[MM3-users] Bots outbreak - Subscriptions pending user confirmation (58)

Odhiambo Washington via Mailman-users writes:

<Location /accounts/signup> <Limit POST PUT DELETE> Order allow,deny

I guess you're using mod_access_compat? Is there some reason you *want* people using TOR to access the non-mutating methods? If I'm not going to allow them to signup, I would just deny them access to that location altogether (ie, use no LIMIT section).

            Allow from all
            Include /opt/mailman/tor-exit-list.conf
       </Limit>

</Location>

Assuming that the content of tor-exit-list.conf is a long list of correctly formatted "Deny from" addresses, looks like it should work to me.

cat /opt/mailman/tor-exit-list.conf | wc -l 2081

Does this mean the restrictions aren't caching them?

You'd have to look at the sources of the subscription requests in the log and compare to tor-exit-list to find out. You would also be able to see if TOR exits are being denied.

Steve