Security Check V2.0 for DLG BBSs by Doug McLean Security: -------- This update is in response to several requests. There are enough changes from the previous version that a seperate changes list is not provided. You should read this entire file before installing Security Check. If you have any additional ideas to include in Security Check, let me know! Security Check is intended for DLG BBS only, and will not run on other BBSs. I don't really feel like writing docs right now, and it is 5:09 AM (I just finished and tested the update), so these instructions might be a little confusing. You should have no trouble if you read the entire file, but watch out for the typing mistakes that are probably throughout this doc file. What it does: ------------- If you do not validate users via a voice phone call (I don't bother), then this little program might help you sort the "real" users from the fake ones. Every BBS sometimes has people who call and don't supply their real name (or other valid info) when they sign up. They make up a name and other data just so they can get an extra account (perhaps so they can play as sevaral players in games, or maybe they plan to try to crash your system). The program will ask users a question from their user data file every 5th call. Questions may be one of: - Last 4 digits of phone number, - Last 3 digits of postal code, - Year of birth, - Month of birth, - Date of birth. In my experience, users who call a BBS and supply false information seldom write these things down, they remember only the name and password. On the other hand, users who are real will easily be able to provide the above information. Users will be asked one of the above questions. If they answer correctly, the security check will pass. A wrong answer will cause the security check to fail. In this case, the sysop is informed, and result is optionally written to the log file. The program will NOT do anything other than record the results of the security check to the log file; it is up to you to take whatever action you deem appropriate. In addition to asking the user questions he should be able to answer, Security Check will also check several other things: - The user's name and alias against a banned file. Users whose name or alias appear in the banned file will be kicked off. This file is most useful catching kids and hackers who use four letter words (or other undesireable language) for their name or alias. - The user's name against a warn file. The user is warned if his name appears in this file. This feature could also be used to provide a special greeting to select users. - The user's name against a notify file. The user is not aware that he is being checked, but the sysop is notified that the user logged on. - The user's alias against an alias file. If the users name appears in this file, he is asked to change it. This is useful for ensuring that users maintain alias's that are in good taste. - The user's name to ensure that it contains a first and last name (determined by the presence of a space in the name). This is useful for people who refuse to give their full name. In each case, the sysop is notified of what took place. The results of the security program will appear in the Sysop's event.log, which is automatically shown at log-on, and in an optional security log file. Each of the above features may be disabled, and the entire security check may be disabled if the user exceeds a certain user level. Setting it up: -------------- First, if you ran a precious version of Security Check, delete it and the data files that it used (the Security.Mad data file in each user's directory is no longer used). To delete the data files, use the following command: DELETE USER:#?/SECURITY.MAD To install the new version of security check, proceed as follows (your BBS should be up and running to ensure that the correct assigns have been done): [1] Copy the SECURITY program to DLG: COPY SECURITY DLG: [2] Create a SECURITY directory in DLGCONFIG:MISC/ MAKEDIR DLGCONFIG:MISC/SECURITY [3] Copy the data and text files to this directory COPY #?.(MAD|TXT) DLGCONFIG:MISC/SECURITY/ Edit these files as needed. [4] Add the following line as the last line in your login.dlgbatch file (located in DLGCONFIG:BATCH/): DLG:SECURITY %PORT SYSOP_NAME EXAMPLE: dlg:security %PORT Doug_McLean Note the sysop's name must have the underscore replacing spaces, just like the directory names of users (the program uses this as the sysop's user directory). The options are explained below. Files included: --------------- security The security program executable. security.doc You are reading it. alias.mad Bad alias list. alias.txt Text file displayed if user fails alias test. banned.mad List of users to be kicked off when they call. banned.txt Text file to show banned users before hanging up. fail.txt Text file for when a user can't answer the question. nolast.txt Text file for when a user doesn't provide first/last names. notify.mad List of users to notify the sysop when they log on. warn.mad List of users to warn. warn.txt Text file to show warned users. The files: ---------- The .txt files are shown to users when they fail a particular check. If any of these are absent, a single line message will be printed by the program instead. Edit these files to suit your system. The .mad files are the lists of things to check for. Each of these is a list of names or words that are to be filtered by the appropriate function. Each list should contain one string on each line. Spaces are checked too, so don't leave extra spaces at the end of a line! And don't put extra returns at the end of the files, the last return in each file should be on the last line that contains text to check. The strings in these files are not case sensitive. The match is un-anchored, so the position in the user's name or alias that a filtered string occurs does not matter. The files are not case sensitive. So, if banned.mad contained a line ABC, the user's ABC ZZZ, ZZABCZZ ZZZ, and ZZZ ZZABC would be banned users, but ZZA BCZZ would not. Pattern matching is supported. * will match 0 or more occurances of the previous character, and ? will match any character. So, A* would match A AA AAA AAAA AAAAA etc. A?C would match AAC ABC ACC ADC etc. A?*C would match AC ARHJKUYC ABC etc. ?* would match EVERYTHING. Options and things: ------------------- The options may be in any order, but must follow the %PORT and SYSOP_NAME. They are: Fxx First call. xx is the number of the call that the security question is first asked, and does not effect anything but the question check. Calls are numbered starting at 0. So to start asking users the security question on their 5th call, use F4. This defaults to starting the questions on the second call (F1). Cxx The increment between calls to ask questions. To ask the security question every 5th call use C5 (the default). To ask the question every 10th call, use C10. N Disables the check for first and last names. Q Disables the question check. L Disables the log file, DLGCONFIG:NISC/SECURITY/SECURITY.LOG. The sysop is still notified by his event.log. Mxx Maximum user level to check. Users with a level higher than this will not be checked in any way. Defaults to 255 (check all users). To disable the BANNED check, delete the BANNED.MAD file. To disable the NOTIFY check, delete the NOTIFY.MAD file. To disable the WARN check, delete the WARN.MAD file. To disable the ALIAS check, delete the ALIAS.MAD file. So, DLGCONFIG:SECURITY %PORT DOUG_MCLEAN F1 C5 N Q L M250 would send the security reports to the user Doug McLean, would start asking security questions on the second call, would ask questions every 5th call, would not check for first and last name, would not ask security questions (even though the first call and call increment are specified, the questions would be skipped in this case), would not keep a seperate log file, and users with level greater than 250 would not be checked at all. Notes: ------ - You will have to edit or delete the log file yourself if it is enabled, the program will not do this for you. I suggest using a script run by TPTCron to copy and delete the file weekly. Such a script might look like: if exists dlgconfig:misc/security/security.log copy dlgconfig:misc/security/security.log sys:t/ delete dlgconfig:misc/security/security.log endif This way the log never gets too long, and you always have last weeks log too... - The user does not see anything if the security check finds no problems. Once the program determines that everything is ok and the question not needed, it exits without printing or recording anything. The log file is no longer notified when a user passes all checks, only failures are recorded. - A banned user is not deleted (he is merely logged off), this is up to you. Legal Stuff: ------------ This program is PD. Do what you will with it. If you like it, great! If you don't, or it messes up your system, it is YOUR problem. I refuse to accept any responsibility (especially legal responsibility) for anything this program does or does not do. I wrote this program to use on my BBS, and it works fine for me, so I'm happy. But, if you like this program, and would like to see improvements and/or enhancements, then send me netmail at FIDO 1:255/9 to let me know that you are using it. I won't bother with updates if nobody but myself uses it! Send bug reports to the same FIDO address, or to Doug McLean c/o The Mad Scientist's BBS 145 Bedell Ave. Saint John, NB Canada, E2K 2C3 BBS: (506) 636-9117