Constant, unrelenting "password incorrect" errors

[css_script_writer]

First of all, I'm using SMF v2.0 (RC3) with the default theme.

For the better part of a year (if not longer) the error log has been inundated with "password incorrect" errors. Sometimes it can take up to 8 tries before a member is actually able to log in. I'm sure this is very frustrating for my members and I can tell you that it is absolutely graying the hairs on my own head. Here's what a typical entry in my logs look like...

http://www.anxietyzone.com/index.php?action=login2
Password incorrect - <membername>

I have tried so many bits of advice on this forum and nothing seems to work. Doing a search on the forum here brings up many others who have had (or are currently having) this same issue. I'm just at my wits end at this point and don't know what to do or where to turn anymore. I don't know what else I can say but at this point, I'm willing to try just about anything.

To all of the kind folks here willing to help, please let me know if you need more information or if you have a solution to this problem as I am really becoming desperate.

Thank so much, CSS

[rd]

Password incorrect is mostly the users fault. The best you can do is have some banners around that advice users to keep note of their passwords. If the error log gets big then simply delete it at anytime.

[Kill Em All]

caps lock or num lock is usually the culprit.

[rd]

There is a mod for that:

http://custom.simplemachines.org/mods/index.php?mod=1807

It's for RC2 but it might work for RC3, check on a test forum or something if it doesn't then go annoy Nas on his support topic

[css_script_writer]

So I'm trying to imagine something like 8 attempts made to login...

1st: Member types in wrong password.
2nd: Member types in wrong password again.
3rd: Member realizes their caps lock is on and tries again but...
4th: ...suddenly realizes that their numbers lock is on too.
5th: Member still can't log in so deletes cookies, cache, history, etc but still can't login.
6th: Member tries (guesses) three other passwords they might have used. Still no luck.
7th: Computer spontaneously reboots itself so member starts process all over again.
8th: success...finally!.

This scenario (while I was being a bit silly) seems unlikely so how does one explain so many different login attempts?. I mean the error log is flooded with numerous attempts up (between 5 and 8 ) and not just by a few members but by most of them.

Thanks again for the replies. I really appreciate all you people do in trying to help others but I'm just trying to understand a little better.

- Thank you, CSS

[rd]

Can you tell us how many members do this?

Also, are they new members or people that have been around for a while?

[rd]

You seem to have a big forum, I am not surprised you get so many of these since you have like 13,000+ members. Also, it's an anxiety forum, how do you know that the members aren't just typing it wrong because they are constantly worried?

I had some anxiety before and I know how it feels like.

[css_script_writer]

I'd say upwards of 20 or more members get this error each day and the ones I just looked up have been around for awhile and have posted a number of posts.

[rd]

I'd say upwards of 20 or more members get this error each day and the ones I just looked up have been around for awhile and have posted a number of posts.

That's interesting and I think the only way to solve this is to PM them and find out what's going on.

It can be a human error but I find it unlikely that this is SMF related...

[css_script_writer]

@Royalduke - Well, I suppose anything is possible. We all get nervous at times and can't remember our passwords...the name of the person we met the other day...where we laid out car keys, etc. It's just the sheer volume of these errors that appear (1,000's of them) within less than a week and I was suspecting something simple like perhaps changing a setting here or there would do the trick since I've read that some of the settings in SMF might correct this issue (none have worked for me so far though).

[css_script_writer]

Here are several other errors I've been seeing regularly in the error log. Perhaps one or more of them will provide a clue...

1) http://www.anxietyzone.com/index.php?PHPSESSID=6d206409f6b6369e79d1be29866712c4&amp;action=login2

2) http://www.anxietyzone.com/index.php?action=login2

3) http://www.anxietyzone.com/index.php?action=emailuser;sa=email
Unable to find user's email address.

4) http://www.anxietyzone.com/index.php?action=activate;u=16401;code=ccfe46b3a5
Ran into problems sending Mail. Error: 451 Temporary local problem - please try later

5) 8: Undefined index: max_menu_id
File: /home/anxietyz/public_html/Sources/Profile.php

6) http://www.anxietyzone.com/index.php?action=reminder;sa=setpassword;u=16339;code=546dc96847
2: in_array() [<a href='function.in-array'>function.in-array</a>]: Wrong datatype for second argument
File: /home/anxietyz/public_html/Sources/Security.php
Line: 837

Number 6# is of particular concern because it was a guest who caused this error not once but 26 times within about 10 minutes and unlike members and other guests, they had no IP address visible anywhere. The fact that it shows "security.php" also makes me nervous.

I also have a post count based group set up and configured so that a new member must create a single post in order to use search, PMs, post links and a variety of other things.

Not sure if any of this helps. Thanks again!.

- Regards, CSS

[rd]

* Royalduke thinks he figured it out! This looks like some kind of database error. Because it seems even the members Email address can't be found.

I am not much of a database person, so I'll let someone who knows DB handle this.

[css_script_writer]

Thanks RoyalDuke. I'll keep my fingers crossed .

Here are even more errors I've just discovered from the guest with the invisible IP address...

1) http://www.anxietyzone.com/index.php?action=reminder;sa=setpassword;u=16339;code=546dc96847
8: Undefined index: permissions
File: /home/anxietyz/public_html/Sources/Security.php
Line: 837

2) http://www.anxietyzone.com/index.php?action=reminder;sa=setpassword;u=16339;code=546dc96847
2: array_unshift() [<a href='function.array-unshift'>function.array-unshift</a>]: The first argument should be an array
File: /home/anxietyz/public_html/Sources/Load.php
Line: 1581

3) http://www.anxietyzone.com/index.php?action=reminder;sa=setpassword;u=16339;code=546dc96847
8: Undefined index: smiley_set
File: /home/anxietyz/public_html/Sources/Load.php
Line: 1539

4) http://www.anxietyzone.com/index.php?action=reminder;sa=setpassword;u=16339;code=546dc96847
8: Undefined index: name
File: /home/anxietyz/public_html/Sources/Load.php
Line: 1534

5) http://www.anxietyzone.com/index.php?action=reminder;sa=setpassword;u=16339;code=546dc96847
8: Undefined index: ignoreusers
File: /home/anxietyz/public_html/Sources/Load.php
Line: 1531

6) http://www.anxietyzone.com/index.php?action=reminder;sa=setpassword;u=16339;code=546dc96847
8: Undefined index: email
File: /home/anxietyz/public_html/Sources/Load.php
Line: 1530

7) http://www.anxietyzone.com/index.php?action=reminder;sa=setpassword;u=16339;code=546dc96847
8: Undefined index: language
File: /home/anxietyz/public_html/Sources/Load.php
Line: 1529

http://www.anxietyzone.com/index.php?action=reminder;sa=setpassword;u=16339;code=546dc96847
8: Undefined index: mod_cache
File: /home/anxietyz/public_html/Sources/Load.php
Line: 1527

9) http://www.anxietyzone.com/index.php?action=reminder;sa=setpassword;u=16339;code=546dc96847
8: Undefined index: username
File: /home/anxietyz/public_html/Sources/Load.php
Line: 1528

Not to get off of my original topic but what could this "guest" possibly be up to?. Unlike everyone else I've ever seen, they have no IP and they seem to be generating some really strange errors I have never seen before (and lots of them).

- Regards, CSS

[rd]

It seems that this guest is trying to use the "Remind Password" function because either they are upto no good or really forgot their password and is trying to reset it.

I refered this topic to the SMF Support Helper board so that someone experienced with DB or knows this kind of problem can assist you.

[rd]

By the way, this:
1) http://www.anxietyzone.com/index.php?PHPSESSID=6d206409f6b6369e79d1be29866712c4&amp;action=login2

Isn't really a problem, it's how your hosting service is setup.

[css_script_writer]

Thanks RoyalDuke. You have been a huge help with fast responses!.

Just a few quickies...

1) Is there a way I can obtain the IP address of this guest?. Obviously the SMF software knows what it is because when I clicked on "show only messages from this IP", it showed only messages from this mysterious guest.

2) Is there an URL on this helper board or a way to track replies on it or will the replies end up here in this thread?.

Once again, thanks for all your help

- Regards, CSS

[rd]

1) There has to be a way but sadly I don't know. Maybe you should check if error log had the IP recorded. I never really had to check a guest IP before.

2) Sorry, it's a hidden board and is for the helper group.

Anyways, you are most likely going to get support in 7 or 8 hours because most support staff are American or British and it's now 12:11 AM EST (my time to sleep). Hopefully they'll help you tomorrow.

[SlammedDime]

Have any members actually complained to you that they're having a problem, or are you just worried/wondering because you see all of those hits in the error log?

[css_script_writer]

I understand. G'night and thanks for your help!. I just want to sneak one more thing in here. This "guest" generated over 100 of these errors and all at exactly 11:13:26 AM on May 30. I'm not sure how a person can sit there and type passwords in over 100 times all within the space of a minute. This is really getting stranger by the minute and smells a bit fishy to me.

- Thanks again, CSS

[css_script_writer]

@SlammedDime - Not recently but a few times in the past members have asked about it. Otherwise I rarely hear about it so I assume they must just be tolerating it.