Server updates

[alexh]

I was able to use my mobile phone to leave a msg here.

[exxos]

I was able to use my mobile phone to leave a msg here.

Ah yes. Most have a different device. Or can vpn in etc. So it shouldn't really be a problem.

Got several more unban requests. All coming from the same IP. Requesting huge ranges be unbanned.. So clearly not even a typical user. They just miffed they got locked out. Don't know why they even bother. There's nothing valuable really for them to get even. Maybe peoples email addresses. But not worth the effort. We are not a big forum even.

[exxos]

The new page restrictions have now been programmed up !

Users can still check publicly if their IP addresses banned. But they need to be logged in to request a unban. It has to be done by a different IP address or "phone a friend" to do it for you.

Frankly I got sick and tired of the daily threats from people demanding they be unbanned ! Of course they are all spammers,hackers etc, in general trying to request millions of IP's be unbanned, which is ridiculous to start with. None of them can fill in the information box properly either, which makes me 100% not motivated to look into the requests. Make threats towards myself and unreasonable demands and you will remain banned plain and simple !

It's even more ridiculous that people demand, and threaten, to be unbanned. I mean I did not realise retro users was so addicted to this forum that they to have to go to such extremes ! but really, I'm offering a free service hosting this platform, nobody really has a right to access this forum or any of the websites linked will run by myself on the same server. The level of entitlement of people these days is just beyond delusional. If I wanted to only give access to the forum to 5 users, then I have that right to do so. Not saying I will ever do that, but I do not have to give access to services to anyone whatsoever!

Most of these requests are coming from the Brazil area, which has been a constant botnet farm for like the past year now. I cannot do anything about entire infected countries ! Not my problem sorry !

If people want uninterrupted access, then they will have to register on the forum and login at least once a week which will greatly reduce the chances of you being accidentally banned. But it is no guarantee of course either.

I'm not going to give any more time on "guests" anymore, sorry guest users ! I have way too much on my plate to keep spending time on this problem repeatedly ! Pretty much 99% of legitimate requests from forum users already. Trying to work out who is a legitimate guest or not is practically impossible. Not worth me spending my time trying to figure it all out. My priority is to aid registered users and keep them online from now on.

[exxos]

Not had much time lately, but noticed while "doing my rounds" we survived the largest attack to date a few weeks back!

Capture.PNG (3.77 KiB) Viewed 1027 times

Worth noting that what's shown on the forum stats is only a small percentage of the actual picture. Factor in hits to the wiki, the store, and the main site pages and you're looking at roughly x100 what the forum figures alone suggest.

What makes this particularly remarkable is that last year I was struggling to keep on top of 10,000 forum hits during attacks, and we're now absorbing 60,000 forum hits alone at peak. The custom rules and scripts that have been built up over the past couple of years are doing exactly what they were designed to do — silently and without anyone noticing.

One of the trickier aspects is the botnet behaviour itself. Individual IPs often only hit the server once every 24 hours — which looks completely harmless in isolation and won't trigger standard tools like fail2ban, which look for repeated hits from single IPs. But when you have thousands of IPs all doing that one hit every 24 hours simultaneously, the cumulative volume is enormous and the effect on a small server is the same as a conventional flood. Detecting and blocking that pattern required custom solutions that standard blocklists and off-the-shelf tools simply don't cover.

As always, attack types will shift over time and it does get harder to stay ahead of as things evolve. But for now the server is holding up well and I wanted to make sure that got acknowledged somewhere.

Server updates were also done a couple days ago, so everything there is up to date.

[kohli79]

Not had much time lately, but noticed while "doing my rounds" we survived the largest attack to date a few weeks back!


Capture.PNG


Worth noting that what's shown on the forum stats is only a small percentage of the actual picture. Factor in hits to the wiki, the store, and the main site pages and you're looking at roughly x100 what the forum figures alone suggest.

What makes this particularly remarkable is that last year I was struggling to keep on top of 10,000 forum hits during attacks, and we're now absorbing 60,000 forum hits alone at peak. The custom rules and scripts that have been built up over the past couple of years are doing exactly what they were designed to do — silently and without anyone noticing.

One of the trickier aspects is the botnet behaviour itself. Individual IPs often only hit the server once every 24 hours — which looks completely harmless in isolation and won't trigger standard tools like fail2ban, which look for repeated hits from single IPs. But when you have thousands of IPs all doing that one hit every 24 hours simultaneously, the cumulative volume is enormous and the effect on a small server is the same as a conventional flood. Detecting and blocking that pattern required custom solutions that standard blocklists and off-the-shelf tools simply don't cover.

As always, attack types will shift over time and it does get harder to stay ahead of as things evolve. But for now the server is holding up well and I wanted to make sure that got acknowledged somewhere.

Server updates were also done a couple days ago, so everything there is up to date.

The number of views is crazy!

Thanks for all your hard work!

[exxos]

I've had to update some server stuff, the usual security BS.

If anything seems broken from now.. let me know.. I won't be able to look at it until tomorrow night at the earliest though..

[exxos]

Just updated PHP to a later version. Possible and likely issues are forum extensions might not yet support later php versions.. if anything now looks broken then let me know..

Also been cleaning up some server RAM by stuff I don't actually need / use anymore.

[exxos]

Server may go offline at some point, maybe for a hour while some disk backups are done. So if people cannot access the forum (timing out) it will come back up by itself once the backup is done. possible it may not go offline at all, but just warning people in case it does..

[exxos]

The clone is done and the operating system is being updated on the clone server to make sure there is no nasty surprises.. We are having to jump up versions a fair bit so it has to be done in stages.

Depending on how well it goes, the server operating system will be updated at some point "soon".

The forum will be disabled to stop posts during the move as well as other services. Things which do come up what may well be broken or cause errors, I will work through them one at a time as they appear.

So this is a forewarning that if things suddenly go down or look broken, it's because the server is being updated..

I will post a announcement when I start doing this work "live", so people know what to expect and when.

[rubber_jonnie]

The clone is done and the operating system is being updated on the clone server to make sure there is no nasty surprises.. We are having to jump up versions a fair bit so it has to be done in stages.

Depending on how well it goes, the server operating system will be updated at some point "soon".

The forum will be disabled to stop posts during the move as well as other services. Things which do come up what may well be broken or cause errors, I will work through them one at a time as they appear.

So this is a forewarning that if things suddenly go down or look broken, it's because the server is being updated..

I will post a announcement when I start doing this work "live", so people know what to expect and when.

Good luck!