Forum maintenance: Nov 2020

[Martin Blank]

As some of you may have noticed, the forum had some downtime tonight. Here's all the fun that happened:

• ISP moved us to a new set of IP addresses. Or, rather, one address out of five I'm supposed to get. The remaining four came in late, so expect some more downtime as I get the new addresses integrated.
• Ran some server updates. Doesn't seem to have broken anything, but always keeping watch.
• Noticed in some logs that HTTP/2 wasn't enabled in Apache2 because the prefork module (required for basic PHP functionality) breaks the http2 module. Changed that to PHP-FPM and now it works. PHP may also work faster, and possibly more securely by breaking some functionality out to a separate userspace.
• I broke HTTPS by utterly failing to update the IP address in the site's .conf file. That took me 20 minutes to figure out even while staring at the .conf file itself because why look at the only part that would affect anything?
• Took the time to upgrade to phpBB 3.3.2. This was a fantastic idea until I ran into a database error, "Row size too large. The maximum row size for the used table type, not counting BLOBs, is 8126." The profile fields data table had some rows that were too large (I guess?), so despite trying to delete the Google Plus column (which would reduce the row size), it just failed with this message. But there's a solution! What's that? It involves modifying the table's basic format? What a totally not terrifying idea! Let's read lots more and try to find some examples that don't regurgitate a developer writing for developers, utterly fail, and then give it a try, wondering if watching the sunrise is in my near future! (It worked, BTW.)
• Altered the TLS settings for HTTPS for the entire server to restrict it to very modern ciphers, stripping out CBC and going with only GCM or POLY1305. Shouldn't affect anyone using vaguely modern software, but it does mean that Android prior to 4.4.2 (KitKat), Internet Explorer prior to 11, Java JRE/SDK prior to 8, and Safari prior to 9 will not work.

So, yeah. Things should work at least as well as they did, but with some interruptions over the next day or so as I get the IP address situation worked out. They might even be a little faster courtesy of the PHP-FPM installation and/or HTTP/2 actually working.

[Deacon]

• ISP moved us to a new set of IP addresses. Or, rather, one address out of five I'm supposed to get. The remaining four came in late, so expect some more downtime as I get the new addresses integrated.

You know, for whatever reason, I still can’t get to the site while mobile, only on WiFi. AT&T. I really don’t know why.

[Martin Blank]

Might be IPv6-related. I'll look into it.

[Deacon]

It works now! Both in general and even on mobile data. Well done!

[Seannery]

I've been unable to connect to the forum server the past couple days---at all. I've also noticed sometimes, I'd connect, but then loading browsing to another page, I'd get an bland page saying ``unauthorized''---then I'd reload the page, and it'd be fine. Sometimes, I'd connect fine, but the stylesheet wouldn't, or partially, load---sometimes, reloading didn't help, or made it worse. Perhaps notable: I'm using TOR to connect---some servers tend to have unnecessary problems with TOR, such as responding with `unauthorized' errors.

[Martin Blank]

Tor shouldn't present a problem for connectivity itself. What you can run into is IP address matching. Sessions have to match both the cookie (like session management on most sites) and I think the first two octets of an IPv4 address. If your tunnel shifts or restarts while you're in an area that requires special permissions, you can get that "Unauthorized" response.

The server has issues related to iproute2 in handling large numbers of IP addresses, especially IPv6. I've been trying to find a solution for years, but nothing seems to hold past a reboot, and sometimes not even manual configs. In the US, the mobile networks often prefer IPv6, which is good on principle, but it can cause some unexpected results.

It's a bit of a hobby server for me. It runs Debian test, so sometimes things get a little glitchy. For some reason, the web server was down last night and I haven't been able to figure out why. I restarted it, though, and it's been OK since, which suggests that it was not the PHP-FPM service.

[Seannery]

I think I know what you mean---sometimes, I'd just get logged out, despite the session id in the URL (when not using cookies) or the cookies not changing. I've been getting that since always, here, but it's been happening more often, recently, when not using cookies but the URL session id. I've been getting a different `unauthorized' error recently, mainly when not logged in---it's not the usual forum `you must be logged in' but like an HTTP error page.
The stylesheet errors are new, and I've been getting them about the same whether logged in or not.

[Martin Blank]

I just went and checked the actual settings, and the session manager checks the first three octets. Tor seems to have gotten more aggressive about shifting tunnels in the last few years as a privacy mechanism. If you're using Tails or some other privacy-focused distro to run Tor, they might have their own tunnel change settings.

As for stylesheets, everything should be hosted locally, including jQuery (which isn't CSS, but is something most sites farm out to reduce bandwidth and take advantage of browser caching). I've purged the server cache, so let me know if that changes things.

[Doc Giggles]

I'm just glad that the "forgot password" reset started to work after the maintenance.

[Seannery]

Still getting all the same errors.

[Martin Blank]

I'm just glad that the "forgot password" reset started to work after the maintenance.

I didn't know it was broken.

Still getting all the same errors.

Go to https://ipecho.net/plain before you visit the site to see what your apparent address is and note it, then check the same site after you get the error. Let's see if they change.

[Seannery]

Same address.
By the way, the error page:

Code: Select all

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
<hr>
<address>Apache Server at www.reallifeforums.com Port 443</address>
</body></html>

[Doc Giggles]

I didn't know it was broken.

I kind of thought there was something odd going on. I sent a couple messages through the "Contact board administrator" option but never heard back. Sounds like the update came at just the right time.

What was happening was that I clicked the forgot password, opened the link in the email, entered a new password and got a blank page after clicking on submit. No confirmation that the password had been changed and the new password failed when I tried to log in.

Hopefully I was the only one stuck in that limbo.

[Deacon]

No errors over here. Still working on mobile now for the first time in a long time.

[raptor9k]

I periodically get the 403 error page from time to time now. It seems to happen more when I click in a subforum, read a post, then click the board index link to back out to see what's unread. Chrome from Mac OS over AT&T.