Skip to main content ↑ ↓
Recent Posts
1
Bug Reports / Re: Recent Posts permissions
Last post by Spuds -
Is your concern that they are not reading the thread, in which case they may simply click reply when there was already a reply?  I know some users tend to be lazy and just use recent posts for everything.

Quote from: Steeley – Worse, it's apparently a logic conflict in 2.x..
I'm not sure what you are getting at :innocent: is it simply that in the full topic listing there is not reply button on each message yet there is one for each when viewed in the recent listing?

Its easy to remove the extra buttons from the recent listing, but its been that way for a long time.

Notify of course is a topic level function as well .. even though its shown on a per message in the recent listing.
2
Bug Reports / Recent Posts permissions
Last post by Steeley -
I think it's not a good idea to have permissions to do anything with posts in the "recent posts" listings other than link to the actual post in the topic - that's where the user should act on posts.
Quote, Reply (and Like, Notify?), etc. should not be available in the Recent Posts list,  only be available in the actual topic. 
Observed in v 1.1.x and v 2.x

Worse, it's apparently a logic conflict in 2.x..

In v 2.x, you can't "reply" to a particular message in a topic - the Reply function at the top (or bottom) of the topic is for the general topic, where the individual posts offer a "Quote" (which makes sense) as the reply is going to end up at the end of the reply chain anyway so you know what post is being replied to. But you can "reply" to the individual posts from the  Recent Posts listing, which I think really doesn't make sense in the listing, or anywhere else for that matter....
6
Chit Chat / Re: Stress relief
Last post by Hectraph -
My oddball stress relief is a worm bin. I started with a black tote and a pound of red wigglers in the basement. Keep the bedding like a wrung-out sponge and bury coffee grounds and veg trimmings in rotating corners. No smell if you don’t overfeed. The castings made my peppers and tomatoes sturdier, and the “worm tea” diluted 1:10 perks up containers. It also cut our trash a lot. Sifting the bin with a headlamp is weirdly zen after a long day.

If you’re curious about the setup and what to feed or avoid, you can read about vermicomposting. That walkthrough is what got me going.
9
General ElkArte discussions / Re: How to integrate ElkArte and fail2ban?
Last post by Spuds -
There is a good overall blocker that you can set up for either Apache or Nginx available here. https://github.com/mitchellkrogza its really good if you have a general problem with you sites getting hammered.

If you just want to trigger fail2ban based off the Elkarte login page getting hit, then (untested) you would do

1) find where you server is saves its access log, example /var/log/nginx/access.log
2) in that log you should see the submit page for the login /index.php?action=login2 if its getting hit you will see that with the same ip address over and over
3) create a f2b filter /etc/fail2ban/filter.d/elkarte-login-abuse.conf with the following
Code: [Select]
[Definition]
failregex = <HOST> -.*"(GET|POST) /index.php\?action=login2.* HTTP/.*"
ignoreregex =
4) add the above to your fail2ban jail jail.local
Code: [Select]
[elkarte-login-abuse]
enabled = true
port = http,https
filter = elkarte-login-abuse
logpath = /var/log/nginx/access.log
maxretry = 4
findtime = 300
bantime = 86400
action = iptables[name=elkarte-login-abuse, port=http, protocol=tcp]
maxretry: 4 requests in
findtime: 300 seconds (5 minutes) triggers the ban.
bantime: 86400 seconds (24 hours). ban time

adjust to your liking
5) restart fail2ban sudo systemctl restart fail2ban
10
General ElkArte discussions / How to integrate ElkArte and fail2ban?
Last post by hannaconner -
Hi, are there anyone that tried to integrate ElkArte and fail2ban? I want to prevent someone bruteforcing the login page. While the forum will ban multiple failed login but it still get processed by php. I want to take it further that the bot is blocked at network level, so it doesn't affect performance badly. yesterday my wordpress blog login page got hammered, and i must disabled php-fpm to access my vps.