Forum being attacked?

Get help with installation and running phpBB 3.2.x here. Please do not post bug reports, feature requests, or extension related questions here.
Webmasterks
Registered User
Posts: 268
Joined: Tue May 27, 2003 11:28 pm
Location: The Hague, The Netherlands
Contact:

Forum being attacked?

Post by Webmasterks » Wed Nov 06, 2019 3:43 pm

A while now the number of active visitors (guests) is through the roof (well, for my board anyways). My maximum number of visitors at one time was 325 or so, but lately it has been 5 times as many. I didn't think much of it, but today, however, my board and website are loading very slow. Visitors report up to 30 secs for a page to load.

I contacted my webhost and they say my board is being attacked, which influences my website as well. I have another website/domain on the same server, which seems to also be affected (loads very slow).

I'm still a n00b, but if my forum is being attacked, what can I do to counter act it?

User avatar
warmweer
Registered User
Posts: 3055
Joined: Fri Jul 04, 2003 6:34 am
Location: Van Allen Belt ... well actually Belgium

Re: Forum being attacked?

Post by warmweer » Wed Nov 06, 2019 3:49 pm

Webmasterks wrote:
Wed Nov 06, 2019 3:43 pm
...
I'm still a n00b, but if my forum is being attacked, what can I do to counter act it?
This is actually not phpBB - related, but a host situation. There is no way you (or phpBB) can block anyone browsing to you board. If it's truly an attack the the blocking has to be done before the attackers reach the webserver and that's your host's responsibility.
The year is 2192. The British Prime Minister visits Brussels to ask for an extension of the Brexit deadline. No one remembers where this tradition originated, but every year it attracts many tourists from all over the world.

Webmasterks
Registered User
Posts: 268
Joined: Tue May 27, 2003 11:28 pm
Location: The Hague, The Netherlands
Contact:

Re: Forum being attacked?

Post by Webmasterks » Wed Nov 06, 2019 3:54 pm

That's what I thought. My host says my board is being overrun and the number of guests seem to confirm that. They say they don't have any knowledge of phpbb so they can't help me.

What can I do to filter out the bots and/or not-real guests from my board? Or do I have to restrict access to registered users only (which would suck big time)?

User avatar
david63
Registered User
Posts: 16718
Joined: Thu Dec 19, 2002 8:08 am
Location: Lancashire, UK
Name: David Wood
Contact:

Re: Forum being attacked?

Post by david63 » Wed Nov 06, 2019 3:59 pm

Webmasterks wrote:
Wed Nov 06, 2019 3:54 pm
They say they don't have any knowledge of phpbb so they can't help me.
They may not have any experience of phpBB (not that they need to have) but they do (or at least I would hope that they do) have experience of running, setting up and controlling servers.

If they do not have the ability to protect their servers from attacks then it looks as if it might be time to find a new host that knows what they doing.
David
Remember: You only know what you know and - you don't know what you don't know!
My CDB Contributions | How to install an extension
I will not be accepting translations for any of my extensions in Github - please post any translations in the appropriate topic.
No support requests via PM or email as they will be ignored

User avatar
warmweer
Registered User
Posts: 3055
Joined: Fri Jul 04, 2003 6:34 am
Location: Van Allen Belt ... well actually Belgium

Re: Forum being attacked?

Post by warmweer » Wed Nov 06, 2019 4:02 pm

Webmasterks wrote:
Wed Nov 06, 2019 3:54 pm
That's what I thought. My host says my board is being overrun and the number of guests seem to confirm that. They say they don't have any knowledge of phpbb so they can't help me.

What can I do to filter out the bots and/or not-real guests from my board? Or do I have to restrict access to registered users only (which would suck big time)?
Filtering them implies identifying them and storing the data in the database, adding them to a special group which doesn't have access or giving them NO access on an individual basis That would be a very time consuming effort with little (and only temporary) result and is only useful for recognisable bots and humans with a fixed IP (easily circumventable).
The year is 2192. The British Prime Minister visits Brussels to ask for an extension of the Brexit deadline. No one remembers where this tradition originated, but every year it attracts many tourists from all over the world.

Webmasterks
Registered User
Posts: 268
Joined: Tue May 27, 2003 11:28 pm
Location: The Hague, The Netherlands
Contact:

Re: Forum being attacked?

Post by Webmasterks » Wed Nov 06, 2019 4:18 pm

So what does one usually do to get rid of unwanted guests/visitors or in the case of a DDOS-attack?

User avatar
warmweer
Registered User
Posts: 3055
Joined: Fri Jul 04, 2003 6:34 am
Location: Van Allen Belt ... well actually Belgium

Re: Forum being attacked?

Post by warmweer » Wed Nov 06, 2019 4:22 pm

Webmasterks wrote:
Wed Nov 06, 2019 4:18 pm
So what does one usually do to get rid of unwanted guests/visitors or in the case of a DDOS-attack?
Wait for the host to come up with a solution?
Again, the problem is not your board being attacked, but the server.

Added:
read this topic: viewtopic.php?t=2476486
The year is 2192. The British Prime Minister visits Brussels to ask for an extension of the Brexit deadline. No one remembers where this tradition originated, but every year it attracts many tourists from all over the world.

Webmasterks
Registered User
Posts: 268
Joined: Tue May 27, 2003 11:28 pm
Location: The Hague, The Netherlands
Contact:

Re: Forum being attacked?

Post by Webmasterks » Wed Nov 06, 2019 4:27 pm

In the ACP there is a page with Security settings. Is there anything I can change there to minimize malicious guests?

I have the ReCaptcha active, the I am Not A Robot, but is that still adequate or do I need to use another one?

User avatar
Lumpy Burgertushie
Registered User
Posts: 66858
Joined: Mon May 02, 2005 3:11 am
Contact:

Re: Forum being attacked?

Post by Lumpy Burgertushie » Wed Nov 06, 2019 4:38 pm

you are missing the point. this has nothing to do with phpbb/your board, it may be because the bots are trying to access your board but it is not a problem with your board. your host can stop this at their level but you can NOT stop it from your board.


robert
I'm baaaaaccckkkk. still doing work on donation basis. PM your needs.

Premium phpBB 3.2 Styles by PlanetStyles.net

If a tree falls in the forest and nobody is there, does it make a sound?

User avatar
warmweer
Registered User
Posts: 3055
Joined: Fri Jul 04, 2003 6:34 am
Location: Van Allen Belt ... well actually Belgium

Re: Forum being attacked?

Post by warmweer » Wed Nov 06, 2019 4:39 pm

Webmasterks wrote:
Wed Nov 06, 2019 4:27 pm
In the ACP there is a page with Security settings. Is there anything I can change there to minimize malicious guests?
Anything you do there is at your Board level - the server will still be bombarded.
Webmasterks wrote:
Wed Nov 06, 2019 4:27 pm
I have the ReCaptcha active, the I am Not A Robot, but is that still adequate or do I need to use another one?
That's to mimimise bot/spam registrations, and guess what? They're still harassing the server.
BTW the standard Captcha's have been broken aeons ago (probably even before internet existed ;) ). Using a good Q&A should hold back most bots.
As to spam, use the NRU group to filter them out on their first posts.
The year is 2192. The British Prime Minister visits Brussels to ask for an extension of the Brexit deadline. No one remembers where this tradition originated, but every year it attracts many tourists from all over the world.

Webmasterks
Registered User
Posts: 268
Joined: Tue May 27, 2003 11:28 pm
Location: The Hague, The Netherlands
Contact:

Re: Forum being attacked?

Post by Webmasterks » Wed Nov 06, 2019 4:45 pm

I concur that the weakness lies at servel level and I have a feeling it has to do with the SSL or TLS. I have a VPS server at my host and on it are a handful of domains/websites and only those with SSL have problems. The other websites without SSL still run without a hitch.

The other day I got a message from my host, saying that they will change my IP-address. Could it have to do with that?

User avatar
Mick
Support Team Member
Support Team Member
Posts: 21681
Joined: Fri Aug 29, 2008 9:49 am
Location: Cardiff

Re: Forum being attacked?

Post by Mick » Wed Nov 06, 2019 4:47 pm

If your board anti-spam techniques weren’t working you would have hundreds of new unwanted members. Try speaking to your hosts level two support, you may get more help there.
"The more connected we get the more alone we become" - Kyle Broflovski

Webmasterks
Registered User
Posts: 268
Joined: Tue May 27, 2003 11:28 pm
Location: The Hague, The Netherlands
Contact:

Re: Forum being attacked?

Post by Webmasterks » Wed Nov 06, 2019 5:00 pm

What I do see in the lists of guests that are currently 'online' is that the majority of IP-addresses originate from China. Since my website is 100% in Dutch, I'd have no problem blocking China in its entirety, but is that even possible?

User avatar
Mick
Support Team Member
Support Team Member
Posts: 21681
Joined: Fri Aug 29, 2008 9:49 am
Location: Cardiff

Re: Forum being attacked?

Post by Mick » Wed Nov 06, 2019 5:08 pm

Yes but your host needs to get to grips with it, they’re still hitting the server.
"The more connected we get the more alone we become" - Kyle Broflovski

User avatar
warmweer
Registered User
Posts: 3055
Joined: Fri Jul 04, 2003 6:34 am
Location: Van Allen Belt ... well actually Belgium

Re: Forum being attacked?

Post by warmweer » Wed Nov 06, 2019 5:13 pm

Mick wrote:
Wed Nov 06, 2019 5:08 pm
Yes but your host needs to get to grips with it, they’re still hitting the server.
warmweer wrote:
Wed Nov 06, 2019 4:39 pm
Anything you do there is at your Board level - the server will still be bombarded.
This means you'll stop them registering, perhaps viewing anything (basically they'll be banned). But your board will still suffer because the webserver is under attack, and you're using more resources when phpBB has to check the IPs for blacklisting.
The year is 2192. The British Prime Minister visits Brussels to ask for an extension of the Brexit deadline. No one remembers where this tradition originated, but every year it attracts many tourists from all over the world.

Post Reply

Return to “[3.2.x] Support Forum”