Cannot access v3.2.2 board Error 403

BeBop · Post by **BeBop** » Sun Jun 23, 2019 12:26 pm

We are two old giffers but long term faithful phpBB board users currently running version 3.2.2 and as of Friday night we cannot access our board, with the following error:

"Forbidden
You don't have permission to access /forum/viewtopic.php on this server.
Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request."

Has anybody else had this experience recently and what should we do, we have contacted support at our hosting provider and got this reply, which doesn't help as it's still the same status:

"Hello,

Thank you for contacting .net Support!

I will be glad to help you out with this issue.I went to 973-eht-namuh-973.com/forum/ and I was able to pull something up. Now, I don't think this is the correct version of the site, but this is what I'm able to see: https://prnt.sc/o5gnim

It is not giving me a 404 error. I have reset the permissions for the forum directory, so you should be able to access it. If still not able to access it, try clearing your browser cache or going incognito. Please let us know if you are still experiencing the issue.

As always, please feel free to let me know if you have any questions or concerns and I will be able to assist."

Any ideas please. Thank you in advance.

Kind Regards BeBop

david63 · Post by **david63** » Sun Jun 23, 2019 1:19 pm

A 403 error is saying that you do not have the correct permissions to access the page.

Now let's get one thing straight - this does not happen on its own out of the blue, somebody somewhere has changed something and most likely that change has taken place on the server. On the basis that you probably don't have access to the server and that it suddenly happened then the most likely culprit would be your hosts.

Unfortunately you will have to go back to them and ask them what they have changed/updated/upgraded - probably better off asking for second level support as first level appear to have no idea what they, ley alone you, are talking about.

EA117 · Post by **EA117** » Sun Jun 23, 2019 3:51 pm

BeBop wrote: ↑Sun Jun 23, 2019 12:26 pm "Forbidden
You don't have permission to access /forum/viewtopic.php on this server.
Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request."
...
I will be glad to help you out with this issue.I went to 973-eht-namuh-973.com/forum/ and I was able to pull something up. Now, I don't think this is the correct version of the site, but this is what I'm able to see: https://prnt.sc/o5gnim

This definitely seems like some bizarre behavior to me. On the one hand, there does definitely seem to be a 403 permissions issue with being able to download any of the supporting .css or .js static files from the web server.

Which is not "a phpBB issue", and would appear to fall squarely within the hosting service's purview. i.e. Whether or not your web browser can retrieve the resource http://www.973-eht-namuh-973.com/forum/ ... family.gif has nothing to to with phpBB configuration or functioning. And at least for me right now, that image URL returns 403 forbidden.

So if nothing else, you could talk to the hosting provider specifically about that -- why am I unable enter http://www.973-eht-namuh-973.com/forum/ ... family.gif into a web browser and view the file on my web site -- without having to even involve any phpBB-related questions. See what if any issues remain after that question is answered.

You could certainly "shoot yourself in the foot" and create an outcome such as this, by editing the .htaccess file incorrectly. So maybe compare your current .htaccess file to any previous backups (and perhaps also the root-level .htaccess for the main site, instead of just for the forum directory) and see if there has been some significant change there.

The site also seems to intend to have a bit of a "puzzle" for entry... this issue isn't happening because of some kind of misfiring "deny them access until they've solved something" mechanism that is unique to this site?

In addition to all of that, it seems like phpBB itself -- meaning phpBB PHP files are being given the chance to execute -- then also decides to return a 403 status, too. Because if I don't have cookies saved for the site, I actually do get the phpBB-generated dynamic HTML page. Same as what your hosting support agent showed in that screen shot they included. The page is still "not formatted well", because the underlying .js and .css static files have all been separately denied with 403 also, due to the earlier condition described.

But access to the index.php was not blocked with 403, and the page did actually return the text/html data expected from phpBB. However, once I've accessed the page and cookies are now saved, attempting to re-access the page apparently causes index.php itself (or more likely, an underlying session mechanism) to return 403 from the PHP code itself. At that point, I get the result that you described you're seeing, which is "no phpBB page content at all", and just a 403 forbidden page.

Clearing the cookies for the site lets me get back to the "one-time" ability to see the content generated by index.php, after which it will return back to 403 forbidden again once cookies are saved.

I don't know what to make of all this yet; I'm just describing all of these observations in case it triggers an idea or is recognized by someone else who has seen it before. Here is a list of test URLs I've been using; again, I can get the phpBB-generated text/html content from these pages "once" if I clear cookies for the site. Afterwards, the same URL will return 403.

http://www.973-eht-namuh-973.com/forum/index.php

http://www.973-eht-namuh-973.com/forum/ ... um.php?f=1

http://www.973-eht-namuh-973.com/forum/ ... 097#p12097

Pilgrim2006 · Post by **Pilgrim2006** » Mon Jun 24, 2019 9:30 am

Oh. I'm reading this topic now after having been searching for hours and posted my own one at viewtopic.php?f=556&t=2515096

This is exactly the same problem I'm experiencing and I agree with splendid post from EA117.

I should add something, I manage two different forums running in two different servers (same provider) and both showed the same issue at the almost the same time (last saturday afternoon). Everything points to a server issue but they claim that no changes have been made.

EA117 · Post by **EA117** » Mon Jun 24, 2019 12:34 pm

EA117 wrote: ↑Sun Jun 23, 2019 3:51 pm So if nothing else, you could talk to the hosting provider specifically about that -- why am I unable enter http://www.973-eht-namuh-973.com/forum/ ... family.gif into a web browser and view the file on my web site -- without having to even involve any phpBB-related questions. See what if any issues remain after that question is answered.

Just made an additional observation: The http://www.973-eht-namuh-973.com/forum/nuclearfamily.gif image link returns an HTTP 403 status unless I clear cookies for the site. Once cookies are cleared, I can download even the image successfully. But once the cookies are re-created by visiting index.php or one of the other pages, now the image URL returns 403.

That is still in line with "the host has changed something", but might be a useful hint if they are still claiming ignorance on what the change was. Its as though the web site is denying HTTP GET requests with 403 "because they have cookies included."

Find in your hosting control panel (or perhaps a file visible through your FTP access to the site) where the web server error log and/or access log is visible, and see what kinds of messages or errors the web server might be recording during these 403 attempts. This is starting to sound like perhaps a mod_security change that was rolled out by the host. And that it's not PHP code returning a 403 in the latter case as suspected earlier, and still the underlying web server returning 403 in that case due to the presence of cookies, same as with the image HTTP GET request.

BeBop · Post by **BeBop** » Mon Jun 24, 2019 1:43 pm

Thank you so much for all your help gentlemen and ladies. We will go back to our hosting company armed with a lot better information. This is no country for old men.

Kind Regards BeBop the slightly younger

Lumpy Burgertushie · Post by **Lumpy Burgertushie** » Mon Jun 24, 2019 2:15 pm

I think you might be surprised at the age of many of us here including some of the staff members.

also, I seems that this problem may be related to a cpanel update for the hosters. there are several people with the same type of problem and at least one of them was solved because the host's cpanel was updated and they had to make an adjustment.

robert

Post by **Mick** » Mon Jun 24, 2019 2:49 pm

There’s a small issue with your cookie settings too, your Cookie domain needs changing to .973-eht-namuh-973.com, note the leading dot. See Fixing incorrect cookie settings.

EA117 · Post by **EA117** » Mon Jun 24, 2019 4:02 pm

The conclusion runewolf came to in viewtopic.php?f=556&t=2515111&p=15278591#p15278591 certainly fits the symptom being observed here. i.e. The hosting service either installed an updated set of mod_security rules -- or installed some other update which also included an updated set of mod_security rules -- and now there was a rule to issue 403 in response to matching a pattern which was occurring in runewolf's phpBB "k" cookie value.

But examining that possibility here against http://www.973-eht-namuh-973.com/forum/ doesn't show the "ModSec number 211290" regex pattern ((?:'\\xbf?\\x22|\\x22\\xbf?'|^\\+?$)) being matched in the ehtnamuhforum_k cookie or any other cookie value. So it might not be "exactly the same issue" as runewolf (meaning not exactly the same mod_security rule matching), but the existence of a new mod_security rule certainly still fits overall.

There did seem to be at least one other report of an updated rule set this weekend causing false positives:
https://forums.comodo.com/free-modsecur ... #msg889418

So still no better suggestions than continuing to talk with hosting support, and looking whether the web server error logs or access logs are giving you any hints as to the reason for the 403 denials when they occur.

@Mick I'm already seeing the leading dot in the cookies even yesterday, when verifying that the www subdomain would be covered after seeing the site forced use of the subdomain. Is it still missing somewhere that I'm not looking yet? Edit: Cancel that, I see I've been looking at cookie domain incorrectly all along. I've been using Chrome's cookie details to confirm "what domain is the cookie for", but apparently Chrome always shows the leading dot. LAN trace confirmed what you said, that the leading dot wasn't there, which made me go look harder at why I was wrong.

Pilgrim2006 · Post by **Pilgrim2006** » Mon Jun 24, 2019 8:54 pm

For your information, I've received a message from hosting provider tech support admitting that the issue is related to "Yes, the ModSecurity rules were recently updated, those resulting in the 403/404 error. " as EA117 suggested

They are working on it at level 2.

NormNM · Post by **NormNM** » Tue Jun 25, 2019 7:27 am

Pilgrim2006 wrote: ↑Mon Jun 24, 2019 8:54 pm For your information, I've received a message from hosting provider tech support admitting that the issue is related to "Yes, the ModSecurity rules were recently updated, those resulting in the 403/404 error. " as EA117 suggested

They are working on it at level 2.

That is good news. As you will be aware there are others with the same problem with a different provider. Please let us know how it goes and hopefully our provider can do the same.

Post by **Mick** » Tue Jun 25, 2019 7:42 am

You’re paying these [server] people, they shouldn’t require input from multiple sources to fix their issues.

NormNM · Post by **NormNM** » Tue Jun 25, 2019 7:51 am

Mick wrote: ↑Tue Jun 25, 2019 7:42 am You’re paying these [server] people, they shouldn’t require input from multiple sources to fix their issues.

Totally agree, I may well be moving. Their first response is often "We have changed nothing", which is usually a lie.

What amazes me is that this fault has led to many customers raising tickets for help but they go through the same story with each one. Surely if you run a system and multiple customers complain with the same complaint then something is wrong and it is their fault. I am due to renew soon, so let's see.

Post by **Mick** » Tue Jun 25, 2019 7:58 am

You’ll probably find that whoever it is you speak to at server support are reading from flash cards or some ‘first line support manual’, they know very little apart from what’s in front of them hence we sometimes suggest asking for level two support. Mod security settings are very easy to change, ten minutes tops I would say, if they know what they’re doing of course

NormNM · Post by **NormNM** » Tue Jun 25, 2019 8:07 am

I use to have a job supplying, changing and supporting software to calculate the cost to repair cars for insurance customers.

We listened to customers if they had a problem. NEVER said nothing had changed, would say maybe it has and I have not been made aware or equivalent. Treat customers with respect. I realise some customers will cause their own problems but they must be listened to etc. I agree about them reading from a script but with multiple complaints I feel they need a different response.