Files

T

pmb 946c2b9e01 Block abusive IPs after repeated failed plan lookups

Port 79 mostly attracts HTTP/SIP probes, TLS handshakes, and username
guessers -- none of which resolve to a plan file. Treat any request that
fails to read a plan as an "offense" and timestamp it against the source
IP.

Add BanTracker (ban.hpp/ban.cpp): a per-IP rolling-window offender list.
When an IP has more than 3 offenses still inside a 24h window, its
connections are dropped without being read or answered; timestamps older
than the window are pruned so a blocked IP frees itself automatically.
State is in-memory (single io_context thread, no locking); the clock is
injected for testability. A periodic sweeper keeps the map bounded.

Legitimate lookups that hit a real plan never count, which also
frustrates username enumeration. Unit tests in test_ban.cpp.

2026-06-15 16:23:58 -07:00

1.9 KiB

Raw Blame History

finger

A silly finger service written in c++20

Compiling:

meson setup builddir
meson compile -C builddir

This will create a static linked binary called builddir/finger. You can copy this to your remote server if you're going to run it via docker.

Building a Dockerfile

Create a Dockerfile with the contents:

# Use a minimal base image
FROM alpine:latest

# Copy the local binary to the container
COPY finger /usr/local/bin/finger

# Make the binary executable
RUN chmod +x /usr/local/bin/finger

# Create the directory for user data
RUN mkdir -p /var/finger/users

# Expose port 79 (finger protocol)
EXPOSE 79

# Set the binary as the default command
CMD ["finger"]

And execute docker build -t finger-app .

Running

Create a docker-compose.yml file:

version: '3.8'

services:
  finger:
    build: .
    ports:
      - "79:79"
    volumes:
      - ./users:/var/finger/users
    restart: unless-stopped

and execute docker compose up -d

Setting your status

within the ./users directory, create a file named after the user you wish to have a response. That's it!

Abuse protection

Most traffic on port 79 is not finger at all -- HTTP and SIP probes, TLS handshakes, and username-guessing scanners. None of these resolve to a plan file, so the daemon treats any request that fails to read a plan as an "offense" and timestamps it against the source IP. When an IP records more than 3 failures within a rolling 24-hour window, its connections are dropped (without being read or answered) until those failures age back out of the window. Legitimate lookups that hit a real plan never count against an IP. All state is in-memory; thresholds live in BanTracker::Config (ban.hpp).

1.9 KiB Raw Blame History