MyBB Community Forums

hi , I made test finnaly with the last version of mybb is a Great job some change and is same to be more powerful and fast to load maybe is just me during a fresh install but , i would like to know when a Member copy the url

http://Example.com

is made Member coming on the index.php page and they have the message

You are either not logged in or do not have permission to view this page etc etc ...

1:
2:
3:
4:

and is offer to Login or register

But if we want to protect more the board for Who received ddos attack And i speak not For me for the moment But Is Change Nothing.. i am here to Received help .. But Certain member received ddos i see that in thread and post and on duckduckgo.com !

For counter ddos we Can use Nginx and reduce the rate speed per second and ip

example with a command line

reducerate per second to 2 request per second to that

/index,php


and Is reduce the rate to the index.php page but the problem with that is if we reduce the rate of the index.php page is reduce the user on the board the speed is possible to just Block access to the user to not access to that page without any message ? like a redirection to the login page at now

member.php?action=login

because for the moment with the last version for login is with that link


example.com/member.php?action=login

,,

Is possible when user go in the link example.com the arrived in the login page Automatically ?

is possible if user are not loged to block Completely access to the page like made An 404 error page if they try to access to the Index.php .. we need i think to secure more that page..

Thanks to understand That Request is for the Last version of mybb and is for make The Board More secure.. wish you Understand.


*note , I have try before in nginx config file of the server in Sites-available and Sites-enabled to put in the index index.html index.php;

i have try to change for only member.php?action=login

but after a restart is continue to Put the member at the index.php

I think you don't really know what a DDoS attack is.
A DDoS attack doesn't need to access a real page on your host, it just has to query your server. If you server get the query, it will answer (even with an error, but it will answer). The mind is to overload the server capabilities, flooding maximum of resources.

Nginx settings is a way to limit the attack via http ports, but you can be attacked via other ports as ssh, smtp, dns... and any port which is listening.

i dont know 100 % what is is sure i am new lets me know if i am wrong thanks you for the information but

the default port we can change it to 22 and ssh to 22 i think is more secured and we can use Firejail and ufw to protect more the server for smtp I dont know but I think is disabled by default in nginx ? and with mybb we dont need to use (because i dont use mail system ) i think is for mail system ? for the dns is another problem but the only way to secure the dns is to use a Private Vpn like one member as explained to me vpn created by me not a public vpn ..?

With nginx we can put to max of we can with the server config and the vps like if is a 8 go ram we can put the upper the how many request can be made and how many page can be open i think is named worker connection ? is explained on nginx how to Put your server to max is called Optimization and Hardening..

is not fault The index page is one Thing and is not the most important i understand

Stop focusing nginx and web.
What i said is that if a port is open on your server, and some ports are open, DDoS is possible.
You have a webserver so attackers can do request of ports 80 and 443, regardless the webserver is serving a page or an error.

Using nmap (or any port analyser), a potential attacker can do request (telnet your.ip port) and your server will answer. Your network adapter and/or the process listening the ports can be overloaded.

The nginx settings allows you to limit (well, try to limit) a kind of attack (on nginx ports) but it's not the solution.

And why thinking about DDoS attacks when your site is not accessible ? Have you ennemies ?
I have several websites on my own servers, I never had any DDoS attack. I've some SQL injection tries, some SSH tries, but DDoS, never.

(2020-07-20, 10:43 AM)Crazycat Wrote: [ -> ]Stop focusing nginx and web.
What i said is that if a port is open on your server, and some ports are open, DDoS is possible.
You have a webserver so attackers can do request of ports 80 and 443, regardless the webserver is serving a page or an error.

Using nmap (or any port analyser), a potential attacker can do request (telnet your.ip port) and your server will answer. Your network adapter and/or the process listening the ports can be overloaded.

The nginx settings allows you to limit (well, try to limit) a kind of attack (on nginx ports) but it's not the solution.

And why thinking about DDoS attacks when your site is not accessible ? Have you ennemies ?
I have several websites on my own servers, I never had any DDoS attack. I've some SQL injection tries, some SSH tries, but DDoS, never.

okais i understand more what you mean You say is not the solution again please What you recomend to me For the port ? if you say they can use a scanner like Curl or other they can scan and find the port is not false

and For the moment lol no i dont have enemie i am new about past -less 2 week here but I dont wanna be attacked by troll and i understand about your sql attack etc Every website probably received 1 x an attack why just for the fun of the hacker or for domage the website or server or for Ask for money and they stop the attack etc .. i am maybe too paranoid but i think we need all to secure our server i dont wanna work on a forum to Host and pay for that and after all config and learn is be easy destroyed by a troll ..

some member recommend me some Tricks to help for the security but is not Enoff

Stop worrying about attacks.

You can restrict SSH and FTP ports to your own IP (take care, add it in fail2ban whitelist), and run your website with another user than root (settings in php-fpm pools and nginx.conf), well configure your jails in fail2ban and don't install anything "just for a try".

(2020-07-20, 11:22 AM)Crazycat Wrote: [ -> ]Stop worrying about attacks.

You can restrict SSH and FTP ports to your own IP (take care, add it in fail2ban whitelist), and run your website with another user than root (settings in php-fpm pools and nginx.conf), well configure your jails in fail2ban and don't install anything "just for a try".

Crazycat That is a good recommend Thanks again

perfect

I'll just put out there that you don't need external access to anything other than 80 (HTTP), 443 (HTTPS), and 22 (SSH).

And if you've got a console you can get away with not having 22 (SSH) open. 22 (SSH) should not be open to the world anyway, unless you've got a firewall blocking 22 inbound.

Linux creates a local loopback interface for all your locally hosted stuff, MySQL, PHP-FPM, etc. - so blocking external access isn't an issue. Ideally you'd set the interface up to drop incoming packets.

(2020-07-20, 11:16 PM)s3_gunzel Wrote: [ -> ]I'll just put out there that you don't need external access to anything other than 80 (HTTP), 443 (HTTPS), and 22 (SSH).

And if you've got a console you can get away with not having 22 (SSH) open. 22 (SSH) should not be open to the world anyway, unless you've got a firewall blocking 22 inbound.

Linux creates a local loopback interface for all your locally hosted stuff, MySQL, PHP-FPM, etc. - so blocking external access isn't an issue. Ideally you'd set the interface up to drop incoming packets.

Thanks you . If i put it on a host Vps and i want control the Vps Over ssh and PRobably Kdp if is the good word (like Vnc) .. Does i need to Block incoming trafic on port 22 and all other port and Only allow Outgoing Trafic ?

if i block incoming trafic is probably block ssh in the next login connection

I think i need to see a lot of tutorial on internet I know here Some member say to may i dont need to config nginx or I dont need to protect6 my self more than is normal config but I want to secure all I make a lot of search hole the day and i continue in the next 10 hours to config all

(2020-07-21, 01:34 AM)malcom5322 Wrote: [ -> ]Thanks you . If i put it on a host Vps and i want control the Vps Over ssh and PRobably Kdp if is the good word (like Vnc) .. Does i need to Block incoming trafic on port 22 and all other port and Only allow Outgoing Trafic ?

Don't use VNC. You're not installing a desktop. And if you are, you really shouldn't be. Waste of resources.

(2020-07-21, 01:34 AM)malcom5322 Wrote: [ -> ]if i block incoming trafic is probably block ssh in the next login connection

Read what I said again: Don't block 22 (SSH) unless you've got access to a console. If you've got access to a console and are particularly worried about an SSH attack, just use the console.

(2020-07-21, 01:34 AM)malcom5322 Wrote: [ -> ]I think i need to see a lot of tutorial on internet I know here Some member say to may i dont need to config nginx or I dont need to protect6 my self more than is normal config but I want to secure all I make a lot of search hole the day and i continue in the next 10 hours to config all

You do need to do more research; a lot more research.