License Violation Procedures

Violations are reported by vendors to us via eleres. The IP address and timestamp of violation are often noted. Sometimes a special string is sent by the vendor to the proxy server so you can find the offending time/IP/account in the proxy logs. The vendor will let you know what it is in their communication.

Our proxy server address is 128.119.168.112.

1. Identify the compromised account.
2. Temporarily block the IP.
3. Report account to abuse@oit.umass.edu
4. Respond to vendor letting them know you have blocked and reported the account.
5. OIT will respond telling you they have reset the account's password. Once you have received this notification lift the block on the account.
6. Move all emails into the Proxy Abuse folder in the eleres email account.

1. Review the proxy logfile.
   1. If investigating the abuse on the same day as it occurred, you can simply view the logfile in EZproxy's admin for the current day.
      1. Search via the IP/time or the code to find the account.
   2. If investigating the abuse on a different day you need to
      1. To access past UNIX side saved logs:
         1. Login and change to logs directory e.g. cd logs
         2. View available logs e.g. ls
         3. Saved logs have timestamp of date/time they were saved in filename.
         4. Use UNIX commands to search entries in log to find offending username, below is one way using the more command
            • more filename opens file
            • /20110605:02 goes to that text string timestamp forward in the file
            • h will display a help file of commands
            • q will quit you out of the more function
         5. If using Putty, you can right click on header to copy screen to Clipboard
         6. Alternatively use psftp to ftp the entire logfile to your PC

• Set up a local file somewhere in your C Drive for the software to use when you edit the text files.

Using a FTP client (preferably WinSCP- Put in a SysHelp Ticket to have it installed on your machine) access the Proxy Server.

• The Username and Password can be obtained from Scott, Kat, or Jack.
• Once logged in, Identify the user.txt file in the main directory.
• There are a couple old files and backups that are not used anymore. Make sure you select the correct one.
• Drag the file from the right pane into the left pane (the local folder on your C Drive).
• Allow it to overwrite or change the existing version if there is one.
• Double click on the file in the local folder to open the text editor. (For more advanced edits, use Notepad++ - Put in a SysHelp Ticket to get it on your machine).
• The file has a specific structure. The beginning has administrative information, etc.
  • Different sections are commented out using a #
• Find the line that begins with #Add user to be blocked….
  • Add a new line in this format= Netid::deny
• Save the local copy.
• Drag the local file back into the Proxy Server and allow it to overwrite the existing file.
• Go to the EZProxy Admin and login with the same credentials as the Server.
• Restart the Server AFTER you've updated the file.

Suspected abuse of UMass NetID (below) going through the library proxy. This person was logged on IP ###.###.###.### (over the past 24 hours OR timestamps).

UMass NetID: NETID

I identified the offending user id and put a deny request in our proxy. I have informed our IT folks so they can force the id owner to reset their password. Please lift any blocks against our IP.

Using a FTP client (preferably WinSCP- Put in a SysHelp Ticket to have it installed on your machine) access the Proxy Server.

• The Username and Password can be obtained from Scott, Kat, or Jack.
• Once logged in, Identify the user.txt file in the main directory.
• There are a couple old files and backups that are not used anymore. Make sure you select the correct one.
• Drag the file from the right pane into the left pane (the local folder on your C Drive).
• Allow it to overwrite or change the existing version if there is one.
• Double click on the file in the local folder to open the text editor. (For more advanced edits, use Notepad++ - Put in a SysHelp Ticket to get it on your machine).
• The file has a specific structure. The beginning has administrative information, etc.
  • Different sections are commented out using a #
• Find the line that begins with #Add user to be blocked….
  • Remove the line that contains the netid in question.
• Save the Local copy.
• Drag the local file back into the Proxy Server and allow it to overwrite the existing file.
• Go to the EZProxy Admin and login with the same credentials as the Server.
• Restart the Server AFTER you've updated the file.

n.b. “label” in the above refers to the email subject line