nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Block Bots and control anomymous access

Normann P_ Nielsen _Netic_

Bots have started to kill Confluence Data Center, latest is:

GET /pages/diffpagesbyversion.action?pageId=280912688&selectedPageVersions=19249&selectedPageVersions=19250

in extension manner from aionbot - problably: Artificial Intelligence Oracle Network Bot.

At 141.0.0.0 - 141.255.255.255 and other subnets.

Last time it was labels quiries as:

GET /label/portfolio=orchestration+product=kubernetes+scope=kubernetes+scope=timeservice+service=monitoring+target=satellite

with 20+ labels.

That is blocked now.

But Page History and Page Diff are availble to anonymous users.

I would like to block anonymous users acces to specific URL's - but have trouble identifying them in the proxy (apache and Ivanti VTM) in front of Confluence.

Who can I achive that.

Accepted answers

All comments

Nikola Perisic

Hi @Normann P_ Nielsen _Netic_

You should block everything that is accessible by the anonymous users including the public links as well. Also, restrict those pages to only be available to needed users. Run a curl command to see if you can retrieve anonymous data.

Normann P_ Nielsen _Netic_

Sure - but how in the best way. What You are stating is not really new to me….

If You mean with "restrictions" - a lot of the pages are public - and that is intended.

Nikola Perisic

@Normann P_ Nielsen _Netic_ This page might give you better insights: https://community.atlassian.com/forums/discussion/3232815/is-there-some-way-to-limit-the-size-that-is-allowed-for-confluence-page-creation

Normann P_ Nielsen _Netic_

Nops. This is 100% external calls. I cant really see any clues there?

Nikola Perisic

I've found this: https://confluence.atlassian.com/conf59/using-apache-to-limit-access-to-the-confluence-administration-interface-792499746.html

Also you should make configurations in Apache HTTP server which should be mentioned in the documentation.

Normann P_ Nielsen _Netic_

AS per my post:

/pages/diffpagesbyversion.action

/label

has nothing to do with the admin interface, its a fully open URL for all request - like on my own Confluence: https://www.mos-eisley.dk/pages/diffpagesbyversion.action?pageId=4161541&selectedPageVersions=119&selectedPageVersions=118

No auth required….

Nikola Perisic

@Normann P_ Nielsen _Netic_ this doesn't seem like a regular Confluence wiki. Is this built with an application? Restriction of the page is this: https://confluence.atlassian.com/doc/page-restrictions-139414.html

Your page is open to public which is a huge risk.

Normann P_ Nielsen _Netic_

Its a normal Confluence Data Center and normal URLs, - I have several running.

It has nothing to do with Restriction of pages, the 2 URLs are not pages.

Nikola Perisic

From the URL itself as far as I can see it says site name (please delete the url of the page, this is the public forum)/pages followed by versions of the pages and the pageId. As you say that this is not a page, maybe I am missing something?

Normann P_ Nielsen _Netic_

Its not page, its a function to compare versions of a page, that returns a comparison result.

The page is intendedly public (eg not restricted, hence the compare URL/function are also)

As the URL: /label/portfolio=orchestration+product=kubernetes+scope=kubernetes+scope=timeservice+service=monitoring+target=satellite is not a page, its a search function that return all pages with these labels.

The latter one is a real life sample that I also have to block from AI hits, as the bots just keeps putting new labels on the list…

Tomislav Tobijas

Hi @Normann P_ Nielsen _Netic_,

One additional thing worth exploring here is handling this directly at the reverse proxy level rather than through Confluence page restrictions.

Since you're using Apache, you could look into <LocationMatch> to target specific endpoints such as /pages/diffpagesbyversion.action and /label/, while leaving normal public pages accessible.

Just keep in mind that blocking those endpoints entirely would also affect legitimate users. Depending on your Confluence DC version, global rate limiting might also be worth exploring. 👀
And also, this is not really my area of expertise, so I might be a bit off here 🫤

But I kinda feel this would be a good question for the Developer community 👈 Folks there might be able to provide some decent insights or suggestions about this.

Cheers,
Tobi

Normann P_ Nielsen _Netic_

Excatly - that I why I write:

I would like to block anonymous users acces to specific URL's - but have trouble identifying them in the proxy (apache and Ivanti VTM) in front of Confluence.

How do I distinquish between authenticated and not authenticated users in the Proxy .. I have tried a lot of cookie matchiung etc - no luck so far…

Gabriela - LeanZero

Hi Normann,

JSESSIONID won't separate them. Tomcat hands that cookie to anonymous visitors too, which I'd guess is what your cookie matching ran into.

The one that only exists after a login is seraph.confluence, the Remember me cookie. Atlassian's cookie page says Remember me is "enforced by default when Confluence is clustered", and the session timeout KB says the same for Atlassian's own SSO for Data Center app at default settings. So on your two paths I'd send any request arriving without it to the login page, in Apache or vTM. That step is my inference from the docs, I haven't run it against a logged-in session, and since it only checks that the cookie is present it'll turn crawlers away without being a security control.

X-AUSERNAME is a response header, so your proxy sees it after the diff has run.

https://confluence.atlassian.com/doc/confluence-cookies-160794071.html

On a single node without SSO it's only there for people who ticked Remember me. Is yours clustered, or behind SSO?

Tomislav Tobijas

Ah yes. Well, this deffo falls outside of my scope, so I can't say for sure 🤔

I'd still say to reach out to the Dev community as I believe I've seen some people playing around with that stuff.

Apart from that, maybe you could check with Atlassian Support to see if they'll provide any insights or suggestions.

Normann P_ Nielsen _Netic_

HI,

I have a single Confluence DC (I have several 😎 ) and I have tried looking at JSESSIONID, seraph etc - also remember me. Not any luck so far.

But simple bloking /pages/diffpagesbyversion.action when the User-Agent name contains "bot" has taken the heat of one of the instanses….

Nikola Perisic

As this is more developer focused question that would include the changing the Apache settings in a safe way as @Tomislav Tobijas mentioned, your best choice is to ask this in the

https://community.developer.atlassian.com/

Gabriela - LeanZero

Hey @Normann P_ Nielsen _Netic_, thanks for coming back with what you tried, and sorry I tucked the single node part right at the end of my answer. On a single node Remember me isn't enforced by default, so seraph.confluence is only there for the people who ticked Remember me when they logged in. Everyone else who's logged in reaches your proxy with only a JSESSIONID, the same as an anonymous visitor, and I'd guess that's why your cookie matching felt like no luck. I haven't tested forcing it on.

Your "bot" User-Agent block on diffpagesbyversion.action is a sensible stopgap for the crawlers that announce themselves. The ones sending a normal browser User-Agent will walk straight past it, though, so I'd keep an eye on your access log for both paths. Feel free to share a couple of redacted lines if you see them keep coming and I'll happily have a look

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

confluence-data-center