Mercurial > prosody-modules
annotate mod_dnsbl/README.markdown @ 6319:04c3273cb81f
mod_auth_cyrus: Add empty 'profile' table to SASL handler objects
This is for compatibility with Prosody's built-in util.sasl objects.
A SASL profile table usually includes methods supported by the backend, which
can be used by SASL mechanism handlers to perform operations (such as testing
the password). It also optionally contains a 'cb' field with channel binding
method handlers.
The Cyrus backend doesn't support channel binding, and doesn't have the same
concept of auth backend methods (it handles all that internally, and Prosody
has no insight or control over it).
Thus, we create an empty profile which informs Prosody that the SASL handler
does not support any of the auth or channel binding methods. Some features
will not work, but they didn't work anyway. This just makes it explicit.
This fixes a traceback in mod_sasl2_fast, which expected SASL handlers to
always contain a 'profile' field.
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Thu, 04 Sep 2025 10:14:46 +0100 |
| parents | 99860e1b817d |
| children |
| rev | line source |
|---|---|
|
6133
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
1 --- |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
2 labels: |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
3 - 'Stage-Alpha' |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
4 summary: 'Flag accounts registered by IPs matching blocklists' |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
5 depends: |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
6 - mod_anti_spam |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
7 --- |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
8 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
9 This module is designed for servers with public registration enabled, and |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
10 makes it easier to identify accounts that have been registered by potentially |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
11 "bad" IP addresses, e.g. those that are likely to be used by spam bots. |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
12 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
13 **Note:** Running a Prosody instance with public registration enabled opens up |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
14 your server as a potential relay for spam and abuse, which can have a negative |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
15 impact on your server and the network as a whole. We do not recommended it |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
16 unless you have prior experience operating public internet services and are |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
17 prepared for the time and effort necessary to tackle any issues. For other |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
18 advice, see the Prosody documentation on [public servers](https://prosody.im/doc/public_servers). |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
19 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
20 ## How does it work? |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
21 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
22 When a user account is registered on your server, this module checks the user's |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
23 IP address against a list of configured blocklists. If a match is found, it |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
24 flags the account using [mod_flags]. |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
25 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
26 Flags can be reviewed and managed by using the mod_flags commands and flagged |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
27 accounts can be automatically restricted, e.g. by mod_firewall or similar. |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
28 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
29 This module supports two kinds of block lists: |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
30 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
31 - DNS blocklists (DNSBLs) |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
32 - Text files, with one IP/subnet per line |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
33 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
34 ## Configuration |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
35 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
36 **Note:** mod_dnsbl requires mod_anti_spam to be installed, but it does not |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
37 need to be enabled or loaded (only some code is shared). mod_flags is also |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
38 required, and this will be automatically loaded if not specified in the |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
39 config file. |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
40 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
41 The main configuration option is `dnsbls`, a list of DNSBL addresses: |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
42 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
43 ```lua |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
44 dnsbls = { |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
45 "dnsbl.dronebl.org"; |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
46 "cbl.abuseat.org"; |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
47 } |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
48 ``` |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
49 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
50 You can set a message to be sent to users who register from a matched IP |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
51 address: |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
52 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
53 ```lua |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
54 dnsbl_message = "Your IP address has been detected on a block list. Some functionality may be restricted." |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
55 ``` |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
56 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
57 You can change the default flag that is applied to accounts: |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
58 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
59 ```lua |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
60 dnsbl_flag = "dnsbl_hit" |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
61 ``` |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
62 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
63 ### File-based blocklists |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
64 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
65 As well as real DNSBLs, you can also put file-based blocklists here, by |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
66 prefixing `@` to a filesystem path (Prosody must have read permission to |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
67 access the file): |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
68 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
69 ```lua |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
70 dnsbls = { |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
71 "dnsbl.dronebl.org"; |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
72 "@/etc/prosody/ip_blocklist.txt"; |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
73 } |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
74 ``` |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
75 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
76 The file must contain a single IP address or subnet on each line, though blank |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
77 lines and comments are ignored. For example: |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
78 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
79 ``` |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
80 # This is a comment |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
81 203.0.113.0/24 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
82 2001:db8:7894::/64 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
83 ``` |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
84 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
85 File-based lists are automatically reloaded when you reload Prosody's |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
86 configuration. |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
87 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
88 ### Advanced configuration |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
89 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
90 You can override the flag and message on a per-blocklist basis with a slightly |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
91 more detailed configuration syntax: |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
92 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
93 ```lua |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
94 dnsbls = { |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
95 ["dnsbl.dronebl.org"] = { |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
96 flag = "dnsbl_hit"; |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
97 message = "Your account is restricted because your IP address has been detected as running an open proxy. For more information see https://dronebl.org/lookup?ip={registration.ip}"; |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
98 }; |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
99 ["@/etc/prosody/ip_blocklist.txt"] = { |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
100 flag = "local_blocklist"; |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
101 message = "Your account is restricted"; |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
102 }; |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
103 } |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
104 ``` |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
105 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
106 ## Compatibility |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
107 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
108 Compatible with Prosody 0.12 and later. |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
109 |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
110 If you are using Prosody 0.12, make sure you install mod_flags from the |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
111 community module repository. If you are using a later version, mod_flags is |
|
99860e1b817d
mod_dnsbl: Flag accounts registered by IPs matching blocklists
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
112 already included with Prosody. |
