Forum broken!

[Richard Russell]

I'm very sorry to say that this forum seem to be broken (all attempts to post or reply result in a 403 or 405 response) and I don't know how to fix it.

[Phil_Thatcham]

Working for me, if you can read this.

pt

[RNBW]

Working for me.

[Richard Russell]

Working for me.

It seems to have recovered to some degree, but the hosting provider suspects a DDoS attack. Unfortunately enabling CDN seems to make things worse, possibly because it's interfering with the working of phpBB.

[Richard Russell]

Here's the proof that the forum is actively under attack.

attack.png

[Richard Russell]

It's widespread:

overview.png

[Richard Russell]

It is entirely likely that my hosting provider will suspend the site entirely, because the DDoS attack causes it to exceed the limits in the hosting agreement. This will of course shut down not just the forum but also the Wiki, the server for the in-browser version of BBCSDL (wasm.bbcbasic.net) and all the other BBC BASIC resources hosted there.

There's only a very limited amount I can do in mitigation, because I deliberately relinquished admin access to this forum, and as an ordinary member I can't change any settings (such as blocking guest access); only the forum's owner can do that. The only thing I could do is to delete or disable the forum altogether by removing files.

[jgharston]

Who is the forum owner? Can you PM them? An interim - though unsatisfactory - solution is to require login to view the forum. That's what several forums I use have been forced to do. I reduced the load on the BeebWiki by taking it offline for a couple of days and examining the logs, very quickly having to learn some php admin skills which I hadn't planned on diverting my time to, and blocking URI fetches that match the attacking behaviour.

* I now block everything with 'bot' in the User Agent string, which unfortunately includes Google.
* I noticed near to all spam accesses had more than two ?queries, so I blocked everything with more than two ?queries. Unfortunately, that breaks advanced history searching, so will have to be tweeked a bit.
* I added something called 'Blackhole' which tricks non-humans into accessing a URI that results in their IP address beign blacklisted and access blocked.

[Richard Russell]

Things seem to have improved this morning. The number of 'guests' has diminished greatly since last night, when the forum was mostly inaccessible because of resources being exceeded, but we'll have to see whether that indicates the end of the attack or is just a temporary lull.

I discovered that I could block individual countries at my hosting provider, and since most reports suggest these attacks are coming from China I've experimentally blocked access from there. Apologies to any genuine Chinese forum members there might be!

[Richard Russell]

Who is the forum owner? Can you PM them?

He is aware, yes.

An interim - though unsatisfactory - solution is to require login to view the forum. That's what several forums I use have been forced to do.

As you say, that's not a very satisfactory solution and I'll only suggest it as a last resort.

The particular (cheap) hosting package I am using does not provide a conventional cPanel (or similar) but rather a 'dashboard' with very restricted control. So my options are limited in respect of some of the things you've tried (nor is my understanding of them sufficient).