Cafuego - spam

drupal webforms and recaptcha

cafuego — Sun, 22 Feb 2009 00:15:07 +0000

One of the great features of Drupal is that you can so easily extend its functionality with modules.

For example, the webform module allows you to gather information from users by creating forms using all available HTML form elements and then store these responses in a database and send an email. All without needing to write any PHP code.

One problem with forms on web pages though, is that spammers tend to find them very quickly and try to find vulnerabilities in them that allow them to use the form to send email about viagra and cheap rolex watches to any number of unsuspecting victims. Even if the form is not vulnerable, you'll still end up with hundreds or thousands of spam entries in the database and your email inbox. Very annoying.

Drupal has a solution for this too; the recaptcha module allows you to automatically place a widget on any form, that forces the user to enter two random words before the form can be submitted. It is very hard for software to decipher these words, so it makes the form useless for spammers.

When you create a form, its node ID is used to generate an identifier that you can add to the recaptcha administration page, so automatically have the captcha challenge added to your form. For instance, if your form node ID is 42, the identifier will be webform-client-form-42.

There is one slight issue though; if you try to enter this identifier in the captcha the admin page will say Illegal form_id. Not helpful.

It turns out that you need to convert all hyphens to underscores when you enter the form identifier. So instead of webform-client-form-42 you enter webform_client_form_42.

And as if by magic, the spam stops! :-)

Trackback URL for this post:

http://cafuego.net/trackback/304

spam

cafuego — Wed, 05 Nov 2008 04:43:09 +0000

Dear intertubes,

Until such time as there is an officially announced result in the US elections, I do not need estimated outcomes from absolutely everyone on the minute, every minute.

kthxbai

Trackback URL for this post:

http://cafuego.net/trackback/243

DKIM for Postfix

cafuego — Thu, 25 Sep 2008 08:13:07 +0000

After a fairly long and frustrating day, I finally have DKIM working with Postfix on Etch. I was assuming it would be fairly straighforward, but was treated to such lovely errors as these in my mail.log:

smtpd: warning: milter [...] can't read SMFIC_OPTNEG reply packet header: Connection timed out
smtpd: warning: milter [...] read error in initial handshake
cleanup: warning: milter [...] can't read SMFIC_EOH reply packet header: Success
smtpd: warning: milter [...] can't read SMFIC_MAIL reply packet header: Success
smtpd: warning: milter [...] can't read SMFIC_OPTNEG reply packet header: Connection timed out
smtpd: warning: milter [...] read error in initial handshake

To make a long story short, dkim-filter defaults to doing DNS lookups via TCP. It never even bothers trying UDP. I suppose that makes a certain amount of sense, seeing as it expects a relatively large response (the public key). However, my anti-spam domU didn't have a firewall rule permitting 53/tcp out, so dkim-filter kept timing out after initial startup and then died.

After making sure the firewall was letting lookups via tcp through, dkim on cafuego.net works dandy :-)

Trackback URL for this post:

http://cafuego.net/trackback/221

Junk Mail

cafuego — Fri, 22 Aug 2008 23:05:14 +0000

The fight against junk is ever on-going, so I better make sure I publish the honey.pot@cafuego.net address. Feel free to send it a mail, if you happen to be a spam bot.

Trackback URL for this post:

http://cafuego.net/trackback/185