I'm trying to setup apache, on a Cobalt Raq 4, to not allow spammers to use vanurable FormMail's. The Idea is to not allow anyone access to the site / server if they are trying to send the recipient varaible to formmail :

"..../formmail.pl?recipient=..."

-- or --

"...../formmail.pl?X=whatever&Y=whatever&recipient=..."

basicaly, if "formmail.pl" & "recipient=" are both in the Apache Request_URI, in upper or lower case, I would like apache to not allow the request.

here is what I have so far:


SetEnvIf Request_URI ".*(formmail\.pl).*(recipient=)" spammer=true

SetEnvIf spammer true keep_out

<Directory /home/sites/site*/web/cg*/>

Order Allow,Deny
Allow from all
Deny from env=keep_out

</Directory>


This works nice untill I try doing more then "formmail.pl" as the regexp. I'm a newbie to the Regular Exp. sceen, anybody know what regexp pattern would do what I need done above?

I have thought about replaceing the "SetEnvIf" line with:

SetEnvIf User-Agent "^Microsoft URL Control" spammer=true

But i don't really want to just deny everyone using the MS control from accesing the server, just because some spam tool out there uses it.text to color.

It would be nice to be able to do something like "If User-Agent == Microsoft URL Control AND Request_URI has formmail.pl in it, THEN Deny", however this is proving to be a pain to figure out.

Thanks in advance

Jucebro:

Why not just use the updated version of Matt Wright's formmail? It allows you to hardcode the recipient, reffering domain(s) and is pretty darn secure as far as I can tell.

Take a look at http://www.worldwidemart.com/scripts/formmail.shtml

Well, The idea was to avoid forcing all the webmasters to upgrade to the new version of FormMail. If it were 1 or 2 formail.pl's on 1 or 2 servers, that would have already been done but there are many more scripts on many more servers. Also, If we were to go in and upgrade each formmail.pl to 1.9, some webmaster who is unaware of the exploits can use the 1.6 formmail script afterwords and unknowningly open the door for spammers, the method I'm trying to figure out would still stop spam in this case.

I am curious too.

i would also like to see a fix for this besides upgrading the hundreds of scripts that already reside on our servers