know how this is achieved,
> One way is to use AS (autonomous system, very large network or group of networks with a single routing policy) blocking.
> This can be achieved using local tools, and creating a blocklist, or hardware firewalls.
>
> I would recommend blocking AS24940, AS16276, AS14061, AS51167, AS16509, AS8075, AS396982, AS136907.
> You can generate lists using, bgpq4, to generate lists that you can use, supporting a wide output for hardware.
> Or you can define output format, such as bgpq4 -F "%n\\n" AS24940.
>
> From the above list, "bgpq4 -F "%n\\n" AS24940 AS16276 AS14061 AS16509 AS8075 AS396982 AS136907 > output" gives a file with 36 945 address. Even just using these tools to see where this traffic is coming from is helpful.
If you wish to help then please share more details about this output on sysadmin@openoffice.apache.org and I can at least see if we see these ip in the logs.
> There are many autonomous systems that should be filtered, or monitored.
We do have deny lists and can support manual changes to these filters.
> I also asked a question recently to Brave (Kit), and it replied with an answer from the public email archive in very recent history. It would be worth investigating where the traffic comes from, as what the intention of the connection.
>
> If it is a web scraper, you could feed it to a tarpit, https://arstechnica.com/tech-policy/2025/01/ai-haters-build-tarpits-to-trap-and-trick-ai-scrapers-that-ignore-robots-txt/. This has varying levels of success.
For me just setting up a tarpit is a personal “tarpit”.
>
> Otherwise, BGP filtering will allow you to get rid of a bunch of bad connections. Some should be outright blocked, others can be monitored for abuse, and rejected upon x request in a given time.
The tuning I am working on is starting to stop bad requests before they get to the php layer.
Last year I put aggressive IP blocking in place and we have a large deny list (and a small allowlist) built over time.
The latest set of trouble has included slow loris connections and that is mitigated. Otherwise we have the usual scanners trying phpBB style requests w/o knowing our unique organization.
I’ll need to revisit the deny list process (python code that counts IPs in access logs) to include looks in the error logs for specific errors which should show bad actors more quickly.
Best,
Dave
>
> All the best.
>
> ________________________________
> From: Dave Fisher <wa...@apache.org>
> Sent: 30 January 2026 02:53
> To: dev <de...@openoffice.apache.org>
> Subject: Re: Unable to access on forums and wiki
>
> I’ve used a new tool from ASF Infra to block a couple of data centers with bad connection requests.
>
> I then restarted the services.
>
> The site appears to be better.
>
>> On Jan 29, 2026, at 12:40 AM, Dick Groskamp <di...@apache.org> wrote:
>>
>> And again today.
>>
>> On 2026/01/08 07:37:04 club.acsi@free.fr wrote:
>>> Since this morning, access was very slow
>>>
>>> But now, I got timeout
>>>
>>> Thanks to restore it
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
>> For additional commands, e-mail: dev-help@openoffice.apache.org
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Unable to access on forums and wiki
Posted by Dave Fisher <wa...@apache.org>.
Today’s improvements.
1. I am now adding Bytedance’s spider from both the Forums and Wikis. I tracked requests from 17,000 IP addresses today. Bad, bad, Bytedance, be better. I feel like sending them an invoice.
2. I’ve tuned the Apache and php fpm workers to be balanced.
Response times seem to be in decent shape.
We are averaging about 100,000 requests an hour on across the 10 forums including 403 on denied requests.
Best,
Dave
> On Feb 2, 2026, at 1:26 AM, Rory O'Farrell <of...@iol.ie> wrote:
>
> On Mon, 02 Feb 2026 07:39:53 +0100
> club.acsi@free.fr wrote:
>
>> All day Sunday and again this morning, no access.
>
> A comment, not a criticism: it has been very slow - minutes for log-in - but one gets there in the end with patience! I leave a window logging in and visit some other site while waiting.
>
> I appreciate the difficulties sys-admins have with these repeated attacks and the effort it requires for then to counteract such malice.
>
> --
> Rory O'Farrell <of...@iol.ie>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
> For additional commands, e-mail: dev-help@openoffice.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Unable to access on forums and wiki
Posted by Rory O'Farrell <of...@iol.ie>.
On Mon, 02 Feb 2026 07:39:53 +0100
club.acsi@free.fr wrote:
> All day Sunday and again this morning, no access.
A comment, not a criticism: it has been very slow - minutes for log-in - but one gets there in the end with patience! I leave a window logging in and visit some other site while waiting.
I appreciate the difficulties sys-admins have with these repeated attacks and the effort it requires for then to counteract such malice.
--
Rory O'Farrell <of...@iol.ie>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: Unable to access on forums and wiki
Posted by cl...@free.fr.
All day Sunday and again this morning, no access.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org