BlacklistCheck
Blacklist Check
Overview
This plugin is designed to use public DNS Blacklist servers to check incoming connections and disallow anyone using a known public proxy from being able to connect. The list of DNSBL servers used is configurable.
Features
- Stop grief before they even connect
- Increased security
- (v0.2) Whitelist known IP addresses to always allow connections
- (v0.3) Whitelist entire IP subnets
- (v0.5) Choose to block the connection until the address may be verified, or allow the connection and kick if they are blacklisted
Configuration
Plugin Configuration
- DNSBLServers (v0.1) A list of DNS servers that will resolve blacklisted IP addresses
- Whitelist (v0.2) A list of IP addresses that will always be allowed in and will not be checked against the DNSBL servers. NOTE: As of v0.3 these addresses must be in CIDR notation. For example to enter a single IP address use "127.0.0.1/32" to allow an entire class C subnet use "192.168.1.0/24". Please be sure to update the config file when upgrading from v0.2.
- Debug (v0.3) (Boolean) [Default: false] A directive to have the plugin print more information to the console
- LogDisconnects (v0.4) (Boolean) [Default: true] A directive to have the plugin output connection refusals to the console
- DelayCheck (v0.5) (Boolean) [Default: false] A directive to have the plugin allow the connection, then thread the DNS lookups. This option is not recommended, as there will be a period of time when they will be connected to the server until the DNS lookup returns. It will, however, not delay the connection process.
- DisconnectMessage (v0.5) (String) [Default: "Connected from a publicly blacklisted server!"] The configurable message to send along with the disconnect / kick.
- LogToFile (v0.6) (Boolean) [Default: true] A directive to have the system log to the BlacklistCheck.log file in the plugin's directory for debug and disconnect messages.
Installation
- To install the plugin, simply place the jar in the plugins directory
Bugs / Known Limitations
- The default server list contains 8 DNS servers, checking each one takes time. Increasing this list will cause client timeout errors (without the DelayCheck configuration directive)
- The client will be disconnected if even one DNS server returns a result for the address
Future Plans
- Try to incorporate any additional user requests.
See Also
DNSBL is a common practice to block spammers and other unwanted traffic. For a full description about how DNSBL operates, a list of available public DNSBL servers, and other information, use Google.
Comments
-
_ForgeUser8237554 Owner
-
View User Profile
-
Send Message
Posted Apr 11, 2012All,
I am sorry for the problems with v0.5.1 and the delay check directive. I have corrected the errors and v0.5.1 is now properly operational.
Thank you for your understanding.
-
View User Profile
-
Send Message
Posted Apr 11, 2012I have removed v0.5.1 for now.
-
View User Profile
-
Send Message
Posted Apr 11, 2012I got same prob. with 5.1 it wont load. 5.0 is ok
-
View User Profile
-
Send Message
Posted Apr 10, 2012@xdeathoreox
this happened when i tried to use 0.5.1 as well, i just downloaded 0.5 and it works fine.
-
View User Profile
-
Send Message
Posted Apr 10, 2012On start up:
:(
-
View User Profile
-
Send Message
Posted Apr 9, 2012@kozzy68
I have made an update to address the error below. It will require some investigation because the issue that caused this error was due to the player's address not being available. This was an unanticipated circumstance.
As for timeout: DNSBL is designed to timeout when a player is not blacklisted. The blacklist servers are servers hosting public DNS using the reverse IP address as a subdomain. For example, if your address is 127.0.0.1 and it uses the proxybl.org server, it performs a DNS query for 1.0.0.127.dnsbl.proxybl.org. If the DNS exists, then the address has been blacklisted, if the request times out, or does not have an entry, the address is okay. Therefore, it would not cause clients to timeout.
-
View User Profile
-
Send Message
Posted Apr 8, 2012Hi I got this when I use delay check true:
2012-04-09 00:10:47 [SEVERE] Could not pass event PlayerLoginEvent to BlacklistCheck org.bukkit.event.EventException at org.bukkit.plugin.java.JavaPluginLoader$1.execute(JavaPluginLoader.java:303) at org.bukkit.plugin.RegisteredListener.callEvent(RegisteredListener.java:62) at org.bukkit.plugin.SimplePluginManager.callEvent(SimplePluginManager.java:459) at net.minecraft.server.ServerConfigurationManager.attemptLogin(ServerConfigurationManager.java:227) at net.minecraft.server.NetLoginHandler.b(NetLoginHandler.java:102) at net.minecraft.server.NetLoginHandler.a(NetLoginHandler.java:94) at net.minecraft.server.Packet1Login.handle(SourceFile:68) at net.minecraft.server.NetworkManager.b(NetworkManager.java:229) at net.minecraft.server.NetLoginHandler.a(NetLoginHandler.java:48) at net.minecraft.server.NetworkListenThread.a(NetworkListenThread.java:61) at net.minecraft.server.MinecraftServer.w(MinecraftServer.java:551) at net.minecraft.server.MinecraftServer.run(MinecraftServer.java:449) at net.minecraft.server.ThreadServerApplication.run(SourceFile:492) Caused by: java.lang.NullPointerException at com.archmageinc.BlacklistCheck.BlacklistTask.<init>(BlacklistTask.java:17) at com.archmageinc.BlacklistCheck.BlacklistListener.onPlayerLoginEvent(BlacklistListener.java:37) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source) at org.bukkit.plugin.java.JavaPluginLoader$1.execute(JavaPluginLoader.java:301)
o and btw what happens when some of those 8 servers gets unreachable ? wont it make clients timeout ?
-
View User Profile
-
Send Message
Posted Mar 22, 2012@Hvarr
As mentioned in the Limitations section above, it takes time to run DNS queries. On servers with heavy load, I would recommend limiting the list of DNSBL servers down to perhaps one, or enable the DelayCheck configuration option. By enabling DelayCheck, it will thread the DNS lookup and thus not cause timeout issues.
This is merely a misconfiguration based on your server's requirements. If the above does not resolve the problem, let me know, I will make any adjustments I can to fulfill your needs.
Thank you
-
View User Profile
-
Send Message
Posted Mar 22, 2012Timings of your plugin. It makes server virtually unplayable.
-
View User Profile
-
Send Message
Posted Mar 18, 2012@phaed420
Could you be more specific? Did the server log that your address was blacklisted? Did you receive the blacklist kick message? From what address where you connecting?
-
View User Profile
-
Send Message
Posted Mar 18, 2012Very odd, I put this on my server and no one could log in. Not even me.
-
View User Profile
-
Send Message
Posted Mar 12, 2012@BeastsMC
While it is possible for the system to operate in this way, the safest bet would be to not let them in at all. I may look at adding the option to provide this functionality.
edit: Added in v0.5
-
View User Profile
-
Send Message
Posted Mar 12, 2012Since checking all of DNS servers can hold up the login process, what about letting them log in and checking them in another thread? This would let the login go through at a normal speed. Then, if their IP is blacklisted, kick them from the game with a message. Would this work?
-
View User Profile
-
Send Message
Posted Mar 11, 2012@funknutz
With debug off, it will only log warning messages, I will try to add an option to log forced disconnects.
edit v0.4 now has the LogDisconnects configuration option.
Thank you all for your support. Donations are nice too /wink /wink
-
View User Profile
-
Send Message
Posted Mar 11, 2012Oh, one more thing. Is the log going to list when people are disconnected due to being matched in a blocklist when I have debug off? My whitelist is long enough that it is making the debug output clutter my server.log.
-
View User Profile
-
Send Message
Posted Mar 11, 2012People don't realize how valuable this plugin is. There's a little script kiddie tool people are using to proxy flood minecraft servers. I can't remember the name, but I saw it on another bukkit plugin. The name contained the word 'pwn', I think. Anyway, hopefully people find their way to this plugin, as it's the only one working right now, that I know of. It also seems to work very well, and thanks for adding the CIDR whitelist feature so quickly!
-
View User Profile
-
Send Message
Posted Mar 11, 2012@ArchmageInc
Raw Plugin, keep it up to date. Thank you :D
-
View User Profile
-
Send Message
Posted Mar 10, 2012@funknutz
I have added a Whitelist option to the config. Currently it only allows listing specific IP addresses. I hope to soon have a release that will allow whitelisting entire subnets.
-
View User Profile
-
Send Message
Posted Mar 10, 2012This plugin is great. I don't know of any other alternative. MCBL is not updated. The only thing you really need is a whitelist override. I wish I had more time and skill to help you with that. I have a valid user whose entire /22 is blocked, and there is no way to get him into the server without disabling this plugin. Even if you could just add a simple permissions group check, that would be a simple whitelist.