I assume fail2ban does its own thing and not compatible with anything else anyway. I've never got any of the regex testing sites to work with fail2ban rules. I gave up with them in the end.
You will not be able to post if you are still using Microsoft email addresses such as Hotmail etc
See here for more information viewtopic.php?f=20&t=7296
See here for more information viewtopic.php?f=20&t=7296
Check if your IP is banned
viewtopic.php?t=7286
viewtopic.php?t=7286
Server updates
Re: Server updates
Re: Server updates
I've tried another exploites rule optimize. Does not really seem to be many differences in matches between the old and the original, also considering the log file is constantly changing as well... A full log scan has changed from about 15 minutes to 9 minutes now..
Re: Server updates
Just so people are aware, I need to update the forum software.. which also means I need to update php... Which generally results in loads of stuff breaking. 
I'm going to practice on a backup server first to see what the carnage will likely look like.
It normally starts with the forum banner going back to default as I have to manually change the styles. Dark theme will likely break totally. Some extensions may stop working. Normally the phpbb3 update scripts don't work and I end up hacking stuff to get it to work etc Possible the wiki may break also.
It will be work which will likely be ongoing for the next few weeks. I'll let people know when I start updating the live server. It may well go down a lot and error while things get updated. It will certainly take time to work through everything and fix problems as they show up.
Meanwhile the only thing people may see is the server running slow or timing out as I make backups as I go along. I may turn the forum off from time to time while I update the database etc.
I'm going to practice on a backup server first to see what the carnage will likely look like.
It normally starts with the forum banner going back to default as I have to manually change the styles. Dark theme will likely break totally. Some extensions may stop working. Normally the phpbb3 update scripts don't work and I end up hacking stuff to get it to work etc Possible the wiki may break also.
It will be work which will likely be ongoing for the next few weeks. I'll let people know when I start updating the live server. It may well go down a lot and error while things get updated. It will certainly take time to work through everything and fix problems as they show up.
Meanwhile the only thing people may see is the server running slow or timing out as I make backups as I go along. I may turn the forum off from time to time while I update the database etc.
Re: Server updates
The forum software has been updated, unfortunately the search box and the forum banner is wrong because all the templates have been overwritten and finding out what does what is incredibly time-consuming..
I thought I would just enable the forum because I can be messing around with CSS code for days at this rate
EDIT:
Should be fixed..
The light box extension isn't working.. So clicking image will not pop up a larger image because the extension is too far behind with updates currently. I have opened up a support request...
I have updated the pro silver full theme, the black carbon theme I will not be updating and cannot guarantee things are not broken in it.
I need to update php next...
I thought I would just enable the forum because I can be messing around with CSS code for days at this rate
EDIT:
Should be fixed..
The light box extension isn't working.. So clicking image will not pop up a larger image because the extension is too far behind with updates currently. I have opened up a support request...
I have updated the pro silver full theme, the black carbon theme I will not be updating and cannot guarantee things are not broken in it.
I need to update php next...
Re: Server updates
Popup image lightbox should be working again now...
Re: Server updates
We should be running PHP8 now. I need to start switching the store/wiki etc over now.. really hope nothing breaks...
If anyone sees anything out of the ordinary on anything whatsoever then please let me know otherwise I may not know about problems otherwise...
EDIT:
107 server updates this week!!!! ouch!!!!
EDIT2:
Will update this list of what extensions have been updated:
Lightbox.
Mentions.
ABBC3.
Board Announcements
Board rules.
image attach rotation.
cleantalk.
If anyone sees anything out of the ordinary on anything whatsoever then please let me know otherwise I may not know about problems otherwise...
EDIT:
107 server updates this week!!!! ouch!!!!
EDIT2:
Will update this list of what extensions have been updated:
Lightbox.
Mentions.
ABBC3.
Board Announcements
Board rules.
image attach rotation.
cleantalk.
Re: Server updates
So it looks like the extension "New User Default Settings:" by David63 has "gone".
Looking on his own forum https://phpbbdev.space/viewtopic.php?t=33 and github, and phpbb forums, everything has gone and there is no way to even contact him anymore. Looks like he has taken some crap form some people which no doubt drove him "into silence" which is commonplace on the Internet these days
The extension is still working currently, its useful for setting default settings for new users.
Aside from that all the extensions have now been updated now.. and all server updates should all be done now. I've had to fix the odd thing which didn't like PHP8.
I won't know if anything is broken on the store checkout unless someone mentions it.. There's a lot of "background" scripts which are only run after payment. So they cannot be tested until someone actually does an order...
Looking on his own forum https://phpbbdev.space/viewtopic.php?t=33 and github, and phpbb forums, everything has gone and there is no way to even contact him anymore. Looks like he has taken some crap form some people which no doubt drove him "into silence" which is commonplace on the Internet these days
The extension is still working currently, its useful for setting default settings for new users.
Aside from that all the extensions have now been updated now.. and all server updates should all be done now. I've had to fix the odd thing which didn't like PHP8.
I won't know if anything is broken on the store checkout unless someone mentions it.. There's a lot of "background" scripts which are only run after payment. So they cannot be tested until someone actually does an order...
Re: Server updates
Apologies for unplanned downtime... After a load of updates and a reboot, the forum "died". Long story short, my RamDisk didn't rebuild after the reboot (never had that issue before!!) . I've now wrote a script to check all that on reboot and rebuild the thing automatically so it *shouldn't* happen again!!
Thanks for playing Ubuntu servers!
Thanks for playing Ubuntu servers!
Re: Server updates
Had to do some tweaks to the firewall and reporting scripts today as I notice there was some slight " bugs".. and other tweaks which needed to be done for some other attacks i've just spotted.
We just been hit with over 15,000 different IP addresses all at once! Thankfully the server basically laughed at it and carried on...
I will continue to monitor the situation...
We just been hit with over 15,000 different IP addresses all at once! Thankfully the server basically laughed at it and carried on...
I will continue to monitor the situation...
Re: Server updates
I've noticed some IPs are not being reported to abuseipdb https://www.abuseipdb.com/user/170367
It seems you can't report the same IP more than once per 15mins otherwise you get a error back . Problem is, some rules "overlap". Like there could be several things wrong with the request, so it triggers several jails, then it gets reported several times. Which then basically gives you a 15min "ban" from IP reporting.
I actually queue IPs before reporting them to remove the duplicates, but I now realise that the reporting script can trigger multiple times because its asynchronous operation .
So I have split up the two functions into separate scripts. One script now takes care of all the processing IP address wise, and stores them in a file. Then a second script will periodically run and work through the list one by one and removing IPs has they get reported.
Because the script has been modified (basically not yet finished, and been "down" overnight) I now have a backlog of 32,000+ IPs to report
It seems you can't report the same IP more than once per 15mins otherwise you get a error back
. Problem is, some rules "overlap". Like there could be several things wrong with the request, so it triggers several jails, then it gets reported several times. Which then basically gives you a 15min "ban" from IP reporting. I actually queue IPs before reporting them to remove the duplicates, but I now realise that the reporting script can trigger multiple times because its asynchronous operation .
So I have split up the two functions into separate scripts. One script now takes care of all the processing IP address wise, and stores them in a file. Then a second script will periodically run and work through the list one by one and removing IPs has they get reported.
- Capture.PNG (92.07 KiB) Viewed 39 times
Because the script has been modified (basically not yet finished, and been "down" overnight) I now have a backlog of 32,000+ IPs to report