“How many matching login failures should it take until the plugin stops delaying responses (to avoid a Denial of Service problem)?” sounds to me like the brute-force protection is dropped as soon as the attack continues long enough to place > 500 fails. However I can not believe that this is what you mean. If delaying is stopped, does any other protection come into place instead?

Also, how are distributed attacs treated?
The current attac against my WP uses many different IP adresses, most of them only once (as reported by LSS), the only common thing is the userneme. Does that mean, the attempts are not classified as matching?

This Attac is carrying on since a couple of days now.
Will protection be droped once 500 attempts are reached?

Cheers – Heiko *concearned*

https://www.ads-software.com/plugins/login-security-solution/

I have a cluster of Raspberry Pi’s and BeagleBone Blacks load balancing my website using nginx. The LB works perfectly well. Problem is, if I log into https://www.beagle-pi.com/wp-admin and add a new post and upload an image to it, only the node that I’ve landed on is going to get that image. I have a couple options in my mind:

1) Setup the load balancer to not load balance https://www.beagle-pi.com/wp-admin requests and land on one node all the time for that URL. I can then make posts/upload content from there and run a scheduled rsync task to push out the changes from /var/www/html/wp-content/uploads/… to the other nodes. Problem with this is that the content will be out of sync until that task completes. So, I either need to schedule the task frequently or deal with content issues.

2) Glusterfs – I tried to run a gluster clustered file system. It worked well, but the Raspi’s are too slow to utilize it and it made loading sites a bit slow.

3) NFS share as the content location that all web front ends load from. Tried this, and again, now the hops for https://www.beagle-pi.com are firewall, load balancer, node, NAS, and back out. Its a bit lame.

Any thoughts on how to sync content between load balanced front end servers? MySQL is running on another cluster and does not slow down this processes since it is off-loaded. Are there any plugins within WordPress that detect new content and copy out?

Thanks guys!

I have a cluster of Raspberry Pi’s and BeagleBone Blacks load balancing my website using nginx. The LB works perfectly well. Problem is, if I log into www.beagle-pi.com/wp-admin and add a new post and upload an image to it, only the node that I’ve landed on is going to get that image. I have a couple options in my mind:

1) Setup the load balancer to not load balance www.beagle-pi.com/wp-admin requests and land on one node all the time for that URL. I can then make posts/upload content from there and run a scheduled rsync task to push out the changes from /var/www/html/wp-content/uploads/… to the other nodes. Problem with this is that the content will be out of sync until that task completes. So, I either need to schedule the task frequently or deal with content issues.

2) Glusterfs – I tried to run a gluster clustered file system. It worked well, but the Raspi’s are too slow to utilize it and it made loading sites a bit slow.

3) NFS share as the content location that all web front ends load from. Tried this, and again, now the hops for www.beagle-pi.com are firewall, load balancer, node, NAS, and back out. Its a bit lame.

Any thoughts on how to sync content between load balanced front end servers? MySQL is running on another cluster and does not slow down this processes since it is off-loaded. Are there any plugins within WordPress that detect new content and copy out?

Thanks guys!

Yesterday, we got around a thousand hits each on the same, non-existant usernames, but they all came from different IP addresses. Needless to say, my inbox got very full very fast.

Unfortunately, this had a DDOS-type effect in that it stressed our cheap shared-hosting setup, slowing our site to a crawl. To quickly mitigate this, I modified the plugin with an array of blocked users and modified the is_login_fail_exact_match() to check against it and always return TRUE on match.

This wasn’t enough to ease the server load, so I moved the check into the authenticate() function and simply died if there was a match. That worked.

I realize this is hardly ideal. I know we don’t want to let them know we are reacting to the attack, and I would much rather have a record of the attack. But this worked in a pinch.

My request is for an option to ignore IP address for a list of usernames, or always for non-existant users, and to somehow get them back to the login screen with as few resources as possible.

Thanks again for the plugin.

https://www.ads-software.com/extend/plugins/login-security-solution/

The problem at hand is having file uploads work correctly. If you’re accessing blogdomain.com directlly, there’ s no gaurantee you’re on the main server, which you need for your uploaded file to get correctly replicated to the rest of the servers

I was able to override some WP functions that would allow for a custom administration area URL, so one accessing https://admin.blogdomain.com is gauranteed to be hitting the proper admin server.

Currently, the way the file-upload system works is that it in upload-functions.php there are multiple redirects and one form which relies on get_option(‘siteurl’) — this subverts the whole point of the admin-specific URL, and it ends up uploading stuff to an arbitrary server.

The question is: is there a more elegant solution outside of removing any calls to get_option(‘siteurl’) in /wp-admin/upload-functions.php that I can use to make sure the file uploads go to the right place?

Im looking for the ebook

Distributed Operating Systems
Author: Pradeep K. Sinha
Publisher: IEEE Computer Society
ISBN: 0780311191
Publication Year: 1996

I would be grateful if you can help me.

Thank You

I would like to know whether or not WordPress would still function correctly if I installed it on two different Apache servers and pointed both to the same database perhaps on a third machine.

It seems to me like there shouldn’t be any problems. But I would also like to use the staticize reloaded plugin (wp-cache 2.0 comes up with an error on the options menu). So how does a cache pluggin affect this scenario? Would I have to make the cache folder available to both using an NFS or something similar?

Thanks for your comments!