Forum constantly requires logging on

[iPete]

Hi - I have had my smf forum for almost three years now, but in the last few days I have encountered a new problem.

Each time a user visits the site they are required to re-log on. Even if they check the 'stay logged in' box, they fail to stay logged in. Even once they user is logged back in, trying to reply to a thread or create a new thread brings up the log on dialogue again!

I am running SMF 2.0 RC3 and I haven't made any changes to the site in a couple of weeks.

my URL is http://www.themexbox.com [nofollow]

if anyone can help me resolve this I will be eternally grateful.

[iPete]

I should add that this is not happening to all users, but the ones it is happening to (including myself) are using a range of different browsers, and we have tried clearing cookies and cache etc.

[Clara Listensprechen]

There are a couple of threads on this problem already, and the problem is that some hacker-bot has tried to log in as  you and others, and has failed. A few of measures already discussed are:

1) change the number of attempts to login before failure to some high number
2) ban the IPs of the offenders (and/or WHOIS server range) via Ban List or .htaccess file. THIS thread discusses the .htaccess file in detail.
3) THIS thread advises to add a mod that forces a login to use the email address instead of the username.

Know ye you are not alone!

On my boards, only 4 usernames have been attempted (2 admin, 1 global mod, 1 regular member) so I concur with your observation that the bots don't hack everybody. They also don't seem to care if they're all admin or all mod or all admin/mod either. The attacks on the same names are repetitive.

[Illori]

please upgrade to RC5 it has a security fix for this and other issues since RC3 was released.

[Clara Listensprechen]

I tried that and lost a lot of prized mods on my board, so I restored my RC2 backup. I don't have the time at the moment to do extensive mod-rassling. It's a pain, a headache, and major long-term saddle-bur to do that.

[Illori]

try installing the RC4 patch using version emulation.

[Clara Listensprechen]

RC4 patch will work on RC2?  I didn't know that, and will try that ASAP. Thanks.

[Illori]

it might work, there is no guarantee it will work.

[NiallTTC]

I am experiencing exactly the same thing.  Don't really want to add RC5 as it wont be compatible with any of the mods I have installed.

Why does this happen?

Several of my more regular users are all experiencing this.  They go to the main forum page and it shows unread posts, unread PMs, but when they actually click on any of them to view them, it forces them to log in again.  Does it in any browser, on any computer.

[Clara Listensprechen]

it might work, there is no guarantee it will work.

I got the ole "file is corrupt" error message when using the Package Manager, but I'm already familiar with how to get around that. It would be so nice if stuff wasn't so time demanding, but I know how it is.  Still, I got a good handle on the bot problem so I'm not terribly worried about it.  again, thanks for the help!

[willerby]

Clara, you need to emulate RC4 before installing the mod to avoid that error.

After uploading the patch file view the list of mods but before clicking install click the Advanced link at the bottom of the page.

Change version to RC4 and save then click on install for the RC4 patch.

If that works and shows no file errors, remember to change version emulation back to RC2 when you're done.

[Clara Listensprechen]

Aha. That sounds like sound advice.  I will try that.

[iPete]

Thank you so much for the advice!

I will try to sort the problem and report back.

Thank you again. 

[iPete]

I installed the security patch using emulation and the problem is solved.

Thank you very very much for your help!