Lemmy @lemmy.ml coffeeisnotlatte @latte.isnot.coffee 1y ago

Can you help me deal with the bots?

Trying to purge them and set up with Lemmy Ansible, I've disabled signups without admin approval for now.

I see a postgres container and a password but I'm not very familiar with postgres, I tried psql but can't get access

Edit: Also anyone who's de-federated with us, please reconsider. We're a small server with active admin and will get a handle on this, I promise! We had an easy process to sign up for a few days while I got my users over and forgot to turn it off

Edit2: Looking much more healthy now, I will put the commands I've used in a comment below

22 comments

Turn on captchas too.

I think the easiest is login to the docker and run the postgres client to run sql to delete users. I dont know how to differentiate between your bot and normal
- Yeah that's the issue I'm having, someone sent me a postgres command in DM earlier but it does seem to be a bit of a nuke/picking up ordinary users....
  
  I wound up adding adminer to the docker-compose file temporarily to help me look through the data. In my case, there were no legitimate users who hadn't verified their email, so I deleted all from local_users where the email verified column was false.
Hey there! Thank you for reaching out. I'll definitely not block your instance then. Regarding postgres, first login to the postgres container with docker exec -it containername busybox /bin/sh

You can get the container name by running docker ps. Once inside login to psql console with psql -U lemmy

I've written this from memory, but it should be very similar if not the same.

EDIT: Consider saving the usernames and details of the bots that signed up. We might be able to use that for some analysis.
- Yup I've got them, luckily 5 or more repeating numbers in their email pretty much identified 99% of them. Would you like me to send the CSV somewhere? 27k+ bots
  
  It's be interesting to see where they are coming from, do you have up and user agents in the logs at all?
docker exec -it postgres sh export PGPASSWORD=$POSTGRES_PASSWORD psql -u $POSTGRES_USER

Something like this by heart.

PM me tomorrow if you are stuck (I’m in Europe).
I'm not on lemmy.ml but I think you could get more answers by posting this on [email protected]
- Nevermind, I'm in with user 'lemmy' :) I will start cleaning this up now...
The command to connect to the DB is psql -U <user> <DB_name>.
Usually you also have to use the -p flag but I've been connecting directly to the container without it. Not sure if it's because the container already has the password in a environment variable
Edit: Also anyone who’s de-federated with us, please reconsider. We’re a small server and will get a handle on this, I promise!

In terms of getting refederated, consider:

Making a post in your meta community once you have the bot accounts cleared up. Have the post describe your cleanup process, and measures you've put in place to prevent future bot storms, and what measures you have in place to detect abuse before it gets so far out of hand next time.

Make an alt account on a broadly federated server, and verify it from your main latte account's profile or in the meta-post.

Use this account to contact admins on instances that have defederated from you, show them the post explaining how you've cleaned up and improved your processes and the verification that this alt is really owned by you as an admin on another instance and that you're using it rather than your main to communicate around federation blocks.

I would not expect most admins to review their blocklists unless you give them a reason to by showing them it's less spooky to federate with you today than it was last week. Good luck, and sorry you're having to deal with this.
https://lemmy.dbzer0.com/u/db0 from lemmy.dbzer0.com just made a blog about a new tool he created to use a chain of trust between instances to whitelist instances in an effort to prevent spam maybe contact them about it? https://dbzer0.com/blog/overseer-a-fediverse-chain-of-trust/

22 comments