I had to pm's today... heres one. "i keep getting logged out of P/A even though I pick to stay logged in forever. Like 20 times a day I have to relog in." PA is the site name.
There are two things it could be.
Firstly, prior to 2.0 RC5 (or 2.0 RC4 with the security patch), if someone tried to log in as you and failed, you would be logged out.
Secondly, it could be a cookie/session problem. See about the first one first though.
I am running smf 2.0 rc4 and I am also now having this exact issue. Is there anything to fix this.
Wasn't doing it 3 days ago but now does it all the time.
Thanks
Luke
You can either upgrade to RC5 or use the security patch for RC4 if you don't want to do an upgrade.
http://download.simplemachines.org/
You can also look into different mods to help reduce spammers visiting your sites. I use Stop Spammer (http://custom.simplemachines.org/mods/index.php?mod=1547) and httpBL (http://custom.simplemachines.org/mods/index.php?mod=2155), and they work really well. :D
Is there an easy way to apply the patch.
Thanks
Luke
Admin > Packages > Download Packages
download the package onto your forum, then install it.
Oops, it looks like the security patch isn't in the link I gave you earlier. This is the security patch: http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip
sorry my bad, currently using smf rc2. If i upgrade to rc4 should this still fix the issue. And is it easy to upgrade to this later version and will it change the look fo my website.
Thanks
Luke
Oh, I see. Well if you are planning on upgrading, you might as well upgrade to RC5 (I don't think RC4 is available for download anymore anyway?). And yes, it will help reduce bot attacks on your forum. On top of upgrading, people are using the mods that I linked you (I am using them myself), and are having great success deterring spam bots. You can try looking through this thread: http://www.simplemachines.org/community/index.php?topic=416928
How do i upload rc5?
1) Back up ALL your data.
2) Upload everything from the RC5 zip folder you downloaded onto wherever your forum is via FTP.
3) Go to http://www.YOURWEBSITE.com/FORUMFOLDER/upgrade.php In my case, it was http://adlucem.net/upgrade.php, because I didn't install my forum in another directory.
4) Follow the instructions from there on.
Detailed instructions can be found here: http://docs.simplemachines.org/index.php?board=3.0;sort=subject
We are also having this issue. We already use the Stop Spammer and httpBL on the website and find that its keeping most out but I have noticed that there are a lot more new user requests being pushed thru to the Awaiting Approval queue and in the httpBL log.
I will download the latest SMF version and jump from V2 to V5 as soon as possible. Would it be advisable for all our users to reset their passwords?
Thing2
Yes, it would be advisable.
Will all the mods work with it? Or will I have to find new ones? As well as skins?
you could check to make sure the mods have been updated... some might work using version emulate other might not unless updated.
Quote from: Spoogs on February 13, 2011, 03:37:34 PM
you could check to make sure the mods have been updated... some might work using version emulate other might not unless updated.
Your signature would indicate you're using RC3. As am I. Have you had any issues like this?
It just started yesterday on my forum. I have not experienced but another Admin has.
I'm using RC3
and multiple people on my board are having this problem including me. I thought it might be because I'm not home...but if so many others are having the same issue I guess that is less likely.
We have not had a problem with this before, so do we really need to update or apply patches?
Here is a link to the thread about this issue in my forum.
http://mlcforum.midlifecrisismarriageadvocate.com/index.php?topic=809.new#new
I scanned your thread here but may not be grasping everything right now as I'm taking care of my 92 year old Grandmother for the week and she's not sleeping--therefore neither am I...we have hardly slept since Friday. So I apologize if I misunderstand possible solutions--just type slowly and maybe I'll catch on! :o
Quote from: mcaswe on February 13, 2011, 03:22:39 PM
Will all the mods work with it? Or will I have to find new ones? As well as skins?
The spam prevention mods (Stop Spammer and httpBL) will work with RC5. But as Spoogs said, you'd need to see if your other mods are compatible with RC5. I believe most of the time, RC4 mods will work with RC5 as long as you emulate RC4 on your forum. :D
Quote from: MATTEK on February 13, 2011, 04:28:39 PM
Quote from: Spoogs on February 13, 2011, 03:37:34 PM
you could check to make sure the mods have been updated... some might work using version emulate other might not unless updated.
Your signature would indicate you're using RC3. As am I. Have you had any issues like this?
It just started yesterday on my forum. I have not experienced but another Admin has.
Yes I am still using RC3.... luckily I have not been affected by whats going on... nonetheless I did install the security patch to my forum by emulating RC4
Quote from: mcaswe on February 12, 2011, 08:49:59 PM
I had to pm's today... heres one. "i keep getting logged out of P/A even though I pick to stay logged in forever. Like 20 times a day I have to relog in." PA is the site name.
I am having the same problem on my forums. The forums haven't been updated yet, they are still RC4. I haven't changed anything. The only mod I use is Aeva Lite.
I have many members reporting this issue on various browsers (Chrome, Firefox, Internet Explorer). It seems that Safari users don't have a problem.
The problem first occured on my Vista computer after the latest Window Update (february 11). I have XP users reporting as well. I don't know if the Windows update has anything to do with this.
Maybe the problem is VPS related? Here's my status.php and phpinfo: http://www.bluesforum.com/overzicht.htm
I haven't had the problem on simplemachines.org.
Quote from: Ziggy on February 13, 2011, 11:25:46 PM
Quote from: mcaswe on February 12, 2011, 08:49:59 PM
I had to pm's today... heres one. "i keep getting logged out of P/A even though I pick to stay logged in forever. Like 20 times a day I have to relog in." PA is the site name.
I am having the same problem on my forums. The forums haven't been updated yet, they are still RC4. I haven't changed anything. The only mod I use is Aeva Lite.
I have many members reporting this issue on various browsers (Chrome, Firefox, Internet Explorer). It seems that Safari users don't have a problem.
I strongly advice to install at least the RC4 Security Patch, or upgrade to RC5. It fixes such a behavior, experienced when failed attempts to login as the users are being made. (by bots or malicious users).
It may also be a good idea to consider installing mods that block known or suspected spammers IPs.
Referred to elsewhere - mod to force login using email address -
http://custom.simplemachines.org/mods/index.php?mod=1665
I installed that security patch, and from what members are saying, same story.
I also wanted to add while some were writing their reply to a topic... when they went to post it, they had to log in. And lost their post.
Can you please tell, how many cases were there, after installing the patch?
Were they logged in "forever", or a limited time (like 60 minutes)?
I'm wondering if there's a scripty thingy that can do something like:
10 If user is logged in goto 10
20 If user is logged-out goto 30
30 log user in
40 goto 10
over-simplified and in pseudo-BASIC, I know, but...
Entirely possible, Kat, sadly.
Couldn't something really simple, like that, do the trick?
I'm not familiar enough with PHP to know quite how you'd do it. But it seems pretty simple, to me.
Mind you, to retards, things often do... ;)
Quote from: Norv on February 15, 2011, 02:04:16 PM
Can you please tell, how many cases were there, after installing the patch?
Were they logged in "forever", or a limited time (like 60 minutes)?
3 and they always log in forever, thanks for all the info up to here guys, some great people here
Quote from: Spoogs on February 13, 2011, 05:09:30 PM
Quote from: MATTEK on February 13, 2011, 04:28:39 PM
Quote from: Spoogs on February 13, 2011, 03:37:34 PM
you could check to make sure the mods have been updated... some might work using version emulate other might not unless updated.
Your signature would indicate you're using RC3. As am I. Have you had any issues like this?
It just started yesterday on my forum. I have not experienced but another Admin has.
Yes I am still using RC3.... luckily I have not been affected by whats going on... nonetheless I did install the security patch to my forum by emulating RC4
I'm going to try the same. Thanks.
Umm. I can't find the security patch?
in the upgrade thread stickied in the top board.
Quote from: Illori on February 15, 2011, 03:01:24 PM
in the upgrade thread stickied in the top board.
Found 'er. Thanks man.
Enable local storage of cookies
SMF uses cookies to store login information on the client computer. Cookies can be stored globally (myserver.com) or locally (myserver.com/path/to/forum).
Check this option if you're experiencing problems with users getting logged out automatically.
It's not the problem. The bot attacks are...
Emulating RC4 in RC3 seems to have worked. Sweet.
Is it possible to install rc5 whilst my old version is still in use, ie. can i install rc5 into another directory then once install complete, i can look and edit the new version. Once I am happy with it then change the directory's so Rc5 is the defualt.
Thanks
Luke
Also, what is the easiest way to complete a back up.
Thanks
How do I backup my database? (http://docs.simplemachines.org/index.php?topic=492.0)
if you have cpanel you can use the backup function in it to get a copy of your files and database as well.
So I have counted a handfull of people now having this issue (including myself) and seems like everyone who isnt having the problem is taking jabs at what to do to fix it.
I am using RC4 (not patched yet) and I have renamed my cookies but I am still having the problem.
Someone said they did the security patch, but still has the problem.
I read on another thread that someone who upgraded to RC5 is still having them problem.
Also, I am not changing my settings to local storage of cookies. The current settings should work.
Sounds like this is a major problem effecting multiple people. Can we get someone from SMF to look into this issue?
Thank you! ;)
Quote from: Goad on February 16, 2011, 10:06:10 AM
So I have counted a handfull of people now having this issue (including myself) and seems like everyone who isnt having the problem is taking jabs at what to do to fix it.
I am using RC4 (not patched yet) and I have renamed my cookies but I am still having the problem.
Someone said they did the security patch, but still has the problem.
I read on another thread that someone who upgraded to RC5 is still having them problem.
Also, I am not changing my settings to local storage of cookies. The current settings should work.
Sounds like this is a major problem effecting multiple people. Can we get someone from SMF to look into this issue?
Thank you! ;)
I am one person that have the security patch installed and it do not work at all, my forum was still attacked big time.
I have added the deny ip adresses and that stop them but daily new ip spam adresses are coming.
Can the SMF support maybe create a fix patch for this?
Cheers!
people are still being logged out with the upgrade? or you are still seeing the incorrect password messages in your error log?
-sigh-
The patch doesn't prevent the attempts and the errors. It just prevents you getting logged out.
Quote from: Arantor on February 16, 2011, 10:24:52 AM
-sigh-
The patch doesn't prevent the attempts and the errors. It just prevents you getting logged out.
-
SIGH!-
are you not reading? several people are saying they are still getting users logged out AFTER they have patched.
Very likely the patch was not properly installed then - the behaviour stopped on the 4 forums I admin that are affected, and on numerous other forums as well.
Having actually looked at the code changed, too, and knowing why the change was done the way it was (in two halves, ah the joys of SVN access), if they're being logged out now, the patch wasn't applied properly or another mod is affecting it, which is much more likely.
Goad,
We need to know as many details as possible, please. Were those users logged in as 'forever'? Did you experience it yourself? You say above you didn't install the patch, did you in the meantime?
Thank you.
roonekoos,
Quote from: roonekoos on February 16, 2011, 10:16:33 AM
I am one person that have the security patch installed and it do not work at all, my forum was still attacked big time.
I have added the deny ip adresses and that stop them but daily new ip spam adresses are coming.
The patch addresses the issue of authenticated users getting logged out by the attempts made by bots against their account. It cannot stop bots from trying.
You may want to look into mods like httpBL or login security, to address the attempts.
I have not once experienced the problem with my account on my forum, but I have many people complaining about it.
I just applied the patch and told people to let me know if at all they are still experiencing the issue.
I am not one of the people (yet) who are still having the problem after the patch, but there are others who are
Quote from: Norv on February 16, 2011, 10:33:07 AM
Goad,
We need to know as many details as possible, please. Were those users logged in as 'forever'? Did you experience it yourself? You say above you didn't install the patch, did you in the meantime?
Thank you.
roonekoos,
Quote from: roonekoos on February 16, 2011, 10:16:33 AM
I am one person that have the security patch installed and it do not work at all, my forum was still attacked big time.
I have added the deny ip adresses and that stop them but daily new ip spam adresses are coming.
The patch addresses the issue of authenticated users getting logged out by the attempts made by bots against their account. It cannot stop bots from trying.
You may want to look into mods like httpBL or login security, to address the attempts.
First of all thanks for the quick answers.
If you guys say that the patch is good I assume it is, I am not an expert on that.
I had installed the patch succesfully without errors or manually modifying.
I will try a login security mod and hopefully I can kill the attack attemts.
Do you have a recommendation of a mod I can use best?
Thanks and cheers!
Quote from: Arantor on February 12, 2011, 08:53:32 PM
There are two things it could be.
Firstly, prior to 2.0 RC5 (or 2.0 RC4 with the security patch), if someone tried to log in as you and failed, you would be logged out.
Checking into this thread because I've recently had the same OP problem on my board (logged in forever but still get logged out) and a check of my Forum Error Log indicates that a number of strange IP Guests have been trying to log on as me. I've banned each one and I've stayed logged in, discovering thereby that there's nothing wrong with the SMF software but just a bunch of hacking attacks.
Secondly, it could be a cookie/session problem. See about the first one first though.
It's a bunch of hacking attacks, lots of bots doing it. But prior to 2.0 RC5 / RC4 patch, those attempts would also have the side effect of logging out genuine users, which banning by IP does prevent - until they change IP address again.
Quote from: lukeolding on February 16, 2011, 06:25:30 AM
Is it possible to install rc5 whilst my old version is still in use, ie. can i install rc5 into another directory then once install complete, i can look and edit the new version. Once I am happy with it then change the directory's so Rc5 is the defualt.
Thanks
Luke
Ya, I'd like an answer to this too. I just upgraded and lost all my mods, so I'd like to take the upgrade offline until I can iron all the !#%$*@!! kinks out and get the new version operating with the same features and customizations the old one operated on. I gotta re-do old research all over again and it's not something I can do in 5 minutes.
Quote from: Arantor on February 16, 2011, 06:08:34 PM
It's a bunch of hacking attacks, lots of bots doing it. But prior to 2.0 RC5 / RC4 patch, those attempts would also have the side effect of logging out genuine users, which banning by IP does prevent - until they change IP address again.
True--they're famous for IP spoofing, for sure. I just installed that force email login thingie to save myself from banning every spoofed server in existence.
Assuming the bots IP is in their database, do any of the two mods mentioned in this thread completely block the hack attempts of existing user accounts, or do they just block registering new accounts from that IP?
Stop Spammer: http://custom.simplemachines.org/mods/index.php?mod=1547
httpBL: http://custom.simplemachines.org/mods/index.php?mod=2155
I know, installing the security patch / RC5 will stop users getting logged out, but somehow I still don't like bots endlessly trying to hack into forum accounts...
The patch in my sig has had 100% success at blocking this bot attack.
I am running 2.0 RC 2 and having this same issue personally. I will be logged in and click on a post to read and it will log me out. Or I will hit the reply button and sit for a few minutes, less than five, and when I hit the post button, it will say that your session has expired.
I have had several other users report this as well.
what do I need to do if I am running RC 2? Can I emulate RC 4 in this version?
Thanks
RGecy
You should just upgrade, to be honest. Using the security patch on RC3 is one thing, but using it on RC2 is really not recommended even if it might work (I haven't tested). There are multiple vulnerabilities in RC2 that were fixed in RC3.
I have so many mods I think it would just be a nightmare right now!
I had this same problem last week.I installed this mod http://custom.simplemachines.org/mods/index.php?mod=1665 I have not had any problems since.I was using RC3 so i had to go to his site to get the version i needed.I hope this helps.
I successfully upgraded to RC5 and haven't had any of my users saying that they are being logged out, have seen that there are still logs for unsuccessfully logging in for users so they are still hitting us
Quote from: thing2 on February 23, 2011, 07:07:08 PM
I successfully upgraded to RC5 and haven't had any of my users saying that they are being logged out, have seen that there are still logs for unsuccessfully logging in for users so they are still hitting us
No-one said that the upgrade would magically prevent the bots trying to guess your members' details. See the thread in News and Announcements for suggestions on what you can do about it.
I have a similar problem. Some users are being asked to log back in on the front page, bit when they click any of the links it says they're logged in?
I've had a look and found out that when I go to the url
Quotehttp://sitename.net
it keeps me logged in, but if I go to
Quotehttp://www.sitename.net
it does the problem explained above. The Forum URL in the server settings is set to the
Quotehttp://sitename.net.
How can I fix this?
Thanks.
The reason is down to the cookie - it's not set to go across multiple subdomains so it's only valid for sitename.net not www.sitename.net too. So the forum URL is without www, double check the URLs for all your themes too to make sure they're consistent.
Meantime, go to Admin > Configuration > Server Settings > Cookies and Session and enable "Use subdomain independent cookies" - then log out and log back in again.
Fixed it - I just set my forum URL to the http://www.sitename.net, now the http://sitename.net directs to the www one and installs both cookies! :)
Thanks anyway.
ok, we have a bit toooo many people within this topic asking for support. I'll lock this and mark this as solved. If anyone is still facing any issues as such and the tricks within this topic do not help, feel free to create a new topic with the details.