XF 2.1 Prevent Discouraged IPs from Login?

[Dragonfruit]

It's great it can be prevented from registering, but it would be helpful to prevent it from logging in as well. Is there any way it can be adjusted to work this way?

 

[beerForo]

Ban it

 

[Dragonfruit]

That's a workable solution, but would prefer if they can still access/browse the board.

 

[beerForo]

In "Discouraged" state the reason they can log in is so they do not suspect you have altered their account, but they believe they are experiencing other technical difficulties such as slowness etc. If they simply can't log in that defeats the purpose. Admins will get an instant email.

Just ban the IP or use Discouraged. They have different purposes.

 

[RallyFan]

ACP > Setup > Options > User Registration > Registration timer (heading) > Prevent discouraged IP addresses from registering: Ticked

Check if it's there for you.

 

[beerForo]

He wants login.

 

[Dragonfruit]

Yeah. I understand the purpose of Ban IP. It's a bit extreme for our needs. A middle ground would've been Discouraged had an option to prevent logging in as well.

 

[RallyFan]

He wants login.

In that case wouldn't you just discourage a user and add them to a guest only usergroup (ala Unconfirmed/Unregistered)?

 

[Dragonfruit]

In that case wouldn't you just discourage a user and add them to a guest only usergroup (ala Unconfirmed/Unregistered)?

That wouldn't work for my situation, no.

 

[RallyFan]

That wouldn't work for my situation, no.

What specific situation / scenario are you trying to resolve by this?

If a user is added to Unregistered/Unconfirmed they effectively default back to Guest (Read Only) status.

 

[Dragonfruit]

I'm not using it for users. I'm using it to stop bots/spam/web attacks.

It's been actually effective on neutralizing DDOS attacks. Dump the IPs in, and it lags them majorly. What I want is users to still be able to guest post for help, in case they're incorrectly affected. Thus prevent logging & registering only.

 

[RallyFan]

Ohhh hang on we are talking about two different explanations for discouraged here.

You are talking "discouraged" as in "dodgy IPs that spammers might use".
I was talking "discouraged" as in the Xenforo setting/term "Discourage users by doing xyz".

In this case you could probably utilise something like Signup and Abuse Detection by @Xon ( https://xenforo.com/community/resources/signup-abuse-detection-and-blocking.6812/ ), and drop the Maximum messages for Spam detection to something low.

Or the other method is go one step back in the chain and deal with DDOS at a Web Application Firewall (aka Layer 7) level. Otherwise your server is still copping a performance hit from people hitting the front end.

FWIW I'm trying to figure out a similar solution at the moment, not allowing spammers to post links in a guest forum, based on usergroups. That might assist you as well if I can get it figured out.

 

[Dragonfruit]

I still don't think we're on the same page. Basically I have tens of thousands of data center CIDR IP ranges. These can easily be formatted into an XML file to import into the Discouragement. I want them imported in so that it neutralizes anyone that could be using proxy/data servers to spam or attack the boards. Added bonus is to prevent banned users attempting to use them to return.

So I have the IP data, I just need an application to use it. Some users have legitimate use for VPN services and I want them to be able to contact us for help if they're blocked out. Thus the IP banning while effective, isn't ideal.

 

[beerForo]

I believe if you are banned from the site you still see the site and can utilize the contact form. But I am not sure.

 

[Dragonfruit]

I believe if you are banned from the site you still see the site and can utilize the contact form. But I am not sure.

We don't use contact form, we have a dedicated guest section.

 

[beerForo]

But if the user is Discouraged by mistake he or she will have an issue posting and will receive timeouts so they will likely be unable to post there anyway.

 

[Dragonfruit]

But if the user is Discouraged by mistake he or she will have an issue posting and will receive timeouts so they will likely be unable to post there anyway.

Not true, I've had a few members affected able to post/PM for help.

If they can do it, so can a logged out user.

 

[beerForo]

Yes it will take a few tries. That's the whole point of Discouraged. It slows down the site and makes it hard to post. They can eventually so they think they are not banned but think the website has issues and they give up. Hence the name Discouraged.

 

[Dragonfruit]

I understand the intended purpose and I'm not disagreeing with that, but I've found a different application for it. I'm not here to debate that. Obviously every board is different, and all I'm saying is the option to prevent discouraged IPs from logging in would be a benefit as a whole because it allows the system to be used for other applications. How is that not a good thing? It makes XF overall more versatile. Plus what if someone does in fact want the discouraged users not to be able to log in? Maybe even random login fails.

 

[beerForo]

What about:
Ban the IPs. Go to Communication >> Notices, create a notice only banned members see. Say something like if you believe you are locked out by mistake please contact us with a link, etc.