Spam control
Several complementary layers — each section below says where to
configure it:
1. Pre-login bot gate (telnet only)
Before showing the login menu, the BBS prompts:
Press ESC or * twice to continue...
Auto-scanners just dump bytes — they don't follow prompts and time
out after BOT_GATE_TIMEOUT seconds (default 30). Real humans tap
ESC twice and proceed. SSH and rlogin skip this since they've
already authed at the protocol layer.
2. NUV — New User Verification
NUV_ENABLED=true
Every new registration is marked is_verified=False and can't log
in until a sysop clicks Approve at Admin → Pending Users.
Approval triggers an automatic welcome PM.
3. Manual IP bans
Admin → IP Bans (/admin/ip-bans). Ban a single IP or a CIDR
range. Optional TTL in days (0 = permanent). Login + register routes
both refuse banned IPs.
4. Login auto-ban
The same Admin → IP Bans page also has an auto-ban settings
panel — this is arguably the most important layer here, since it
runs with no sysop intervention at all. Repeated failed logins from
one IP within a configurable window get a temporary ban automatically.
Defaults: 10 attempts / 5-minute window / 1-hour ban. All three are
sysop-adjustable on the same page.
5. Registration rate limiting
New-account registration is rate-limited per IP (default: 3 attempts
per hour) independently of the login auto-ban above — this stops
registration-form spam even from an IP that's never tried to log in.
Attempts are logged for the sysop to review.
6. IP whitelist
Admin → IP Bans also has a whitelist. An IP on it bypasses every
ban above (manual or auto) — useful for a sysop's own static IP, or a
trusted peer BBS's BinkP/QWK source address.
7. Country blocking
Admin → Settings (/admin/settings) has a "Blocked countries"
field — comma-separated ISO codes (e.g. CN,RU,KP). Blank disables
it. Looks up the caller's country via ip-api.com (no registration/API
key needed).
8. Word filter
Admin → Word Filter. Sysop maintains a list of bad terms and
their replacement (e.g. ****). Applied at write-time on:
- Shoutbox posts
- Board posts
- PMs
- Oneliners
- Echomail composition
- Netmail composition
Filter is in-memory cached, but the cache is invalidated automatically
on every add/toggle/delete — no manual reload step needed.
9. File moderation queue
FILE_MOD_QUEUE_ENABLED=true
Non-admin uploads land in data/file-queue/ with a FileQueueEntry
row. Admin → File Queue lets sysop approve (publishes to area)
or reject (deletes from quarantine).
10. Closing registration entirely / invite codes
REGISTRATION_OPEN=true
REGISTRATION_INVITE_CODE=
REGISTRATION_OPEN (default true, unchanged existing behavior) gives
a sysop a hard off switch for new-account creation — set it false
and both the web /auth/register form and the terminal
(telnet/SSH/rlogin/PETSCII) registration flow refuse with a plain
"registration is currently closed" message, before anything else runs.
REGISTRATION_INVITE_CODE (blank by default — no code required) adds
a shared invite password instead of closing registration outright —
matches Synchronet's own convention. Set it to any string and every
new registration (web and terminal) must supply it correctly or be
refused. Both settings are editable at Admin → Settings.
These are independent of NUV (NUV_ENABLED above) — NUV gates
usage after an account is created; these two gate creation of the
account itself.
Bonus: per-user
Users can self-block at User menu → Block List. Blocked users
can't PM them or @-mention them.