Tor not getting blocked well enough

Help with EFnet related issues

Moderators: Website/Forum Admins, EFnet/Help Moderators

scar
Posts: 13
Joined: Wed Mar 24, 2004 4:30 am

Tor not getting blocked well enough

Postby scar » Mon Nov 10, 2014 1:04 am

I am dealing with an abusive user who keeps evading bans by using Tor. Tor is supposed to be blocked on EFnet, i thought.
The Tor Project provides an easy way to keep your blocklist updated here,
https://check.torproject.org/cgi-bin/TorBulkExitList.py
so i'm not sure why the user is able to connect to Efnet via Tor....
User avatar
munky
Site Admin
Posts: 826
Joined: Wed Jul 02, 2003 4:54 pm
Location: Phoenix AZ
Contact:

Re: Tor not getting blocked well enough

Postby munky » Mon Nov 10, 2014 6:23 pm

tor is blocked on EFnet, and every server should be using at least one RBL that lists tor. however, not every RBL is perfect (even the one operated by the tor project). if the user in question is always using the same server, it's possible that server's BOPM isn't operating correctly or the RBL they are using is not functioning correctly. contact the server admin in question to let them know.
In God we trust,
Everyone else must have an X.509 certificate.
scar
Posts: 13
Joined: Wed Mar 24, 2004 4:30 am

Re: Tor not getting blocked well enough

Postby scar » Wed Nov 12, 2014 4:20 am

thanks guys, yeah he was definitely using Tor, as one of his hosts was assk2.torservers.net and a few of the other hosts too were listed in that link in my first post. then there are the proxies he is using which i thought EFnet also scanned for and banned, but maybe he's using different kind of proxy.

i was looking for maybe a TCL script that would cross-reference RBL's and ban accordingly, and i found this one:
http://pastebin.com/amW5EQB7

but the problem is all of the lists it uses ("dnsbl.swiftbl.org" "dnsbl.ahbl.org" "ircbl.ahbl.org" "rbl.efnet.org" "dnsbl.dronebl.org" ) are inoperable except for the dronebl one, well and the efnet one i assume is already cross-referenced upon a client connecting to efnet.

so maybe this TCL script is good? are there other RBL's that i can define to make it more robust?

thanks
User avatar
munky
Site Admin
Posts: 826
Joined: Wed Jul 02, 2003 4:54 pm
Location: Phoenix AZ
Contact:

Re: Tor not getting blocked well enough

Postby munky » Wed Nov 12, 2014 11:05 pm

In God we trust,
Everyone else must have an X.509 certificate.
User avatar
munky
Site Admin
Posts: 826
Joined: Wed Jul 02, 2003 4:54 pm
Location: Phoenix AZ
Contact:

Re: Tor not getting blocked well enough

Postby munky » Wed Nov 12, 2014 11:06 pm

In God we trust,
Everyone else must have an X.509 certificate.
scar
Posts: 13
Joined: Wed Mar 24, 2004 4:30 am

Re: Tor not getting blocked well enough

Postby scar » Thu Nov 13, 2014 6:48 pm

thanks, got it... i've also been using this tool:
http://www.unifiedemail.net/Tools/RBLCheck/Default.aspx

to cross-reference the old IPs and then i can also use the RBL's that come up positive...

but the TCL script isn't working right... seems to work well up to the point of actually setting mode +b on the channel, so i'm working with the author/#eggheads on that front...

Who is online

Users browsing this forum: No registered users and 4 guests