XWA Upgrade

Hello,
For a few days, from time to time, I cannot log in.
When I try to log in, I am redirected to the index page of the forum without being connected.

the same happened o me this morning, I put in my login details and tried to login, but like Jeremy was redirected to the index page.

I tried another browser and the same happened I couldn't login, I cleared my cache half a dozen times, in the end I just kept refreshing the page

weird

I had the same problem this morning, took ages to login

I didn't have that particular problem, however I did notice I frequently got disconnects when accessing the site via smartphone. In other cases rather than the forum opening, I got a server message.

Again had a hard time logging in this morning this will be the forth day

Keep getting this error
also this looks suspicious

Who else is having that issue right now?

I heavily limited what not-logged in users can do, hopefully this way it will become less interesting for spammers and other unwanted entities. I really don't know what's going on except that I did get more spam messages from the 'Contact Us' section. (That I also disabled)

Anything else that you noticed?

I dunno but right now I see 440 unregistered guests in the last 5 minutes and that seems entirely unlikely given we are a small insulated and obscure off the grid kind of community...

Upsurge of content viewers due to recent releases, or DDOS attack?

Driftwood wrote: ↑

Thu Feb 14, 2019 5:55 pm

I dunno but right now I see 440 unregistered guests in the last 5 minutes and that seems entirely unlikely given we are a small insulated and obscure off the grid kind of community...

Upsurge of content viewers due to recent releases, or DDOS attack?

I highly doubt it's due to the releases. I am guessing it is some sort attack, not a targeted one at us directly but more likely at phpBB forums in general. I'll dig into it a bit deeper, but I am hopefull that limiting guest users in what they can do will make us a less interesting target.

Yeah... so there are two IP-Ranges that appear to completely trawl the forum. (270.000 requests in sum for both of them, with the next one coming in at 6.000)
I am not a big fan of IP-Range banning, but if this keeps up I might have to put a lid on that. For now I completely blocked the forum for non-logged in users.

I hate doing that, but if the forum is unusable without it there's little I can do

Force, I was wondering too if you would be able to implement SSL login encryption? And maybe Captua's (s/p?) I'm not a bot thing. Good idea to create a more secure website, as there are wackos out there up to no good. You can also use Arin.net or WhoIs to track those IP ranges and maybe make a formal complaint of abuse to the ISP's that control those ranges.

Captchas don't work, but the current bot protection appears to work good. I haven't noticed any unusual new registrations. As for SSL, that costs quite a bit of money on the provider I am currently on. (Free certificates won't work sadly) I am still looking into it, but I don't foresee a solution any time soon.

What about OpenSSL ? Don't know that much about it although the heartbleed bug was an issue a year to two ago.

Problem is that my provider won't let me install my own certificate. Only option is to use one provided by them or find a new provider. Neither of which I want to do right now.

yeah, a free ssl cert is auto blocked by all browsers unless overridden by the user.

However, if it was a possibility you could let us know certain details so we can "trust" the certificate.
At least it would provide data transfer encryption for login if nothing more. (I have personally been sent an email saying what my password was (both in plaintext and as a hash, both of which were correct at the time) and that they had hacked my account)

Trev

It's not the problem of the browser not trusting the free certificates (there are actually free ones available that are trusted by most browsers) the problem is my provider will not let me install my own certificate. It's theirs or none.

However, since I pretty much am giving up on a different page of mine I might be able to transfer that certificate over to this page. I will have to look into that. So maybe I can now use one. (Due to a bug I currently have two free certificates and so far they have not removed the other one)

Well... so that was easier as I thought it would be. (Well minus my stupid programming of course)

So... we should now be completely SSL connected and the webserver should even force the issue so using a non-https link *should* forward to the https on the main page. I will need to add redirects to all subfolders to be sure, but most of the stuff should be good now. If anybody notices any issues please let me know.

Kinda sad that this will mean I will now have to shut-down my other page, but it was barely used anyways...

It works great. Thanks.

Oooooo does that mean my sites HTTPS now?

Oh it's not oh well

Darksaber wrote: ↑

Sat Feb 16, 2019 8:27 pm

Oooooo does that mean my sites HTTPS now?

Oh it's not oh well

Mhm... actually I have to check that. It's not set to force the issue I think, but it might actually accept the certificate. Let me get back to you on that.

Actually it can be, or rather I set it to now force https wherever possible. You will have to change all your links and css to properly work with https now though. And you should always use the correct link:

https://darksaber.xwaupgrade.com and not https://www.darksaber.xwaupgrade.com

It's mostly working, I think there are just a few hardcoded http links on your main page. If something broke and you want to stop forcing https until you fix it you need to edit the .htaccess file in your home directory and remove the first three lines.

Actually I think there are only three issues. Your home link points the www.darksaber.xwaupgrade.com, you include a few images from extreme-dm.com (which you shouldn't at all, that is a known add-tracker) and the favicon needs to be changed to the proper https location.

Cheers Force, I think I've fixed all the links including links to here, removed the tracker, I haven't logged onto it in years

Darksaber wrote: ↑

Sun Feb 17, 2019 12:01 am

Cheers Force, I think I've fixed all the links including links to here, removed the tracker, I haven't logged onto it in years

Looks good