Spam control
Several complementary layers — each section below says where to
configure it:
1. Pre-login bot gate (telnet only)
Before showing the login menu, the BBS prompts:
Press ESC or * twice to continue...
Auto-scanners just dump bytes — they don't follow prompts and time
out after BOT_GATE_TIMEOUT seconds (default 30). Real humans tap
ESC twice and proceed. SSH and rlogin skip this since they've
already authed at the protocol layer.
2. NUV — New User Verification
NUV_ENABLED=true
Every new registration is marked is_verified=False and can't log
in until a sysop clicks Approve at Admin → Pending Users.
Approval triggers an automatic welcome PM.
3. Manual IP bans
Admin → IP Bans (/admin/ip-bans). Ban a single IP or a CIDR
range. Optional TTL in days (0 = permanent). Login + register routes
both refuse banned IPs.
4. Login auto-ban
The same Admin → IP Bans page also has an auto-ban settings
panel — this is arguably the most important layer here, since it
runs with no sysop intervention at all. Repeated failed logins from
one IP within a configurable window get a temporary ban automatically.
Defaults: 10 attempts / 5-minute window / 1-hour ban. All three are
sysop-adjustable on the same page.
5. Registration rate limiting
New-account registration is rate-limited per IP (default: 3 attempts
per hour) independently of the login auto-ban above — this stops
registration-form spam even from an IP that's never tried to log in.
Attempts are logged for the sysop to review.
6. IP whitelist
Admin → IP Bans also has a whitelist. An IP on it bypasses every
ban above (manual or auto) — useful for a sysop's own static IP, or a
trusted peer BBS's BinkP/QWK source address.
7. Country blocking
Admin → Settings (/admin/settings) has a "Blocked countries"
field — comma-separated ISO codes (e.g. CN,RU,KP). Blank disables
it. Looks up the caller's country via ip-api.com (no registration/API
key needed).
8. Word filter
Admin → Word Filter. Sysop maintains a list of bad terms and
their replacement (e.g. ****). Applied at write-time on:
- Shoutbox posts
- Board posts
- PMs
- Oneliners
Filter is in-memory cached, but the cache is invalidated automatically
on every add/toggle/delete — no manual reload step needed.
9. File moderation queue
FILE_MOD_QUEUE_ENABLED=true
Non-admin uploads land in data/file-queue/ with a FileQueueEntry
row. Admin → File Queue lets sysop approve (publishes to area)
or reject (deletes from quarantine).
Bonus: per-user
Users can self-block at User menu → Block List. Blocked users
can't PM them or @-mention them.