watch the httpd access log rather than the mysql database

README.md

@@ -6,10 +6,8 @@ stopforumspam API](https://www.stopforumspam.com/usage) and
 To deploy:
 
 * modify the configuration variables in the scripts
-* copy the scripts to /usr/local/bin
-* add a line like `0 0 * * * /usr/local/bin/q2a_usercheck.sh` to root's
-  crontab. Alternatively, you can add `q2a_usercheck.sh` to /etc/cron.daily/
-  if it exists (for example, on debian).
+* copy the scripts to `/usr/local/bin`
+* register `q2a_usercheck.sh` as a systemd unit or rc script
 
 TODO:
 * add support for pf

forumspam.sh

@@ -10,18 +10,23 @@ curl 'http://api.stopforumspam.org/api?ip='$ip 2>/dev/null > $repl
 
 if ! grep -q '<response success="true">' $repl; then
 	echo error failed to query stopforumspam api >> $logf
+	rm $repl
 	exit 1
 fi
 if ! grep -q '<appears>yes</appears>' $repl; then
+	rm $repl
 	exit 0
 fi
 freq=`grep '<frequency>' $repl | sed 's/<frequency>//; s!</frequency>!!'`
 if [ "$freq" -ge 1 ]; then
 	if ufw deny from $ip >/dev/null; then
 		echo `date` blocked ip $ip with freq $freq >> $logf
+		rm $repl
 		exit 0
 	else
 		echo error failed to add ufw rule >> $logf
+		rm $repl
 		exit 2
 	fi
 fi
+rm $repl

q2a_usercheck.sh

@@ -1,19 +1,16 @@
 #!/bin/sh
 
-mysql_user='q2a_user'
-mysql_pass='q2a_pass'
-mysql_db='q2a_db'
+logf='/var/log/nginx/access.log'
+cache='/tmp/forumspam_cache'
 
-tmpf=`mktemp`
-yesterday=`date -d yesterday '+%Y-%m-%d %H:%M:%S'`
+install -m 600 /dev/null $cache
 
-mysql -u $mysql_user "--password=$mysql_pass" $mysql_db -e \
-	"SELECT INET_NTOA(CONV(HEX(createip),16,10))
-	FROM qa_users WHERE created >= '$yesterday';
-	" | sed '1d' | sort | uniq > $tmpf
-
-while read ip ; do
-	/usr/local/bin/forumspam.sh "$ip"
-done < $tmpf
-
-rm $tmpf
+tail -F $logf | while read line ; do
+	case $line in (*"POST"*)
+		ip=`echo $line | awk '{print $1}'`
+		if ! grep -q $ip $cache; then
+			echo $ip >> $cache
+			/usr/local/bin/forumspam.sh "$ip"
+		fi
+	esac
+done