Re: telnet security: how are you handeling bots?
By: pweck to All on Mon Sep 21 2026 20:30:13
what are you using to cope with scanners and login floods? fail2ban, custom firewall rules, banner tricks??
share your setup
well, the web server part of Synchronet runs through Nginx Proxy Manager Plus and a haproxy.
in haproxy.cfg i have added this:
===
frontend http_in
bind *:8080
mode http
option httplog
# --- Protection Against Bot Scans and Rate Limiting ---
stick-table type ip size 100k expire 30s store http_req_rate(10s)
http-request track-sc0 src
http-request deny status 429 if { sc_http_req_rate(0) gt 20 }
# Block direct access to sensitive paths and APIs
http-request deny status 403 if { path_beg -i /.env }
http-request deny status 403 if { path_beg -i /.aws }
http-request deny status 403 if { path_beg -i /.git }
http-request deny status 403 if { path_beg -i /.stripe }
http-request deny status 403 if { path_beg -i /wp- }
http-request deny status 403 if { path_beg -i /config.json }
http-request deny status 403 if { path_beg -i /api/events.ssjs }
# Block POST requests to the bare root URL (to prevent form attacks)
http-request deny status 405 if { path / } { method POST }
default_backend synchronet_backend
backend synchronet_backend
mode http
server sbbs_web 127.0.0.1:8000 send-proxy
===
in NPMplus i block all kinds of AI crawlers:
Nginx proxyhost > advanced tab >
# AI-Crawler blocking
if ($http_user_agent ~* "AddSearchBot|AI2Bot|AI2Bot\-DeepResearchEval|Ai2Bot\-Dolma|aiHitBot|amazon\-ke ndra|Amazonbot|AmazonBuyForMe|Amzn\-SearchBot|Amzn\-User|Andibot|Anomura|anthro pic\-ai|ApifyBot|ApifyWebsiteContentCrawler|Applebot|Applebot\-Extended|Aranet\ -SearchBot|atlassian\-bot|Awario|AzureAI\-SearchBot|bedrockbot|bigsur\.ai|Brave bot|Brightbot|Brightbot\ 1\.0|BuddyBot|Bytespider|CCBot|Channel3Bot|ChatGLM\-Spider|ChatGPT\ Agent|ChatGPT\-User|Claude\-Code|Claude\-SearchBot|Claude\-User|Claude\-Web|Cla udeBot|Cloudflare\-AutoRAG|CloudVertexBot|Code|cohere\-ai|cohere\-training\-dat a\-crawler|Cotoyogi|Crawl4AI|Crawlspace|Datenbank\ Crawler|DeepSeekBot|Devin|Diffbot|DuckAssistBot|Echobot\ Bot|EchoboxBot|ExaBot|FacebookBot|facebookexternalhit|Factset_spyderbot|Firecra wlAgent|FriendlyCrawler|Gemini\-Deep\-Research|Google\-Agent|Google\-CloudVerte xBot|Google\-Extended|Google\-Firebase|Google\-Gemini\-CLI|Google\-NotebookLM|G oogleAgent\-Mariner|GoogleOther|GoogleOther\-Image|GoogleOther\-Video|GPTBot|He nkBot|iAskBot|iaskspider|iaskspider/2\.0|IbouBot|ICC\-Crawler|ImagesiftBot|imag eSpider|img2dataset|ISSCyberRiskCrawler|kagi\-fetcher|Kangaroo\ Bot|KlaviyoAIBot|KunatoCrawler|laion\-huggingface\-processor|LAIONDownloader|LC C|LinerBot|Linguee\ Bot|LinkupBot|Manus\-User|meta\-externalagent|Meta\-ExternalAgent|meta\-externa lfetcher|Meta\-ExternalFetcher|meta\-webindexer|MistralAI\-User|MistralAI\-User /1\.0|MyCentralAIScraperBot|NagetBot|netEstate\ Imprint\ Crawler|newsai|NotebookLM|NovaAct|OAI\-SearchBot|omgili|omgilibot|OpenAI|openco de|Operator|PanguBot|Panscient|panscient\.com|Perplexity\-User|PerplexityBot|Pe talBot|PhindBot|Poggio\-Citations|Poseidon\ Research\ Crawler|QualifiedBot|QuillBot|quillbot\.com|SBIntuitionsBot|Scrapy|SemrushBot\- OCOB|SemrushBot\-SWA|Shap\-User|ShapBot|Sidetrade\ indexer\ bot|Spider|TavilyBot|Terra\ Cotta|TerraCotta|Thinkbot|TikTokSpider|Timpibot|Trae|TwinAgent|VelenPublicWebCr awler|WARDBot|Webzio\-Extended|webzio\-extended|wpbot|WRTNBot|YaK|YandexAdditio nal|YandexAdditionalBot|YouBot|ZanistaBot|AhrefsBot|SemrushBot|DotBot|MJ12bot|M egaIndex|BLEXBot|ZoominfoBot|zgrab") {
return 403;
}
Synchronet itself has rate limiting settings for all of its services.
And i additionally run crowdsec and fail2ban.
And last but not least it is always good to have some firewall set. I am using the one that comes build in in proxmox and my dsl router is also some kind of firewall to control wich ports go through etc.
Mindsurfer
--- SBBSecho 3.37-Linux
* Origin: FuNToPiA bbS |
telnet://funtopia.synchro.net:3023 (23:1/105)