At Login - 403 on index.php, after login retry - OK !!!

[melb]

SMF Version: SMF 1.1.4
Hi.

SMF works great, once I get logged in!  But, I seem to get a "cold start" problem. Our board is under test and not yet in production. When logging in after a period of inactivity, the first login goes wrong. Pressing the Back button and Login again, then all is OK!

Raw log is:-

78.86.xxx.xxx - - [18/Oct/2007:07:43:43 -0500] "GET / HTTP/1.1" 200 3646 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:43:43 -0500] "GET /Themes/delta_11final_tp/style.css?rc2 HTTP/1.1" 304 - "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:43:43 -0500] "GET /Themes/delta_11final_tp/style_red.css?rc2 HTTP/1.1" 304 - "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:43:44 -0500] "GET /Themes/delta_11final_tp/images/img/topleft.jpg HTTP/1.1" 304 - "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:43:44 -0500] "GET /Themes/delta_11final_tp/images/img/topright.jpg HTTP/1.1" 304 - "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:43:44 -0500] "GET /Themes/delta_11final_tp/images/upshrink.gif HTTP/1.1" 304 - "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:43:44 -0500] "GET /Themes/delta_11final_tp/images/icons/login_sm.gif HTTP/1.1" 304 - "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:43:44 -0500] "GET /Themes/delta_11final_tp/images/img/topmid.gif HTTP/1.1" 304 - "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:43:46 -0500] "POST /index.php?PHPSESSID=bcc68c6c9c435b9824f6c23954d62111&action=login2 HTTP/1.1" 302 38 "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:43:46 -0500] "GET /index.php?PHPSESSID=db1cac1fd2e2b219a145b2b254037c26;action=login2;sa=check;member=1 HTTP/1.1" 403 - "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:44:47 -0500] "POST /index.php?PHPSESSID=bcc68c6c9c435b9824f6c23954d62111&action=login2 HTTP/1.1" 302 38 "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"
78.86.xxx.xxx - - [18/Oct/2007:07:44:47 -0500] "GET /index.php HTTP/1.1" 200 4599 "hxxp:www.xxx [nonactive]_domainname.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.8pre) Gecko/20071015 Firefox/2.0.0.7 Navigator/9.0"

Thanks for any help
Mel

[青山 素子]

Having problems with mod_security?

[melb]

Many thanks for tip.

I followed the advice in http://www.simplemachines.org/community/index.php?topic=34270.0.

mod_security is installed and I've added the override commands to my .htaccess.

So, see how it goes. I'm not sure yet if it fixed it, but it certainly looks OK

Again many thanks. Appreciate it.

Regards  Mel

[greyknight17]

Monitor it for another day or so and make sure it's ok now. If so, you may mark this topic as solved.

[melb]

That was it - mod_security. No problems for two days. Topic / Issue closed.

Again many thanks for the help

Mel