Is makehuman community site object of attac?

[grinsegold]

This is how makehuman promted after i filled in username and correct password and pressed enter (without my name. That i wrote afterwards). Should i be concerned? That's not the first time i see that.

[joepal]

No, this is phpbb playing up. I am not certain why it does this now and then, but I suspect it is because it is behind a reverse proxy and thus perceives all login attempts as coming from the same IP adress.

I've never been able to see anything looking a DoS or brute force attack when looking at the logs anyway.

[loki1950]

Happens to me at least once a week grinsegold just mildly annoying at this point though I have complained to joel a few times

Enjoy the Choice

[Elvaerwyn]

I have this issue constantly :S

[grinsegold]

Thanks. I can sleep better now

[nomorecookies]

indeed, this happens every single time i try to login. also, the password field says it is not secure when creating an account

[loki1950]

The not secure is because we do not use https.

Enjoy the Choice

[RobBaer]

hmm... @Joel isn't it fairly straight forward to enable https:// authentication without disabling http:// or is this something about our current hosting service? It's been a while, but I am pretty certain this is possible on Windows IIS, not sure about apache and other servers.

[joepal]

The problem isn't enabling https per se. The problem is that we get a routing loop vs the (very old version of) mediawiki backend if enabling https on the outward facing web server while still having http on the inside of the forwarding proxy. When I last looked at it, I was not able to make that particular version of mediawiki behave in an acceptable manner.

In essence, the actual problem is that we have a stone age old and largely unmaintainable mix of different web services that have been modified on a source code level and which therefore cannot be easily upgraded to a modern version.

I have started looking into replacing the entire infrastructure with something coherent, but this requires a lot of work.

[MTKnife]

No, this is phpbb playing up. I am not certain why it does this now and then, but I suspect it is because it is behind a reverse proxy and thus perceives all login attempts as coming from the same IP adress.

I've never been able to see anything looking a DoS or brute force attack when looking at the logs anyway.

The reverse proxy should be able to pass the actual IP through easily enough, though the site has to be coded to read that variable. Unfortunately, I've only done this in Python with NGINX and Flask, and it sounds like you're dealing with something much more complicated.


Scott