Anope IRC Services

Anope Support => 1.6.x (Read Only) => Topic started by: rapax on September 06, 2008, 03:16:05 AM

Title: Read error from server: Broken pipe
Post by: rapax on September 06, 2008, 03:16:05 AM
I've been getting hit everyday by some kids and the services are crashing every time. Is there a way to prevent this type of attack?

[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG nickserv :help"
[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG helpserv :help"
[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG operserv :help"
[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG chanserv :help"
[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG hostserv :help"
[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG botserv :help"
[Sep 05 16:04:45 2008] Read error from server: Broken pipe

The attack is massive, this is the last portion, before the services crash.

Please advise...
Title: Re: Read error from server: Broken pipe
Post by: deiks on September 06, 2008, 09:37:00 AM
Use spamfilter nick match, or use proxy scanners.
There's no way to prevent it, if they're connected to server.
If they're connected then it's like regular user.

I'm using BOPM and AKILL.
Title: Re: Read error from server: Broken pipe
Post by: Jan Milants on September 06, 2008, 10:39:27 AM
consider lowering the sendq and receiveq of your client blocks...
Title: Re: Read error from server: Broken pipe
Post by: Jobe on September 06, 2008, 11:55:21 AM
Are you running UnrealIRCd? if so can you give us some examples of the nicks the drones are using please? The reason I ask is if they follow a patten, it may be possible to spamfilter them.
Title: Re: Read error from server: Broken pipe
Post by: rapax on September 06, 2008, 11:27:52 PM
Thanks guys for the response.

I am using UnrealIRCD 3.2.7

This is a sample of how they are achieving the crashing of the services:

[Sep 06 16:01:47 2008] NickServ: Nick gEigFkRqXfZ has been requested
[Sep 06 16:01:48 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:48 2008] NickServ: Nick wZrmMpNaZiX has been requested
[Sep 06 16:01:49 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:49 2008] NickServ: Nick tBjqBiMsCrM has been requested
[Sep 06 16:01:49 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:49 2008] NickServ: Nick tTftQqEqHmN has been requested
[Sep 06 16:01:49 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:49 2008] NickServ: Nick nIrxWqKfSgL has been requested
[Sep 06 16:01:49 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:49 2008] NickServ: Nick aPvvZxSxAbR has been requested
[Sep 06 16:01:49 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:49 2008] NickServ: Nick kRzeDnFdEfY has been requested
[Sep 06 16:01:50 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:50 2008] NickServ: Nick yIpjHdNgDsO has been requested


[Sep 06 16:02:26 2008] user: JOIN from nonexistent user xAhyQlRlNzQ: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user xGrpFmYxFnA: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user kZgdTfHmKeF: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user vRdePtSaFsS: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user vJrjObNyElS: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user iMosLhQxZwA: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user qOmqGdIsObK: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user xAhtWuXcSzH: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user fUvyScYqIyK: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user vGwcIyTsCzW: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user bKxaTyBiQoQ: #chan


[Sep 06 16:02:27 2008] user: PART from nonexistent user xGrpFmYxFnA: #chan parting...
[Sep 06 16:02:27 2008] user: PART from nonexistent user xSexUrMcYhT: #chan parting...
[Sep 06 16:02:27 2008] user: JOIN from nonexistent user xSexUrMcYhT: #chan
[Sep 06 16:02:27 2008] user: PART from nonexistent user xSexUrMcYhT: #chan parting...
[Sep 06 16:02:27 2008] user: PART from nonexistent user xSexUrMcYhT: #chan parting...
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user kJecExNcGuL: Resource temporarily unavailable
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user rIgjSbMlHkE: Resource temporarily unavailable
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user fKxfAlHvGkH: Resource temporarily unavailable
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user lXfmGlWzLeQ: Max SendQ exceeded
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user mJisXsXqOiP: Dead socket
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user qOmqGdIsObK: Client exited
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user xAhtWuXcSzH: Client exited
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user uLulXgMnPhD: Client exited
[Sep 06 16:02:27 2008] user: JOIN from nonexistent user xAhyQlRlNzQ: #chan
[Sep 06 16:02:27 2008] user: PART from nonexistent user uLnvEhTpOrN: #chan parting...
[Sep 06 16:02:27 2008] user: PART from nonexistent user xAhyQlRlNzQ: #chan parting...
[Sep 06 16:02:27 2008] Read error from server: Broken pipe

Again this is just a fraction of the logs.

When i restart services that email is changed and the crash is inevitable.
I use BOPM also.

Please advise...
Title: Re: Read error from server: Broken pipe
Post by: Jobe on September 07, 2008, 08:46:28 PM
Oh goody, those nicks are easy.

As an oper with type:
/spamfilter add u gline - Botnet! ^(?-i)[a-z][A-Z][a-z][a-z][A-Z][a-z][A-Z][a-z][A-Z][a-z][A-Z](?i)!

That should catch them all.
Title: Re: Read error from server: Broken pipe
Post by: rapax on September 08, 2008, 01:36:48 PM
They have not shown up yet to see if this worked. I will let you know.
Thank you guys. Thank you Jobe.