CAcert System Admins discussion list

[Philipp Guehring <philipp AT cacert.org>]

Hi,
> Several IPs are putting dangerous files on the wiki.
>   
As far as I have understood the attack, the attacks are actually being
done by random browser-clients, not the attacker itself. So blocking
their IPs just blocks random inocuous clients.

> As I don't see much how we can use the usual filtering for spammer with
> MoinMoin in this case, I guess we could try to blacklist IPs or networks
> on the wiki machine.
>   
We should implement CSRF protection, since the attacks are CSRF attacks
as far as I could see.
> I need some pieces of advise please :
> Can it be configured on the wiki vserver ?
>   
No, iptables has to be done on the host.
> if yes, can I/we use the usual Iptable stuff directly on the wiki ?
>   
Yes, we could block it through iptables.

But I would prefer to get CSRF-protection implemented, since that solves
the cause of the problem, it doesn't just try to limit the impact with
known IP addresses.

Best regards,
Philipp Gühring