RPGWatch Updates, Bug reports and Feature requests

No, it's this little "Your Notifications" thing under the "Log Out" button on the upper right side of the forum. Currently I have 9 notifications, all being post quotes".

Oh, probably not much can be done without that expensive plugin, then.

Originally Posted by Alrik Fassbauer
No, it's this little "Your Notifications" thing under the "Log Out" button on the upper right side of the forum. Currently I have 9 notifications, all being post quotes".

I just clink the notification button then it goes away.

Though I agree its bothersome sometimes.

Stop me if this is already known. The first reply after a news post is back to saying it was done by the OP in the headlines.

I don’t think it was ever gone.

It's been the tradition since i can remember.

Originally Posted by Myrthos
I don’t think it was ever gone.

You fixed it once when you added the notification system - or you had to back out the fix for reason because of it.

Originally Posted by Ripper
It's been the tradition since i can remember.

Once again from 7-11:00 am ET the site keeps going out every 5-10 minutes.

Yeah, someone is bothering us.

I already guessed so.

Gotta be supremely bored with your life to ddos a video game site.

If you find the criminals, please string them up by their balls.

We ran quickly out of available resources after a restart. CPU load is still extremely high at the moment, but fiddling with some settings improves the behavior and the site is at least loading for a longer time than before.

Hurray!

Trouble is, any sad sack with time on their hands can organise a DDOS. Not much a small site can do without an expensive infrastructure.

I was trying to load the site to post some news but it is better now. Glad the problem wasn't on my end as I've had computer problems the last couple weeks.

Originally Posted by Myrthos
Yeah, someone is bothering us.

What's the deal? Think they are targeting something (like trying to find something that can mine bitcoin for them). Are you getting hit from multiple IP's?

I am not a star in analyzing log files, but I had the impression that the amount of attacks we had should not cause the site to stop functioning. It wasn’t a generic server issue as it had enough resources to work with and I could just log in as root. The only thing that happened was that 4 of the 8 threads we can run in parallel were at 100% causing PHP-FPM to stop functioning. I changed the configuration parameters and found a set that allowed the site to keep functioning even with all 8 threads at 100% and blocked some Lithuanian IPs in the process. That actually took more time than I thought as the way the documentation says it loads the various configuration files is not how it is implemented apparently. What was left at that moment was a brute force attack for a mysql injection from a single IP, which I blocked.

As to why, I see regular attacks for mail accounts, so our mail server could be used for sending out spam mails. I see about 100 tries a day to get direct access to the server and every now and then someone is doing brute force attacks to detect a mysql injection, which can also used to get access to the server. Up to now all without any success fortunately.

As far as the time it took to solve this, well I have a full-time job, so I could only work on it when I got home

I wonder if it might be worth putting the mail server on a separate, very cheap VPS (you can find very basic ones for a couple of bucks a month.) I assume it's mainly for sending out notifications, so an extremely barebones setup should be good enough. I wouldn't ideally have SMTP running on the same box as a webserver.