1. Forum
  2. spooknet
  3. SN SECURITY

  • Any tips for proactive security for a BBS

    From Operon@700:100/106 to All on Thu Aug 20 18:30:40 2026

    Team,

    I just started getting back into BBSing aftera a 30 year hiatus, and already had my first trolls visiting. I am just wondering if there is something y'all are doing to keep this at a minimum.

    Most of my blocks against scripts/trolls lies at my router where I have huge block lists set up for my forwarded ports. But that is only one layer, people not at VPS centers or known scanner/bas actor sites can still get in (and should be, it is a BBS after all).

    What I try to figure out if you have secondary measurements in place for users that abuse your system, either multiple levels (new user, trusted user) etc. with appropriate access to NetMail/Echomail/MRC, or a scanner for bad user names or language that goes way overboard. I am pretty relaxed and solid in the Free Speech camp, but it has it limits.

    Happy to hear your thoughts!

    Operon.

    --
    --- Amplicon/ENiGMA1/2
    * Operon @ Amplicon BBS -- amplicon-bbs.org -- science & homelab
    --- ENiGMA 1/2 v0.5.1-beta (linux; x64; 22.23.2)
    * Origin: Amplicon (700:100/106)
  • From roman@700:100/72 to Operon on Fri Aug 21 09:08:33 2026
    I think the same advice as in the forums. The easiest way is to registration only via mail with a specific domain (for example, only Yahoo and Gmail). Guest mode - Read Only. Registration through manual activation and so on.
    Perhaps you are also dealing not with trolls, but with AI agents programmed for this.

    --- Mystic BBS v1.12 A48 (Linux/64)
    * Origin: Shipwrecks & Shibboleths [San Francisco, CA - USA] (700:100/72)
  • From poindexter FORTRAN@700:100/20 to Operon on Fri Aug 21 14:20:38 2026
    Operon wrote to All <=-

    Team,

    I just started getting back into BBSing aftera a 30 year hiatus, and already had my first trolls visiting. I am just wondering if there is something y'all are doing to keep this at a minimum.

    Synchronet has the ability to block automated telnet and SSH attempts,
    either for a period of time or permamently. Most of my headaches come
    from bots trying telnet to see if I'm a vulnerable router
    ("Admin/password", "system/system", etc...)

    Many people run Fail2Ban on *nix systems, which I wish I could run.
    Others have used blocklist based Windows tools like Peerblock.

    Some take the step of geoblocking entire countries.

    I'm debating about taking my message boards off of the web service, I
    don't think many people use them. If you do, make sure your guest
    account access level doesn't have access to networked message boards.
    If guest can see the networks, search engine web crawlers can scrape
    message boards for content.

    I've thought about running a WAF, maybe Cloudflare, but I would need to
    do some extra work. I use one hostname for web, telnet, ssh, bink, and IRC,
    would need to either set up tunnels for each or move them to their own
    hostnames.



    ... Vikings invented the microchip.
    --- MultiMail/Win v0.52
    * Origin: realitycheckBBS.org -- information is power. (700:100/20)
  • From roman@700:100/72 to poindexter FORTRAN on Sat Aug 22 09:16:40 2026
    Consider routers with built-in automatic blocklist filtering: Asus AiProtection (Trend Micro) updates IP blacklists automatically. MikroTik can run scripts to fetch blocklists from Spamhaus etc. pfSense/OPNsense with pfBlockerNG also does this with minimal setup. No extra server software needed.

    --- Mystic BBS v1.12 A48 (Linux/64)
    * Origin: Shipwrecks & Shibboleths [San Francisco, CA - USA] (700:100/72)
  • From Operon@700:100/106 to roman on Sat Aug 22 17:32:42 2026

    Roman & Poindexter,

    My router has indeed the pfBlockerNG and I have blocklists set up for email/IMAP, and now some extra specifically for telnet.

    I have been playing with the idea of fail2ban or crowdsec, which I have used successfully in other containers, but to be honest currently probably not necessary. I have rate-limited the telnet/ssh access from the same IPs on the router though.

    What I did do in the end is to set up a 'trusted_user' tier, and let the default 'users' tier have no write access to Echomail, onelinerz, rumorz, and some other doors.

    Operon
    --
    --- Amplicon/ENiGMA1/2
    * Operon @ Amplicon BBS -- amplicon-bbs.org -- science & homelab
    --- ENiGMA 1/2 v0.5.1-beta (linux; x64; 22.23.2)
    * Origin: Amplicon (700:100/106)
  • From poindexter FORTRAN@700:100/20 to roman on Sat Aug 22 23:29:21 2026
    roman wrote to poindexter FORTRAN <=-

    Consider routers with built-in automatic blocklist filtering: Asus AiProtection (Trend Micro) updates IP blacklists automatically.
    MikroTik can run scripts to fetch blocklists from Spamhaus etc. pfSense/OPNsense with pfBlockerNG also does this with minimal setup. No extra server software needed.

    For those with a little time and technical skills, there's Nginx Proxy
    Manager Plus - it adds on to a nicely configurable reverse proxy with
    online IDS and WAF capabilities. I could never get the crowdsec features working and should try again.



    ... Keith spoke in ALPHANUMERALS
    --- MultiMail/Win v0.52
    * Origin: realitycheckBBS.org -- information is power. (700:100/20)
  • From roman@700:100/72 to Operon on Sun Aug 23 09:14:04 2026
    Your setup looks solid. For telnet/SSH rate limiting and user tiering are good. If you have time, try CrowdSec again-it pairs well with pfBlockerNG. The confusion might come from overlapping logs between these tools; check each one separately.

    --- Mystic BBS v1.12 A48 (Linux/64)
    * Origin: Shipwrecks & Shibboleths [San Francisco, CA - USA] (700:100/72)