The dreaded "exceeded the maximum allowed number of login attempts"

[shortmort37]

I recently moved my board from an unmanaged VPS to a managed VPS, and I'm seeing quirky behavior. But first, here's what I did:

I used WinSCP to copy my 3.3.5 site backup to the new site; and I used phpMyAdmin to import a database backup. Then, I followed the instructions for a fresh install of phpBB - I deleted /vendor and /cache from my site, /images, /store, /files and config.php from my 3.3.5 phpBB snapshot, and copied up to the site. I cleaned up the /store folder, ran install (successfully), and deleted the install directory.

I can't log in on the first attempt; I always get that I've exceeded the maximum allowed number of login attempts, and I have to answer my CAPTCHA question. This, even though phpbb_users.user_login_attempts = 0 for my account.

There's other bizarre behavior too; while tooling around in topics, I will suddenly find the account logged out. Test posts don't appear initially; when they do, the don't disappear on deletion; when I attempt to redelete, I'm told "the requested post does not exist". On a couple of occasions, I've been in the ACP, only to find some action kicks me back to the board - and then, "You do not have the necessary permissions to complete this operation".

I've changed the cookie, purged the cache, and cleared my browser cache; still no love. I installed Firefox (I normally use Chrome) and the same issue presents.

My next step is to clear everything out (except for /files, which is huge) and start over. But I'd be happy to hear other suggestions.

Thanks
Dan

P.S. For what it's worth, my unmanaged server ran Apache; my new managed server runs nginx.

[Mick]

Maybe something to do with https://github.com/phpbb/area51-phpbb3/ ... ample.conf

[shortmort37]

Thanks, Mick - I'll run this up the flagpole with my hosting provider.

Dan

[shortmort37]

Well, as a test we disabled NGINX caching (it wasn’t used on my other server); still no love. I’m still warned I’ve exceeded maximum attempts. There are other bizarre manifestations, but I hope that finding the cause for this issue will remediate the others.

Any other ideas about what I should be trying?

[shortmort37]

In the "grasping at straws" department, I did a Softaculous install of phpBB (3.3.8, as it turns out) under a separate domain name I own on the same server with my production installation. Logins work just fine; no maximum attempts exceeded. I don't think NGINX is implicated - certainly, it's disabled. So I'm at a loss as to what's different between my old server and my new.

In the absence of any other suggestion, I'm going to start from scratch - disable my extensions, delete everything from the phpBB root except the things that pertain to my board (/files, /store, /images, /ext and config.php) and do a fresh copy of 3.3.5; then drop my database, reimport, and reinstall phpBB. Then delete /install and play around with logins. If there's anything in that laundry list I've missed, please let me know.

Thanks
Dan

[janus_zonstraal]

Did you try to login from a other browser or in private mode, maybe it is a cookie thing?

[shortmort37]

Yeah, I *installed* another browser (Firefox) only to see the same thing. And, same outcome in private mode.

[janus_zonstraal]

A link to your board can also be helpful.

[shortmort37]

Sure! But I likely will be pulling the rug out from under folks sometime today…

www.59plymouth.net/59forum

[warmweer]

You've set your cookie_secure to False.

ACP > General > Server configuration > Server URL settings
Force server URL settings:

set it to True, and enter https:// in server protocol then delete cookies from your browser, and browser cache (just to restart as clean as possible) delete /installer and /production from /cache and then try logging in again.

[shortmort37]

You've set your cookie_secure to False.
Add you certificate value, set it to True, then delete cookies from your browser, delete /installer and /production from /cache and then try logging in again.

Yes, that was one of many desperate attempts. I’ll set it back.

Where do I add my certificate value? I don’t recall doing this where my board was formerly hosted.

[warmweer]

Where do I add my certificate value? I don’t recall doing this where my board was formerly hosted.

My mistake: I was confused, disregard that, I've edited my previous post.

added: I've edited my previous post again (4th time, damn it: why can't I get it right the first time )

[shortmort37]

You've set your cookie_secure to False.

OK, set back.

ACP > General > Server configuration > Server URL settings
Force server URL settings:

set it to True, and enter https:// in server protocol

Yup, those were already set that way.

then delete cookies from your browser, and browser cache (just to restart as clean as possible) delete /installer and /production from /cache and then try logging in again.

Did that - still no love.

I'm out of pocket for a few hours, but if there are further suggestions, I'll try them when I get back. Thanks to all.

Dan

[warmweer]

set it to True, and enter https:// in server protocol

Yup, those were already set that way.

Strange, as I could access your board using http:// (it didn't force https://) (it does now).

[shortmort37]

Strange, as I could access your board using http:// (it didn't force https://) (it does now).

Everything about the behavior of my board is strange now, although the “exceeded attempts” is the most consistent and obvious strange thing. But those are the settings on my old board, and they persisted on the import.