Spam attack, observations, how to repair

Hello,

I was recently checking my site http://bugs.nuitka.net with Webmaster 
tools. Although I have outlawed bots to follow pretty much everything, I 
seemingly forgot one important thing that allowed me host spam links.

There were links of the form http://bugs.nuitka.net/file139/ (notice the 
trailing /) which when called like that, rendered the attachment that 
was text/html as HTML. Now it is only a forward to robots.txt, 
demonstrating the non-value of such links hopefully. The attacker had 
copied the layout from my main site, and replaced content with spam. Due 
to a mistake, this was causing a 404 to Google, which made me aware of 
that link.

I have now a robots.txt like this:

User-agent: *
Disallow: /file*
Disallow: /msg*
Disallow: /issue?*

The first disallow is new. I hope it's more complete now. I have 
configuration like this:

         RewriteEngine on
         RewriteRule ^/robots.txt$ /robots.txt [L]
         RewriteRule ^/file.*/$ /robots.txt [L]
         RewriteRule ^/googleeXXXXXXXXXXXX.html$ 
/googleeXXXXXXXXXXXX.html [L] # yours will be different
         RewriteRule ^/(.*)$ http://localhost:8088/nuitka/$1 [P,L]

The first rule is to enable robots.txt to be controlled by me. I believe 
Roundup doesn't provide one, does it.

The second rule is new, and guards against these file links with 
trailing "/", that I believe ought to be a bug of Roundup.

The third rule is to provide Google with a token that make it tell me 
about the broken spam I am hosting.

In the past, I was manually removing the impact of spam attacks by 
removing the attachment and undoing e.g. title changes. But this is more 
subtle, as I didn't even have to remove them, I think the attacker did. 
Instead he attached things that looked legit. This attacker appears to 
be human. The email even shows up in whois records.

Anyway, the attacker has created two users. In the first instance, I 
just set its email to an ".invalid" hostname, so it cannot resolve, and 
changed the password. In the second instance, I did it again.

However, these users still appear in the issue history. And the 
attachments are still there, although there is now no way to see it, or 
so I am thinking at least.

I was using roundup 1.4.20 as per Debian package. I upgraded to 1.5.0 
manually, as I saw that it makes the links nofollow. But with the 
possibility to add their own pages, that doesn't protect sufficiently.

I have this in my configuration:

# Setting this option enables Roundup to serve uploaded HTML
# file content *as HTML*. This is a potential security risk
# and is therefore disabled by default. Set to 'yes' if you
# trust *all* users uploading content to your tracker.
# Allowed values: yes, no
# Default: no
allow_html_file = no

However, the type of the attachments is "text/html", so this didn't help.

I have questions therefore:

a) Why is the HTML attached, how to prevent HTML attachments. For my 
tracker I know for sure, that I only want octet stream or normal UTF8 
text attachments.

b) How can I remove the spam users entirely. Will a "retire" do this 
sort of mostly automatically over time? I did a retire of a file, but it 
still exists.  I played a lot with roundup-admin, but I didn't find 
anything there. It would be nice to not have them in the users dropdown 
list at least.

c) How can I remove all actions of a spam user from the history of the 
tracker.

d) How can I get an email as soon as a new user registered.

e) How can I automatically be nosy on every issue. I am getting emails 
for issues created, but not later automatically. The traffic on my list 
is low enough, to do this, and I am interested in all issues anyway.

BTW: I registered on the roundup tracker, but I am not getting any 
confirmation email. Ah, it was classified as spam.

Yours,
Kay


------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft