Someone else launched a cc attack on the forum interface

cnzhou112

Someone else launched a cc attack on the forum interface, causing the site to be shut down. How to stop requesting website interface

/api/discussions?include=user%2ClastPostedUser%2Ctags%2Ctags.parent%2CfirstPost&sort&page%5Boffset%5D=0

/api/discussions?filter%5Bq%5D=photos&page%5Blimit%5D=3&include=mostRelevantPost

Wadera

The easiest way is: https://www.cloudflare.com/
Or if you own a server you can play with configuration for: https://www.fail2ban.org/wiki/index.php/Main_Page

Alternatively if you are using shared-hosting - you can ask them for help.

murdocklawless

Wadera fail2ban does not work, because there are no logs about failed logins.

luceos

murdocklawless you can make fail2ban listen to the access log and check the number of hits per second right?

murdocklawless

luceos fail2ban is taking actions only by logs as I know. So if there is no log, there is no action.

luceos

murdocklawless only by logs

luceos listen to the access log

? 😂

murdocklawless

luceos I'm saying flarum is not loging failed logins. Fail2ban needs that logs.

murdocklawless So if there is no log, there is no action.

luceos

First of all OP does not talk about log in attempts, but of abusing an endpoint that makes perfect sense to hit as an application.

Now according to the fail2ban documentation Jail Options you can configure:

the logpath to point to the access log
a filter to match against the route given
numretries how often someone is allowed to hit that endpoint without getting banned
a bantime

So according to that this could work (https://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Jail_Options).

However Flarum also supports throttling, which might even be applied to the route. I'd have to look into it further to provide a decent answer to that: https://docs.flarum.org/extend/api-throttling

murdocklawless

luceos fail2ban provides some apache and nginx rules by default. Maybe activating some of them help.