095 RC2 Too many forward attempts issue

What version are you running now piwaille... did you upgrade to the public RC 3 which should have fixed this (or at least brought up a couple of warnings in the manager)?

Quote from: OpenGeek at Nov 30, 2006, 09:27 AM

All i can think of is that’s when the hackers come out to play and maybe they are hitting URLs within your site that are triggering Unauthorized responses?

are they polite enough for comming only early in the morning ?
Am I the only one noticing that appens only in the morning (not every morning but quite every time around 7AM - 8AM) ?

I’m not technician enought... but I allready copyed the log here (some posts earlier)... nothing seemed (for me) unusual.

Quote from: OpenGeek at Nov 30, 2006, 09:27 AM

Otherwise, perhaps there is another bad url, maybe within your SMF theme or something, that is getting called a lot and triggering this. But again, if you have no permissions restricting access to those pages, and they are configured properly, there should not be an error from this.

due to the activity of my forum it should appen quite continuously, not once every two days and regularly around 7AM - 8AM.

My SMF theme is the default one ... only modified by SMF’s mod... I agree : there should not be an error from this.

I really can’t understand where it comes from ... but it is ! I do regularly have pages of errors.

MODx doesn’t have any CRON-like jobs that run, so it has to be either a bot doing something nefarious or something your host is doing. It’s odd indeed! How about that version # you’re running?

My logs show I’m getting hit pretty regularly with these attempts, and fixing my 403 page assignment hasn’t helped.
I still get loaded up with these error logs.

Quote from: sottwell at Nov 30, 2006, 11:27 AM

My logs show I’m getting hit pretty regularly with these attempts, and fixing my 403 page assignment hasn’t helped.
I still get loaded up with these error logs.

What do you mean? 403? 401 = Unauthorized and 404 = not found. Both of those must be valid pages. If they are, no errors should be occurring whatsoever.

Ok, I was getting "forbidden" mixed up with "unauthorized". Anyway, I have them both set to a perfectly valid document.

http://www.loripsum.co.uk/doesnotexist.html

And deliberately trying all kinds of weird things doesn’t bother the even log at all. So this is coming from something else altogether. I’m going to stay up tonight and try to catch it as it’s happening.

Quote from: rthrash at Nov 30, 2006, 09:39 AM

What version are you running now piwaille... did you upgrade to the public RC 3 which should have fixed this (or at least brought up a couple of warnings in the manager)?

I’ve just upgraded yesterday evenning ...
This morning I’ve got 68 pages of "Too many forward attempts"

Of course I did not received any warning while saving my configuration at first loging into the manager.

PS1 : maybe not the same issue as it appened yesterday evenning = at 7:07 PM ... I empty the log right now and will see what appens during this week

PS2 : you could rename the tittle of subject from "095 RC2" -> "095 RC2 an RC3"

Please upgrade to 0.9.5 final (released today)

http://modxcms.com/downloads.html

Quote from: OpenGeek at Nov 30, 2006, 09:27 AM

OVH?

OVH is the number one hosting service in France.
http://www.ovh.com/fr/index.xml

If it’s a shared hosting, piwaille, you’d have to check that the specific mod_rewrite module @OVH (aka mod_ort) is not causing any problems there...

Ok, I caught some. They all appear to be from spiders, all but one is a Yahoo! spider:

[Tue Dec 05 04:35:58 2006] [error] [client 74.6.68.172] Premature end of script headers: index.php
loripsum.co.uk 74.6.68.172 - - [05/Dec/2006:04:35:57 +0000] "GET /templates.html?template=AqueousLghtX HTTP/1.0" 500 629 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"

[Tue Dec 05 00:33:33 2006] [error] [client 87.202.79.35] Premature end of script headers: index.php, referer: http://www.modxcms.com/Animetor-Template-942.html
loripsum.co.uk 87.202.79.35 - - [05/Dec/2006:00:33:23 +0000] "GET / HTTP/1.1" 500 629 "http://www.modxcms.com/Animetor-Template-942.html" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0"

[Mon Dec 04 12:15:04 2006] [error] [client 74.6.66.29] Premature end of script headers: index.php
loripsum.co.uk 74.6.66.29 - - [04/Dec/2006:12:15:03 +0000] "GET /templates.html?template=Loripsum HTTP/1.0" 500 629 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"

[Sun Dec 03 10:57:49 2006] [error] [client 74.6.67.232] Premature end of script headers: index.php
loripsum.co.uk 74.6.67.232 - - [03/Dec/2006:10:57:46 +0000] "GET /templates.html?template=Animetor HTTP/1.0" 500 629 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"

The times correspond exactly with the MODx event log entries.

The second entry spent four or five minutes going through the whole site, so I presume it was some kind of a spider as well.