Note: You are currently viewing documentation for Moodle 3.7. Up-to-date documentation for the latest stable version of Moodle may be available here: Reducing spam in Moodle.

Reducing spam in Moodle: Difference between revisions

From MoodleDocs
No edit summary
(changed link)
 
(39 intermediate revisions by 7 users not shown)
Line 1: Line 1:
==The easy way==
{{Security}}
==The best thing to do==


Upgrade to 1.9.4 or later and use the new [[Security_overview| Security report]] to analyse your configuration.  Then do all the things it tells you.
Upgrade to the latest stable version of Moodle and use the [[Security_overview| Security report]] to analyse your configuration.  Then do all the things it tells you.


==Strongly recommended==
Note this is not strictly necessary to combat just profile spam (see the critical settings below) but it will protect you against dozens of other known security vulnerabilities.


* Make sure that 'register_globals' is switched off in your PHP settings (this is the default).  Otherwise your site may be at risk of being cracked, allowing spammers to modify your scripts and insert spam wherever they like.
==Critical settings==


==Further suggestions==
# Make sure that 'register_globals' is switched '''off''' in your PHP settings (this is the default).  Otherwise your site may be at risk of being cracked, allowing spammers to modify your scripts and insert spam wherever they like.
# Keep "Force users to login for profiles" '''enabled''' in ''Site administration > Security > [[Site security settings]]'' to prevent anonymous visitors and search engines from seeing user profiles.
# Keep "Profiles for enrolled users only" '''enabled''' in ''Site administration > Security > Site security settings''.  This will prevent affected profiles from being visible even to other users on the site.


* Keep "Force users to login for profiles" enabled in ''Administration > Security > [[Site policies]]'' to keep anonymous visitors and search engines away from user profiles.
==Strong recommendations==
* Keep "Profiles for enrolled users only" enabled in ''Administration > Security > [[Site policies]]'' (in Moodle 1.6.9, 1.7.7, 1.8.8 and in 1.9.4 onwards).
* Keep self registration disabled in ''Administration > Users > Authentication > [[Manage authentication]]'' common settings.
* Consider the [[Risks|spam risks]] involved in allowing certain capabilities, such as [[Capabilities/mod/forum:replypost| replying to forum posts]], for visitor accounts.


If [[Email-based self-registration]] is used for self registration:
*Make sure you '''upgrade your site often'''.  Recent versions of Moodle have new fixes and warnings that will help you avoid security issues.
* Add spam protection to the new account form by enabling reCAPTCHA (in Moodle 1.9.1 onwards) - see [[Security FAQ]] for details of how to do so. ReCAPTCHA is quite effective against '''most''' automated spambots, but will not foil human spammers at all.
*Consider the [[Risks|spam risks]] involved in allowing certain capabilities for visitor accounts, such as [[Capabilities/mod/forum:replypost| replying to forum posts]] or posting to blogs.
* Limit self registration to particular email domains with the allowed email domains setting or deny email addresses from particular domains, such as mailinator.com and temporaryinbox.com, with the denied email domains setting. Both settings are in ''Administration > Users > Authentication > [[Manage authentication]]'' common settings.
* Consider only enabling self registration for a short period of time to allow users to create accounts, and then later disable it.
* Keep "Email change confirmation" enabled in ''Administration > Security > [[Site policies]]'' (in Moodle 1.8.6 and in 1.9.2 onwards).


==Cleaning up profiles==
==Allowing self-registration==
If your site was open and you have a spam problem then here are some things you can do to clean up the profiles:
* Browse your user list looking for patterns to detect users who need to be deleted.  For example, spammers might have chosen a country that none of your real users has.
* Use the "Bulk user actions" tool under Admin > Users > Accounts to find all these users and delete them.  Note that versions prior to 1.6.7, 1.7.5, 1.8.6, 1.9.2 had a [http://moodle.org/mod/forum/discuss.php?d=101407 bug] that did not properly hide deleted user profiles, so make sure you have upgraded to a later version if you want to keep user profiles visible to the world.
* '''Spam Cleaner''' is a simple script to help you delete spammer accounts more easily:
** Download:  [http://cvs.moodle.org/contrib/tools/spamcleaner/spamcleaner.php?view=co spamcleaner.php]
** Feedback/discussion:  issue MDL-17144 in the Moodle tracker


[[Category:Security]]
If you don't need it, keep self-registration '''disabled''' (it's the default) in ''Site administration > Plugins > Authentication > Manage authentication'' common settings. 


If you '''must''' use [[Email-based self-registration]] to allow people to make their own accounts then:
# Add spam protection to the new account form by enabling reCAPTCHA - see [[Security FAQ]] for details of how to do so. ReCAPTCHA is quite effective against '''most''' automated spambots, but will not foil human spammers at all.
# Limit self registration to particular email domains with the allowed email domains setting or deny email addresses from temporary email domains with the denied email domains setting. (Tip: search the Internet for an up-to-date list of domains for disposable and temporary email addresses then copy and paste the whole list into the denied email domains field.) Both settings are in ''Site administration > Users > Authentication > Manage authentication'' common settings.
# Consider only enabling self registration for a short period of time to allow users to create accounts, and then later disable it by setting 'Self registration' to Disable in the common settings in ''Site administration > Plugins > Authentication > Manage authentication''.
# Keep "Email change confirmation" enabled in ''Site administration > Security > [[Site settings]]''.
# Use the ''Site admin > Security > IP Blocker > Blocked IP List''.  See the discussion here: https://moodle.org/mod/forum/discuss.php?d=222063#p996786
==Cleaning up user profile spam==
[[File:spam cleaner.png|thumb|Spam cleaner]]
If your site was open in the past and you have a spam problem then here are some things you can do to clean up the profiles:
# Use our Spam cleaner report in ''Site administration > Reports > Spam cleaner'' to locate user accounts responsible for spam and other nasty stuff and help you delete them. In addition to user profile descriptions, comments, blog posts and messages are also searched for keywords.
# Browse your user list looking for patterns to detect users who need to be deleted.  For example, spammers might have chosen a country that none of your real users has.
# Use the delete buttons or the [[Bulk user actions]] tool in ''Site administration > Users > Accounts'' to find all these users and delete them.
== See also ==
* [[Security FAQ]]
* [[Hacked site recovery]]
* [https://moodle.org/mod/forum/discuss.php?d=307795 Fighting spam on moodle.org] forum discussion
[[Category:Report]]
[[Category:Site administration]]
[[es:Minimizar_el_spam_en_Moodle]]
[[eu:Spama_murriztu_Moodle-n]]
[[eu:Spama_murriztu_Moodle-n]]
[[fr:Réduire le spam]]
[[fr:Réduire le spam]]
[[ja:Moodleでスパムを減らすには]]
[[ja:Moodleでスパムを減らすには]]
[[de:Spam reduzieren in Moodle]]

Latest revision as of 14:10, 5 December 2018

The best thing to do

Upgrade to the latest stable version of Moodle and use the Security report to analyse your configuration. Then do all the things it tells you.

Note this is not strictly necessary to combat just profile spam (see the critical settings below) but it will protect you against dozens of other known security vulnerabilities.

Critical settings

  1. Make sure that 'register_globals' is switched off in your PHP settings (this is the default). Otherwise your site may be at risk of being cracked, allowing spammers to modify your scripts and insert spam wherever they like.
  2. Keep "Force users to login for profiles" enabled in Site administration > Security > Site security settings to prevent anonymous visitors and search engines from seeing user profiles.
  3. Keep "Profiles for enrolled users only" enabled in Site administration > Security > Site security settings. This will prevent affected profiles from being visible even to other users on the site.

Strong recommendations

  • Make sure you upgrade your site often. Recent versions of Moodle have new fixes and warnings that will help you avoid security issues.
  • Consider the spam risks involved in allowing certain capabilities for visitor accounts, such as replying to forum posts or posting to blogs.

Allowing self-registration

If you don't need it, keep self-registration disabled (it's the default) in Site administration > Plugins > Authentication > Manage authentication common settings.

If you must use Email-based self-registration to allow people to make their own accounts then:

  1. Add spam protection to the new account form by enabling reCAPTCHA - see Security FAQ for details of how to do so. ReCAPTCHA is quite effective against most automated spambots, but will not foil human spammers at all.
  2. Limit self registration to particular email domains with the allowed email domains setting or deny email addresses from temporary email domains with the denied email domains setting. (Tip: search the Internet for an up-to-date list of domains for disposable and temporary email addresses then copy and paste the whole list into the denied email domains field.) Both settings are in Site administration > Users > Authentication > Manage authentication common settings.
  3. Consider only enabling self registration for a short period of time to allow users to create accounts, and then later disable it by setting 'Self registration' to Disable in the common settings in Site administration > Plugins > Authentication > Manage authentication.
  4. Keep "Email change confirmation" enabled in Site administration > Security > Site settings.
  5. Use the Site admin > Security > IP Blocker > Blocked IP List. See the discussion here: https://moodle.org/mod/forum/discuss.php?d=222063#p996786

Cleaning up user profile spam

Spam cleaner

If your site was open in the past and you have a spam problem then here are some things you can do to clean up the profiles:

  1. Use our Spam cleaner report in Site administration > Reports > Spam cleaner to locate user accounts responsible for spam and other nasty stuff and help you delete them. In addition to user profile descriptions, comments, blog posts and messages are also searched for keywords.
  2. Browse your user list looking for patterns to detect users who need to be deleted. For example, spammers might have chosen a country that none of your real users has.
  3. Use the delete buttons or the Bulk user actions tool in Site administration > Users > Accounts to find all these users and delete them.

See also