<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Courier New";
color:black;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"Courier New";color:black">Howdy, <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New";color:black">See this admittedly old EZProxy listserv thread that discusses EZProxy and CAPTCHA: <a href="http://osdir.com/ml/education.ezproxy/2008-02/msg00172.html">http://osdir.com/ml/education.ezproxy/2008-02/msg00172.html</a>.
Many of the concerns/issues remain, and in addition there are known issues with EZProxy and Google’s CAPTCHA.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New";color:black">Two factor authentication at the institution level is certainly helpful and something more places are moving towards. Moving from LDAP to Shibboleth authentication proved helpful for us.
Ultimately when dealing with EZProxy there is no substitute for actively monitoring audit log files. I was part of a presentation for OCLC where I discussed this topic,
<a href="https://oclc.webex.com/oclc/lsr.php?RCID=e0cd4b59099040b48b0e4f180c97917f">
view the recording here</a>. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New";color:black">I should also mention I created a Perl script the parses the daily audit log and sends an email to the EZProxy admin with information to help identify compromised accounts. There is some
technical setup, but we have found it useful. The code is available here: <a href="https://github.com/prbutler/EZProxy_Audit_Log_Email_Script">
https://github.com/prbutler/EZProxy_Audit_Log_Email_Script</a>. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New";color:black">Cheers, Paul<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">-------------------------------------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Paul R Butler, mlis<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Library Technologies Support Analyst<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Library Information Technology Services (L.I.T.S)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black"><a href="bsu.edu"><span style="color:#0563C1">Ball State University</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Muncie, IN 47306<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;background:white">P: 765.285.8032</span><span style="font-size:10.0pt;font-family:"Courier New";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">E:
<a href="mailto:prbutler@bsu.edu"><span style="color:#0563C1">prbutler@bsu.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">University Libraries<i>...a destination for research, learning, and friends<o:p></o:p></i></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">The University Libraries provide services that support student pursuits for academic success and faculty endeavors for knowledge creation and classroom instruction.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Eril-l [mailto:eril-l-bounces@lists.eril-l.org]
<b>On Behalf Of </b>Melissa Belvadi<br>
<b>Sent:</b> Tuesday, October 04, 2016 4:00 PM<br>
<b>To:</b> Craig Boman <craig.boman@gmail.com><br>
<b>Cc:</b> eril-l <eril-l@lists.eril-l.org><br>
<b>Subject:</b> Re: [Eril-l] Sci-Hub users asking us to restore their access!<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Well, that would require LDAP/Shibboleth (we use Shib with our ezproxy) to also keep the country-filter. I figured since ezproxy already has some config code to resolve and block IPs based on
country, it would make more sense to implement it there, as it would mean a lot more functionality to add at the other level. We wouldn't want our Shib server to just start Captcha'ing every single authentication - it would drive the rest of the campus unrelated
to the library services bonkers.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">I will check out the EZProxy discussion list.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Melissa<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Oct 4, 2016 at 4:48 PM, Craig Boman <<a href="mailto:craig.boman@gmail.com" target="_blank">craig.boman@gmail.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">If I understand this issue correctly, the captcha wouldn't necessarily be implemented by EZProxy, but rather the authentication to EZproxy. In most cases I would presume this to be either LDAP or Shibboleth. Perhaps we should be encouraging
these two organizations to use captchas, if they haven't already. Another option would be to enable two factor authentication for university resources. This is something my university has recently done.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">All the best,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Craig<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><br>
Craig Boman, MLIS (Ph.D student)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Applications Support Specialist<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">University of Dayton Libraries<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal">Cboman1 _ at _ udayton _dot_ edu<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">ORCID ID: <span style="color:#494A4C">0000-0001-7511-4078</span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#494A4C">"The reason is that good management itself was the root cause. Managers played the game the way it was supposed to be played. The very decision-making and resource-allocation processes
that are key to the success of established companies are the very processes that reject disruptive technologies." -- Clay Christensen</span><o:p></o:p></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Oct 4, 2016 at 3:24 PM, Steve Oberg <<a href="mailto:steve.oberg@wheaton.edu" target="_blank">steve.oberg@wheaton.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">One suggestion I have is to direct this line of inquiry to the EZProxy discussion list, where you might get more exposure to the issue plus a forum that OCLC EZProxy representatives actively engage with. For details see <a href="http://www.oclc.org/support/services/ezproxy/documentation/list.en.html" target="_blank">http://www.oclc.org/support/services/ezproxy/documentation/list.en.html</a>
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Steve<o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:black"><br>
Steve Oberg<br>
Assistant Professor of Library Science<br>
Electronic Resources and Serials<br>
Wheaton College (IL)<br>
+1 <a href="tel:%28630%29%20752-5852" target="_blank">(630) 752-5852</a><br>
<br>
NASIG Vice-President/President-Elect<br>
<img border="0" width="175" height="48" id="m_23179589546151631m_-549678033015345637248CC2DF4-1A90-4183-8198-638888485034" src="cid:image002.png@01D21EED.8B3192D0"></span><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal">On Oct 4, 2016, at 2:19 PM, Melissa Belvadi <<a href="mailto:mbelvadi@upei.ca" target="_blank">mbelvadi@upei.ca</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">That's a good point about demonstrating good faith in licensing terms.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">I've had a further thought, after having learned from Paul about some of the country-specific options, that what we could really use in ezproxy is the ability not to block an entire country across
the board, but perhaps for a given list of countries, require an additional step, and I'm thinking CAPTCHA here rather than personalized second authentication.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">In this situation at least, it's pretty clear that software is running through our proxy server, not a human being, so a CAPTCHA step might stop it. I know CAPTCHAs are engaged in an escalating
war of technologies, and maybe the Sci-Hub hackers would know all of the tricks to beat them, but it might be worth trying. I don't think it would be a horrible thing to do to our researchers over in Russia, China, etc. to have to answer a CAPTCHA before
establishing a proxy cookie - given all the press about international hacking, I'd think they'd understand the need for it quite well.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">So how does one go about getting OCLC to add new security features to Ezproxy?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Melissa<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Oct 4, 2016 at 4:10 PM, Robert Heaton <<a href="mailto:robert.heaton@usu.edu" target="_blank">robert.heaton@usu.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thank you, Paul, for giving the great technical details.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Melissa, we have not had this particular situation, but if I did, I would certainly include the what-you’re-doing-is-illegal
messaging in my response to the users. While the language is different in each case, a great many of our license agreements require at least a good-faith effort to stop activities that are in breach of the license terms once we have become aware of them. Since
we don’t know which vendors’ content they are accessing (then again, I suppose the proxy logs might clue you in), we may not be liable for not contacting the vendors when we learned of the breach. But I would hate for a vendor to think that I didn’t do my
due diligence when the question originally came to me.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Robert Heaton<br>
Interim Head of Collection Development<br>
Utah State University Libraries<br>
<a href="mailto:robert.heaton@usu.edu" target="_blank">robert.heaton@usu.edu</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Eril-l [mailto:<a href="mailto:eril-l-bounces@lists.eril-l.org" target="_blank">eril-l-bounces@lists.eril-l.org</a>]
<b>On Behalf Of </b>Butler, Paul<br>
<b>Sent:</b> Monday, October 03, 2016 2:08 PM<br>
<b>To:</b> Melissa Belvadi <<a href="mailto:mbelvadi@upei.ca" target="_blank">mbelvadi@upei.ca</a>>;
<a href="mailto:eril-l@lists.eril-l.org" target="_blank">eril-l@lists.eril-l.org</a><br>
<b>Subject:</b> Re: [Eril-l] Sci-Hub users asking us to restore their access!</span><o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">Hi Melissa,
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">I must say this is the first time I have heard users from Sci-Hub reaching out to a library to request access be restored. That is comical!
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">A polite educational email seems reasonable, but likely won’t do much to dissuade them – they just want access to the content by any means.
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">Some techniques that can be used to secure EZProxy, that depend on you and your institution’s ability/comfort to tweak EZProxy...</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">Tracking down and reporting the compromised user account to campus IT is the first step. While campus IT does their work I generally block
the user account from EZProxy and terminate all active sessions. </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">I maintain a list of referrers that I block from EZProxy. If you haven’t done that I would suggest it as another useful step. You can find
it here: <a href="https://github.com/prbutler/EZProxy_IP_Blacklist/blob/master/EZProxy_IfReferer_Blacklist.txt" target="_blank">
https://github.com/prbutler/EZProxy_IP_Blacklist/blob/master/EZProxy_IfReferer_Blacklist.txt</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">You can also block access by country, if you are seeing trends and know a legitimate user would not come from a specific country. This is
a good temporary measure. ALL access from a specific country can be blocked by adding the following to the top of config.txt. Country codes are the same as those in the audit logs.
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">::Common</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">IfCountry US; Stop</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">IfCountry BR; Audit Blocking BR; Deny denied.htm</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">IfCountry CN; Audit Blocking CN; Deny denied.htm</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">IfCountry IR; Audit Blocking IR; Deny denied.htm</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">/Common</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">Using Option BlockCountryChange can also help, see the documentation here:
<a href="https://www.oclc.org/support/services/ezproxy/documentation/cfg/option-blockcountrychange.en.html" target="_blank">
https://www.oclc.org/support/services/ezproxy/documentation/cfg/option-blockcountrychange.en.html</a>
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">Tweaking UsageLimit seems reasonable, it is always a balancing act, contact me off list if you would like to know what we use, or have any
other questions. </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">Finally, you can always block access by IP. I maintain the EZProxy IP Blacklist, which is a community supported effort to share IP addresses
that have been used for fraudulent activity. See here: <a href="https://github.com/prbutler/EZProxy_IP_Blacklist" target="_blank">
https://github.com/prbutler/EZProxy_IP_Blacklist</a>. And if you are willing to share the IP addresses used for the fraudulent activity please send them my way and I can add them to the blacklist.
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">With all of this, be sure to check your messages.txt file after you restart EZProxy to make sure nothing has broken.
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><i><span style="font-family:"Courier New"">Caveat emptor!
</span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New"">Cheers, Paul</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New"">-------------------------------------------------</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New"">Paul R Butler, mlis</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New"">Library Technologies Support Analyst</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New"">Library Information Technology Services (L.I.T.S)</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New""><a href="http://bsu.edu/" target="_blank"><span style="color:#0563C1">Ball State University</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New"">Muncie, IN 47306</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New";background:white">P:
<a href="tel:765.285.8032" target="_blank">765.285.8032</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New"">E:
<a href="mailto:prbutler@bsu.edu" target="_blank"><span style="color:#0563C1">prbutler@bsu.edu</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New"">University Libraries<i>...a destination for research, learning, and friends</i></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Courier New"">The University Libraries provide services that support student pursuits for academic success and faculty endeavors for knowledge
creation and classroom instruction. </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Courier New""> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Eril-l [<a href="mailto:eril-l-bounces@lists.eril-l.org" target="_blank">mailto:eril-l-bounces@lists.eril-l.org</a>]
<b>On Behalf Of </b>Melissa Belvadi<br>
<b>Sent:</b> Monday, October 03, 2016 12:41 PM<br>
<b>To:</b> <a href="mailto:eril-l@lists.eril-l.org" target="_blank">eril-l@lists.eril-l.org</a><br>
<b>Subject:</b> [Eril-l] Sci-Hub users asking us to restore their access!</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">We've recently gotten a spate of emails sent to our ezproxy admin address from various users around the world, all basically complaining
that we've somehow blocked their use of Sci-Hub (!) and asking us to restore their access. One of them even sent a screenshot so we know what they're seeing is the "deny.htm" file in ezproxy. </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">They are all very polite and seem to think they are entitled to access, as if they have no idea what they are doing is illegal, or that
the address they are writing to is for an institution that is unwittingly involved as a result of being hacked.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">Here's an example of one such email (leaving off the signature part - they are all very open as to who they are):</span><o:p></o:p></p>
</div>
<blockquote style="margin-left:30.0pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">I’m a French OT student, actually doing litterature researches for my studies. I’m using scihub to get some articles that I need to
reed for that work. Today my access has been blocked.</span><o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">I would be very grateful to you if you could open my access.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">And another:</span><o:p></o:p></p>
</div>
<blockquote style="margin-left:30.0pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">My access to sci-hub has been temporarily denied, due to excessive downloads. I am sorry but I am actually writing my thesis and need
to read that many articles. </span><o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">I would be really grateful if you could give my access back. I cannot afford paying for all those articles online. My thesis is due
for early November. You guys are my only option.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">We've been able to use our ezproxy logs to trace back the most recent activity to a particular student's compromised account, and dealt
with that one that we could find.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">If I understand what's happening, Sci-Hub has collected a huge number of compromised usernames/passwords from many institutions and
tries them (right through our proxy server) when the article someone requests from them is not already in their archive. If so, it's probably rare that this illegal use will even trigger an "excessive use" denial and consequently any chance of us even knowing
this is going on.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">Has anyone else gotten emails like this? </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">If so:</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">How do you handle it, aside from trying to find the breached account? Do you try to explain to the "user" that what they're doing is
illegal?</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">Are you further lowering your max downloads for major publisher sites to try to stop it?</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">--
<o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Melissa Belvadi<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Collections Librarian<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">University of Prince Edward Island<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="mailto:mbelvadi@upei.ca" target="_blank">mbelvadi@upei.ca</a>
<a href="tel:902-566-0581" target="_blank">902-566-0581</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal">Melissa Belvadi<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Collections Librarian<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">University of Prince Edward Island<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="mailto:mbelvadi@upei.ca" target="_blank">mbelvadi@upei.ca</a>
<a href="tel:902-566-0581" target="_blank">902-566-0581</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Eril-l mailing list<br>
<a href="mailto:Eril-l@lists.eril-l.org" target="_blank">Eril-l@lists.eril-l.org</a><br>
<a href="http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org" target="_blank">http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Eril-l mailing list<br>
<a href="mailto:Eril-l@lists.eril-l.org" target="_blank">Eril-l@lists.eril-l.org</a><br>
<a href="http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org" target="_blank">http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Eril-l mailing list<br>
<a href="mailto:Eril-l@lists.eril-l.org">Eril-l@lists.eril-l.org</a><br>
<a href="http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org" target="_blank">http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal">Melissa Belvadi<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Collections Librarian<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">University of Prince Edward Island<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="mailto:mbelvadi@upei.ca" target="_blank">mbelvadi@upei.ca</a> 902-566-0581<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>