Abuse-Filter blocking 404 page?

Canadaka · New Member Joined: Feb 10, 2006 Posts: 23

the "Abuse-Filter" blocker seems to be messing up somehow on one of my sites. I am getting tones of IP's blocked from this blocker and I know many are legit users some have even been admin ips.

The query string is always a weird value as well, always has the port 80 in the url and my error page.

Query String:

Only registered users can see links on this board!
Get registered or login to the forums!

montego · Posted: Fri Jun 13, 2008 6:04 am

Not sure how we missed this one. Are you still getting this? Do you have valid error pages? You might want to set one up for 404 if you do not already have one as I do not understand why a 404 error would come back through *nuke (which is the only way NukeSentinel would see it).

Canadaka · New Member Joined: Feb 10, 2006 Posts: 23

I only have a custom error page for 404. It is a nuke file though in "includes/errors/404.php"

Code:

<?php
header("HTTP/1.0 404 Not Found");
include("../../config.php");

global $index, $pagetitle;
$index = 3;
$pagetitle = 'The Page Cannot Be Found';
define('NO_SENTINEL', true);
include("header.php");
OpenTable();
?>
<br />
<div style="height:210px; margin:20px;">
<h1>The page cannot be found!</h1>
The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.<br />
Try using our search in the top right of the site, the page might have been moved.
<hr>
<br>
HTTP 404 - File not found
<br /><br />
</div>
<?php
CloseTable();
include("footer.php");
?>

I just noticed the constant for disabling Sentinel, so i added it to this error page, I will see if that helps.
define('NO_SENTINEL', true);

montego · Posted: Sat Jun 14, 2008 12:54 pm

I don't know what you mean by "NO_SENTINEL". I can find that define no-where within the NukeSentinel code or core file edits. Where did you find this constant? That constant would have to "wrap" the include of the nukesentinel.php script within mainfile.php in order for this to fix this issue.

I am not accustomed to seeing folks use nuke structure within their error pages. I guess nothing wrong with it, but you could be causing a huge amount of extra server load by doing this. The reason I say this is that I get sometimes hundreds of 404 errors due to automated scripts, mostly hacking scripts looking for exploits. Therefore, my error handling script is extremely "lite".

Canadaka · New Member Joined: Feb 10, 2006 Posts: 23

Yes sorry I had a bit of a dumb moment, I forgot that that I added the "NO_SENTINEL" constant that does just waht you said. I added it some time ago and forgot.

Hmm i see your point about extra load. I do it because I always forget to update my error pages when i change my sites layout. This way its using the sites theme.

But since I don't need any of the nuke functions for an error page, I will try including the themes header and footer directly.

Anyway adding the NO_SENTINEL to disable Sentinel on these error pages seems to have stopped the Filter abuses. Still not sure what was going on though.

montego · Posted: Sun Jun 15, 2008 7:09 am

Canadaka wrote:

Still not sure what was going on though.

NukeSentinel is actually just doing its job. Looks to me like Apache is passing the normal error string into your 404.php page. And, since it has a pattern that NukeSentinel does not like to see, its tripping that blocker.