[Solved] Maximum number of Login attempts exceeded

[thomasjk]

I've now received this message twice this morning and each time I am presented with a Captcha. Is this something new is is there something wrong with the login process?

[FJCC]

I just got the same message. The forum got software changes very recently and I expect something is set wrong. I also tried logging into the es forum and I didn't get that message. I'll post a message on the dev mailing list.

[RoryOF]

I use persistent log-in and have had no problem (yet!).

[rudolfo]

I did receive the same message right now. It was irritating, because I was quite sure that I typed in the correct login data.
But the captcha login and also the pages after the login are using now the secure protocol https. Haven't check it further so far if the plain http pages are still accessable.

[RGB]

I did receive the same message right now. It was irritating, because I was quite sure that I typed in the correct login data.
But the captcha login and also the pages after the login are using now the secure protocol https. Haven't check it further so far if the plain http pages are still accessable.

They are not. Look at my previous thread on this subforum: https is now enforced.

I remember something like this happened a couple of years ago. At the time the conclusion was that there was a "brute force attack" trying to gain access to admin and moderator accounts. As far as I can tell, the problem is only present on the EN forums, which makes the attack theory more plausible.

[Hagar Delest]

I use persistent log-in and have had no problem (yet!).

+1.

I remember something like this happened a couple of years ago. At the time the conclusion was that there was a "brute force attack" trying to gain access to admin and moderator accounts. As far as I can tell, the problem is only present on the EN forums, which makes the attack theory more plausible.

+1 (cannot check on other forums).

[RoryOF]

There is nevertheless something peculiar happening. We are currently showing 10-12 users; the older forum is at 110 and LibO at 35. Normally we would have 50% more than the older forum and about four times the number on the LibO forum (all figures and estimates very much ball-park).

[thomasjk]

What is persistent login? I logout so I can clear the posts I have marked read. I don't want to see them again. Definitely something peculiar happening.

[Hagar Delest]

I never logout and the login is set to automatic. It doesn't prevent the read topics to be tagged as viewed. So I only see the new posts (in red).

We used to be indeed at less than 100 during the weekend but less than 15 is definitively strange...

[acknak]

I've seen the captcha today as well--each time I've logged in.

[Hagar Delest]

I just saw it when logging in the admin panel!

[thomasjk]

Time for a fix for this issue. Its just started today for me and Ive seen it every login.

[acknak]

I just logged out and immediately tried to login again and I got the "too many login attempts" captcha.

If the problem is a password guessing attack, it must be making a fairly high rate of attempts. Maybe just a config problem?

[RGB]

I just logged out and immediately tried to login again and I got the "too many login attempts" captcha.

Same here.

If the problem is a password guessing attack, it must be making a fairly high rate of attempts. Maybe just a config problem?

There is nothing wrong on the ACP...

[/a3]

I found this thread on phpBB.com that might be useful:
https://www.phpbb.com/community/viewtop ... &t=2176870

[acknak]

I found this thread on phpBB.com that might be useful: ...

Yep. That's it.

I checked the logs: every login after (about) 02 Nov 2013 16:36 is logged as coming from the same IP address.

I've no idea how to fix the problem though; I didn't see any solution mentioned in the linked topic, just a possible cause.

[RoryOF]

In the linked topic Noxwizard says

Re: Maximum allowed number of login attempts

Postby Noxwizard » Mon Mar 25, 2013 9:10 am
If it's happening for all users, you should check to see if everyone has the same IP (check Who Is Online). If they do, then your host is most likely proxying the requests before sending them to you and not correctly restoring the IP.

which seems to offer a solution, although I don't understand it (I have no knowledge of phpBB).

[RoryOF]

I am wondering if the reduced number shown as logged in is because we are now getting a count of the actual number at time of query, rather than a total for the past five minutes, as previously.

[Villeroy]

I am wondering if the reduced number shown as logged in is because we are now getting a count of the actual number at time of query, rather than a total for the past five minutes, as previously.

All the bots out there are out because of the captcha.

[RGB]

OK, it seems I fixed it. At least for the moment... The problem was that the forum is passing through a proxy now, so every user shows the same ip, and that the maximum number of connections from the same ip was well below the usual number of users. Let's see if it works.

[Villeroy]

Well done. Thank you very much.

[acknak]

No captcha for me logging in this morning--thanks!

[Mark Nelson]

I just got the CAPTCHA. Also I am getting the following Certificate Error:
The security certificate presented by this website
was issued for a different website's address.

[acknak]

Now the captcha is back for me as well ...

[RoryOF]

No Captcha for me (persistent login), but Forum definitely slower (fr Forum also report this on dev list).

[Daiwe01]

To Site Admin: Use the header IP in phpBB code
Parse the value[s] of X-Forwarded-For. The first value is the IP of the originating client. Any subsequent values are proxies used before the current proxy.

you should use the ip in the header and not tcpip level. traffic goes
through a proxy. Same thing will happen if we use the trafficserver to
cache pages.

rgds
jan i

[thomasjk]

Captcha i still there for me. The site is very slow right now.

[Villeroy]

Captchas are back in town and the town is crawling. Why do we need a proxy?

[RGB]

Sorry for the delay, it was impossible for me to be on line for several hours. It should be OK now. Let's see how this evolve.

[Hagar Delest]

Well, still crawling...