Re: Unable to access on forums and wiki
Today’s improvements. 1. I am now adding Bytedance’s spider from both the Forums and Wikis. I tracked requests from 17,000 IP addresses today. Bad, bad, Bytedance, be better. I feel like sending them an invoice. 2. I’ve tuned the Apache and php fpm workers to be balanced. Response times seem to be in decent shape. We are averaging about 100,000 requests an hour on across the 10 forums including 403 on denied requests. Best, Dave > On Feb 2, 2026, at 1:26 AM, Rory O'Farrell wrote: > > On Mon, 02 Feb 2026 07:39:53 +0100 > [email protected] wrote: > >> All day Sunday and again this morning, no access. > > A comment, not a criticism: it has been very slow - minutes for log-in - but > one gets there in the end with patience! I leave a window logging in and > visit some other site while waiting. > > I appreciate the difficulties sys-admins have with these repeated attacks and > the effort it requires for then to counteract such malice. > > -- > Rory O'Farrell > > - > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
@Dave, sorry, saw your message a bit late. Tested just now with one file and it works fine. No delay and quick handling On 2026/01/31 00:49:39 Dave Fisher wrote: > I think that I have finally tuned the apache config properly. I’ve got a > little more tuning to do, but unless there is trouble. I’m waiting until next > week. > > Dick - please test file uploads on Media Wiki. > > Best, > Dave > [snip] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
On Mon, 02 Feb 2026 07:39:53 +0100 [email protected] wrote: > All day Sunday and again this morning, no access. A comment, not a criticism: it has been very slow - minutes for log-in - but one gets there in the end with patience! I leave a window logging in and visit some other site while waiting. I appreciate the difficulties sys-admins have with these repeated attacks and the effort it requires for then to counteract such malice. -- Rory O'Farrell - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
All day Sunday and again this morning, no access. - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
I have tightened up and separated php pooling so that wiki and forums are separated. Trouble is caused by back pressure from the database. It turns out that forum session tables needed a specific index created and while they are cleaned up there is an overuse on the Hungarian forum which was causing contention. I plan to setup blocking for aggressive spiders in the apache configuration tomorrow. Here is the list: # Known aggressive bots SetEnvIfNoCase User-Agent "Bytespider" bad_bot SetEnvIfNoCase User-Agent "MJ12bot" bad_bot SetEnvIfNoCase User-Agent "AhrefsBot" bad_bot SetEnvIfNoCase User-Agent "SemrushBot" bad_bot Let me know if you know others to add. Let’s see what the next 24 hours brings. Best, Dave > On Feb 1, 2026, at 1:42 PM, Dave Fisher wrote: > > > >> On Jan 31, 2026, at 10:02 PM, Dean Webber >> wrote: >> >>> I’ve used a new tool from ASF Infra to block a couple of data centers with >>> bad connection requests. >> >> It would be interesting to know how this is achieved, >> One way is to use AS (autonomous system, very large network or group of >> networks with a single routing policy) blocking. >> This can be achieved using local tools, and creating a blocklist, or >> hardware firewalls. >> >> I would recommend blocking AS24940, AS16276, AS14061, AS51167, AS16509, >> AS8075, AS396982, AS136907. >> You can generate lists using, bgpq4, to generate lists that you can use, >> supporting a wide output for hardware. >> Or you can define output format, such as bgpq4 -F "%n\\n" AS24940. >> >> From the above list, "bgpq4 -F "%n\\n" AS24940 AS16276 AS14061 AS16509 >> AS8075 AS396982 AS136907 > output" gives a file with 36 945 address. Even >> just using these tools to see where this traffic is coming from is helpful. > > If you wish to help then please share more details about this output on > [email protected] and I can at least see if we see these ip in > the logs. > >> There are many autonomous systems that should be filtered, or monitored. > > We do have deny lists and can support manual changes to these filters. > >> I also asked a question recently to Brave (Kit), and it replied with an >> answer from the public email archive in very recent history. It would be >> worth investigating where the traffic comes from, as what the intention of >> the connection. >> >> If it is a web scraper, you could feed it to a tarpit, >> https://arstechnica.com/tech-policy/2025/01/ai-haters-build-tarpits-to-trap-and-trick-ai-scrapers-that-ignore-robots-txt/. >> This has varying levels of success. > > For me just setting up a tarpit is a personal “tarpit”. > >> >> Otherwise, BGP filtering will allow you to get rid of a bunch of bad >> connections. Some should be outright blocked, others can be monitored for >> abuse, and rejected upon x request in a given time. > > The tuning I am working on is starting to stop bad requests before they get > to the php layer. > > Last year I put aggressive IP blocking in place and we have a large deny list > (and a small allowlist) built over time. > > The latest set of trouble has included slow loris connections and that is > mitigated. Otherwise we have the usual scanners trying phpBB style requests > w/o knowing our unique organization. > > I’ll need to revisit the deny list process (python code that counts IPs in > access logs) to include looks in the error logs for specific errors which > should show bad actors more quickly. > > Best, > Dave > >> >> All the best. >> >> >> From: Dave Fisher >> Sent: 30 January 2026 02:53 >> To: dev >> Subject: Re: Unable to access on forums and wiki >> >> I’ve used a new tool from ASF Infra to block a couple of data centers with >> bad connection requests. >> >> I then restarted the services. >> >> The site appears to be better. >> >>> On Jan 29, 2026, at 12:40 AM, Dick Groskamp wrote: >>> >>> And again today. >>> >>> On 2026/01/08 07:37:04 [email protected] wrote: >>>> Since this morning, access was very slow >>>> >>>> But now, I got timeout >>>> >>>> Thanks to restore it >>> >>> - >>> To unsubscribe, e-mail: [email protected] >>> For additional commands, e-mail: [email protected] >>> >> >> >> - >> To unsubscribe, e-mail: [email protected] >> For additional commands, e-mail: [email protected] >> > > > - > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
> On Jan 31, 2026, at 10:02 PM, Dean Webber > wrote: > >> I’ve used a new tool from ASF Infra to block a couple of data centers with >> bad connection requests. > > It would be interesting to know how this is achieved, > One way is to use AS (autonomous system, very large network or group of > networks with a single routing policy) blocking. > This can be achieved using local tools, and creating a blocklist, or hardware > firewalls. > > I would recommend blocking AS24940, AS16276, AS14061, AS51167, AS16509, > AS8075, AS396982, AS136907. > You can generate lists using, bgpq4, to generate lists that you can use, > supporting a wide output for hardware. > Or you can define output format, such as bgpq4 -F "%n\\n" AS24940. > > From the above list, "bgpq4 -F "%n\\n" AS24940 AS16276 AS14061 AS16509 AS8075 > AS396982 AS136907 > output" gives a file with 36 945 address. Even just using > these tools to see where this traffic is coming from is helpful. If you wish to help then please share more details about this output on [email protected] and I can at least see if we see these ip in the logs. > There are many autonomous systems that should be filtered, or monitored. We do have deny lists and can support manual changes to these filters. > I also asked a question recently to Brave (Kit), and it replied with an > answer from the public email archive in very recent history. It would be > worth investigating where the traffic comes from, as what the intention of > the connection. > > If it is a web scraper, you could feed it to a tarpit, > https://arstechnica.com/tech-policy/2025/01/ai-haters-build-tarpits-to-trap-and-trick-ai-scrapers-that-ignore-robots-txt/. > This has varying levels of success. For me just setting up a tarpit is a personal “tarpit”. > > Otherwise, BGP filtering will allow you to get rid of a bunch of bad > connections. Some should be outright blocked, others can be monitored for > abuse, and rejected upon x request in a given time. The tuning I am working on is starting to stop bad requests before they get to the php layer. Last year I put aggressive IP blocking in place and we have a large deny list (and a small allowlist) built over time. The latest set of trouble has included slow loris connections and that is mitigated. Otherwise we have the usual scanners trying phpBB style requests w/o knowing our unique organization. I’ll need to revisit the deny list process (python code that counts IPs in access logs) to include looks in the error logs for specific errors which should show bad actors more quickly. Best, Dave > > All the best. > > > From: Dave Fisher > Sent: 30 January 2026 02:53 > To: dev > Subject: Re: Unable to access on forums and wiki > > I’ve used a new tool from ASF Infra to block a couple of data centers with > bad connection requests. > > I then restarted the services. > > The site appears to be better. > >> On Jan 29, 2026, at 12:40 AM, Dick Groskamp wrote: >> >> And again today. >> >> On 2026/01/08 07:37:04 [email protected] wrote: >>> Since this morning, access was very slow >>> >>> But now, I got timeout >>> >>> Thanks to restore it >> >> - >> To unsubscribe, e-mail: [email protected] >> For additional commands, e-mail: [email protected] >> > > > - > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
> I’ve used a new tool from ASF Infra to block a couple of data centers with > bad connection requests. It would be interesting to know how this is achieved, One way is to use AS (autonomous system, very large network or group of networks with a single routing policy) blocking. This can be achieved using local tools, and creating a blocklist, or hardware firewalls. I would recommend blocking AS24940, AS16276, AS14061, AS51167, AS16509, AS8075, AS396982, AS136907. You can generate lists using, bgpq4, to generate lists that you can use, supporting a wide output for hardware. Or you can define output format, such as bgpq4 -F "%n\\n" AS24940. >From the above list, "bgpq4 -F "%n\\n" AS24940 AS16276 AS14061 AS16509 AS8075 >AS396982 AS136907 > output" gives a file with 36 945 address. Even just using >these tools to see where this traffic is coming from is helpful. There are many autonomous systems that should be filtered, or monitored. I also asked a question recently to Brave (Kit), and it replied with an answer from the public email archive in very recent history. It would be worth investigating where the traffic comes from, as what the intention of the connection. If it is a web scraper, you could feed it to a tarpit, https://arstechnica.com/tech-policy/2025/01/ai-haters-build-tarpits-to-trap-and-trick-ai-scrapers-that-ignore-robots-txt/. This has varying levels of success. Otherwise, BGP filtering will allow you to get rid of a bunch of bad connections. Some should be outright blocked, others can be monitored for abuse, and rejected upon x request in a given time. All the best. From: Dave Fisher Sent: 30 January 2026 02:53 To: dev Subject: Re: Unable to access on forums and wiki I’ve used a new tool from ASF Infra to block a couple of data centers with bad connection requests. I then restarted the services. The site appears to be better. > On Jan 29, 2026, at 12:40 AM, Dick Groskamp wrote: > > And again today. > > On 2026/01/08 07:37:04 [email protected] wrote: >> Since this morning, access was very slow >> >> But now, I got timeout >> >> Thanks to restore it > > - > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
There is more to do, but I’ll wait until my morning. > On Jan 30, 2026, at 4:49 PM, Dave Fisher wrote: > > I think that I have finally tuned the apache config properly. I’ve got a > little more tuning to do, but unless there is trouble. I’m waiting until next > week. > > Dick - please test file uploads on Media Wiki. > > Best, > Dave > >> On Jan 29, 2026, at 11:08 PM, Bidouille wrote: >> >> nope, connection still slow at 7:00am >> More than 5 sec to respond >> https://check-host.net/check-report/381a8593kd27 >> >> >> - Mail original - >>> De: "Dave Fisher" >>> À: "dev" >>> Envoyé: Jeudi 29 Janvier 2026 17:53:23 >>> Objet: Re: Unable to access on forums and wiki >>> >>> I’ve used a new tool from ASF Infra to block a couple of data centers >>> with bad connection requests. >>> >>> I then restarted the services. >>> >>> The site appears to be better. >>> >>>> On Jan 29, 2026, at 12:40 AM, Dick Groskamp >>>> wrote: >>>> >>>> And again today. >>>> >>>> On 2026/01/08 07:37:04 [email protected] wrote: >>>>> Since this morning, access was very slow >>>>> >>>>> But now, I got timeout >>>>> >>>>> Thanks to restore it >>>> >>>> - >>>> To unsubscribe, e-mail: [email protected] >>>> For additional commands, e-mail: [email protected] >>>> >>> >>> >>> - >>> To unsubscribe, e-mail: [email protected] >>> For additional commands, e-mail: [email protected] >>> >>> >> >> - >> To unsubscribe, e-mail: [email protected] >> For additional commands, e-mail: [email protected] >> > > > - > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
I think that I have finally tuned the apache config properly. I’ve got a little more tuning to do, but unless there is trouble. I’m waiting until next week. Dick - please test file uploads on Media Wiki. Best, Dave > On Jan 29, 2026, at 11:08 PM, Bidouille wrote: > > nope, connection still slow at 7:00am > More than 5 sec to respond > https://check-host.net/check-report/381a8593kd27 > > > - Mail original - >> De: "Dave Fisher" >> À: "dev" >> Envoyé: Jeudi 29 Janvier 2026 17:53:23 >> Objet: Re: Unable to access on forums and wiki >> >> I’ve used a new tool from ASF Infra to block a couple of data centers >> with bad connection requests. >> >> I then restarted the services. >> >> The site appears to be better. >> >>> On Jan 29, 2026, at 12:40 AM, Dick Groskamp >>> wrote: >>> >>> And again today. >>> >>> On 2026/01/08 07:37:04 [email protected] wrote: >>>> Since this morning, access was very slow >>>> >>>> But now, I got timeout >>>> >>>> Thanks to restore it >>> >>> - >>> To unsubscribe, e-mail: [email protected] >>> For additional commands, e-mail: [email protected] >>> >> >> >> - >> To unsubscribe, e-mail: [email protected] >> For additional commands, e-mail: [email protected] >> >> > > - > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
nope, connection still slow at 7:00am More than 5 sec to respond https://check-host.net/check-report/381a8593kd27 - Mail original - > De: "Dave Fisher" > À: "dev" > Envoyé: Jeudi 29 Janvier 2026 17:53:23 > Objet: Re: Unable to access on forums and wiki > > I’ve used a new tool from ASF Infra to block a couple of data centers > with bad connection requests. > > I then restarted the services. > > The site appears to be better. > > > On Jan 29, 2026, at 12:40 AM, Dick Groskamp > > wrote: > > > > And again today. > > > > On 2026/01/08 07:37:04 [email protected] wrote: > >> Since this morning, access was very slow > >> > >> But now, I got timeout > >> > >> Thanks to restore it > > > > - > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > > - > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
I’ve used a new tool from ASF Infra to block a couple of data centers with bad connection requests. I then restarted the services. The site appears to be better. > On Jan 29, 2026, at 12:40 AM, Dick Groskamp wrote: > > And again today. > > On 2026/01/08 07:37:04 [email protected] wrote: >> Since this morning, access was very slow >> >> But now, I got timeout >> >> Thanks to restore it > > - > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
And again today. On 2026/01/08 07:37:04 [email protected] wrote: > Since this morning, access was very slow > > But now, I got timeout > > Thanks to restore it - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
Rory O'Farrell wrote: On Mon, 26 Jan 2026 17:47:11 +0100 [email protected] wrote: Hi, I checked and forum seems okay to me. So it seems an issue with your connection. Does a vpn improve your speed? all the best petko Forum has been very slow for the past few days; the statistics show it is heavily overloaded with connections - over 2300 a few minutes ago, rather than the usual 100 or so. Rory Still seems to be a problem as at the time of writing this. - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
On Mon, 26 Jan 2026 17:47:11 +0100 [email protected] wrote: > Hi, > > I checked and forum seems okay to me. > > So it seems an issue with your connection. Does a vpn improve your speed? > > all the best > > petko Forum has been very slow for the past few days; the statistics show it is heavily overloaded with connections - over 2300 a few minutes ago, rather than the usual 100 or so. Rory > > Am 26.01.2026 um 08:13 schrieb [email protected]: > > Since a couple of days, access is very slooow > > > > Thanks to have a look > > - > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > -- Rory O'Farrell - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
Hi, I checked and forum seems okay to me. So it seems an issue with your connection. Does a vpn improve your speed? all the best petko Am 26.01.2026 um 08:13 schrieb [email protected]: Since a couple of days, access is very slooow Thanks to have a look - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Unable to access on forums and wiki
Since a couple of days, access is very slooow Thanks to have a look
Re: Unable to access on forums and wiki
Update: With help of infra we managed to fight of a DDOS attack. The response time should be better now. Am 08.01.2026 um 09:38 schrieb [email protected]: Am 08.01.2026 um 08:37 schrieb [email protected]: Since this morning, access was very slow But now, I got timeout Thanks to restore it Thanks for the notification. There are to many connections, but i do not know how to propper resolve them. :( I will update once i found a solution or found someone who has the knowledge. Sorry for the delay. All the best peter - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: Unable to access on forums and wiki
Am 08.01.2026 um 08:37 schrieb [email protected]: Since this morning, access was very slow But now, I got timeout Thanks to restore it Thanks for the notification. There are to many connections, but i do not know how to propper resolve them. :( I will update once i found a solution or found someone who has the knowledge. Sorry for the delay. All the best peter - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Unable to access on forums and wiki
Since this morning, access was very slow But now, I got timeout Thanks to restore it
