Musings

Rewrite Magic

When you deal with the levels of trackback spam that we do, your defences have to be pretty fine-tuned. I’ve mentioned that I redirect trackback spammers to a tarpit. Here I’d like to explain one of the neat mod_rewrite tricks involved.

I maintain a DBM database of trackback-spammer IP addresses. How the database is populated is a closely-guarded secret. Suffice to say that it consists of key/value pairs, where the key is an IP address and the value is the relative URL of a tarpit CGI script.

The first thing to do was to move the trackback CGI script out of the way:

% mv mt-tb.cgi hidden-tb.cgi

Then, in the server-config section of my httpd.conf file, I added a RewriteMap directive

RewriteEngine on
...
RewriteMap tb_spammers dbm:/file/path/to/the/database

Finally, in the Directory-config section for my MovableType installation, I placed

RewriteEngine on
...
RewriteCond %{REQUEST_URI} mt-tb\.cgi(.*)
RewriteRule .* ${tb_spammers:%{REMOTE_ADDR}|hidden-tb.cgi%1} [L]

Legitimate trackbacks are redirected to the trackback script. Spammers are redirected to the tarpit.

The advantage of using a database are several

1. No need to restart the server when IP addresses are added/deleted.
2. It can handle a large number of IP addresses with equanimity.
3. Lookup results are cached in-core until the mtime of the database changes or the server is restarted. So this method is much faster than any of the alternatives.

mod_rewrite is an incredibly powerful tool. RewriteMap makes it even more powerful, by letting you interface with external databases or programs. In my case, it helps me keep the trackback spammers on a short leash.