Lockouts (R-752): decisions 58-60 (decided by CC unattended), the one address behind the tunnel (R-753), the registry answered (R-750); STATUS, report, evidence
gates / gates (push) Successful in 27s
gates / gates (push) Successful in 27s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
@@ -1,3 +1,4 @@
|
||||
# drill 2026-10-01T09:47:56Z
|
||||
drill a4597cd live 8363635
|
||||
2e9514d DRILL wger: axes by username, 15 min, database handler (R-752 proof on 9202)
|
||||
2026-10-01T10:31:39Z drill: 6b0520e DRILL wger: cool-off 5 min (R-752 proof)
|
||||
|
||||
@@ -23,3 +23,18 @@ python3 manage.py runserver 0.0.0.0:8000
|
||||
09:50:26 household — admin RIGHT password: locked | second member RIGHT password: ok
|
||||
09:58:26 +8.0 min admin RIGHT password DURING the lock (does it restart the 15 min?): locked
|
||||
09:58:26 second member, same moment: ok
|
||||
10:06:26 +16.0 min admin RIGHT password: locked
|
||||
10:14:27 +24.0 min admin RIGHT password: locked
|
||||
10:22:27 +32.0 min admin RIGHT password: locked
|
||||
10:30:27 +40.0 min admin RIGHT password: locked
|
||||
10:30:27 a wrong one after: locked | right again: locked
|
||||
10:30:31 level=WARNING ts=2026-10-01 12:30:27,488 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=223 message=AXES: Repeated login failure by {username: "********************", i
|
||||
level=WARNING ts=2026-10-01 12:30:27,498 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=253 message=AXES: Locking out {username: "********************", ip_address: "**
|
||||
level=INFO ts=2026-10-01 12:30:27,662 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=130 message=AXES: User login failed, running database handler for failure.
|
||||
level=INFO ts=2026-10-01 12:30:27,662 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=425 message=AXES: Cleaned up 0 expired access attempts from database that were olde
|
||||
level=WARNING ts=2026-10-01 12:30:27,665 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=223 message=AXES: Repeated login failure by {username: "********************", i
|
||||
level=WARNING ts=2026-10-01 12:30:27,673 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=253 message=AXES: Locking out {username: "********************", ip_address: "**
|
||||
12:30:41 [X] stop -> 200 {'ok': True, 'message': 'Stack wger stop completed'}
|
||||
12:31:13 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'wger', 'volumes_removed': ['wger_wger_data', 'wger_wger_media'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note
|
||||
12:31:21 [X] after remove: deployed=False leftovers='/opt/docker/stacks/wger'
|
||||
10:31:21 removed; deployed = False
|
||||
|
||||
@@ -0,0 +1,37 @@
|
||||
10:31:42 ##### wger fix — controller gitea.dooplex.hu/admin/felhom-controller:0.285.0
|
||||
10:31:53 the box's catalog copy: - AXES_LOCKOUT_PARAMETERS=username
|
||||
12:31:53 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['ADMIN_PASSWORD']
|
||||
12:31:53 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
12:33:28 [1] deployed, controller state=running, pinned={'wger': 'wger/server:2.7'}
|
||||
10:33:28 deploy: True
|
||||
10:33:41 axes settings inside the app: ['username'] 10 0:05:00 True axes.handlers.database.AxesDatabaseHandler django.core.cache.backends.locmem.LocMemCache
|
||||
python3 manage.py runserver 0.0.0.0:8000
|
||||
/usr/bin/python3 manage.py runserver 0.0.0.0:8000
|
||||
10:33:46 second member: made second
|
||||
10:33:46 positive controls — admin: ok | second: ok
|
||||
10:33:47 stranger wrong try 1 (admin): wrong
|
||||
10:33:47 stranger wrong try 2 (admin): wrong
|
||||
10:33:47 stranger wrong try 3 (admin): wrong
|
||||
10:33:48 stranger wrong try 4 (admin): wrong
|
||||
10:33:48 stranger wrong try 5 (admin): wrong
|
||||
10:33:48 stranger wrong try 6 (admin): wrong
|
||||
10:33:49 stranger wrong try 7 (admin): wrong
|
||||
10:33:49 stranger wrong try 8 (admin): wrong
|
||||
10:33:49 stranger wrong try 9 (admin): wrong
|
||||
10:33:50 stranger wrong try 10 (admin): locked
|
||||
10:33:50 stranger wrong try 11 (admin): locked
|
||||
10:33:50 household — admin RIGHT password: locked | second member RIGHT password: ok
|
||||
10:35:50 +2.0 min admin RIGHT password DURING the lock (does it restart the cool-off?): locked
|
||||
10:35:51 second member, same moment: ok
|
||||
10:41:21 +7.5 min admin RIGHT password: ok
|
||||
10:41:22 a wrong one after: wrong | right again: ok
|
||||
10:41:25 level=INFO ts=2026-10-01 12:41:21,471 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=425 message=AXES: Cleaned up 1 expired access attempts from database that were olde
|
||||
level=INFO ts=2026-10-01 12:41:21,819 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=130 message=AXES: User login failed, running database handler for failure.
|
||||
level=INFO ts=2026-10-01 12:41:21,820 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=425 message=AXES: Cleaned up 0 expired access attempts from database that were olde
|
||||
level=WARNING ts=2026-10-01 12:41:21,822 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=201 message=AXES: New login failure by {username: "********************", ip_add
|
||||
level=INFO ts=2026-10-01 12:41:22,053 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=295 message=AXES: Successful login by {username: "********************", ip_address
|
||||
level=INFO ts=2026-10-01 12:41:22,054 module=database path=/home/wger/.local/lib/python3.12/site-packages/axes/handlers/database.py line=425 message=AXES: Cleaned up 0 expired access attempts from database that were olde
|
||||
12:41:35 [X] stop -> 200 {'ok': True, 'message': 'Stack wger stop completed'}
|
||||
12:42:07 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'wger', 'volumes_removed': ['wger_wger_data', 'wger_wger_media'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note
|
||||
12:42:15 [X] after remove: deployed=False leftovers='/opt/docker/stacks/wger'
|
||||
10:42:15 removed; deployed = False
|
||||
@@ -0,0 +1,14 @@
|
||||
12:42:24 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['ADMIN_PASSWORD']
|
||||
12:42:24 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
12:44:00 [1] deployed, controller state=running, pinned={'wger': 'wger/server:2.7'}
|
||||
10:44:00 deploy: True
|
||||
10:44:23 running env: AXES_COOLOFF_TIME=5 | container created 2026-10-01T10:42:53.627288276Z
|
||||
10:44:24 drill: ea94447 DRILL wger: cool-off 6 (installed-app probe)
|
||||
10:44:31 stack-dir compose after 7 s of sync rounds: - AXES_COOLOFF_TIME=6
|
||||
10:44:34 running env (no action yet): AXES_COOLOFF_TIME=5 | container created 2026-10-01T10:42:53.627288276Z
|
||||
10:44:45 press Restart: ('200', {'ok': True, 'data': {'state': 'starting'}, 'message': 'Stack wger restart requested — state now: starting'})
|
||||
10:45:18 running env after Restart: AXES_COOLOFF_TIME=6 | container created 2026-10-01T10:44:34.755369792Z
|
||||
12:45:29 [X] stop -> 200 {'ok': True, 'message': 'Stack wger stop completed'}
|
||||
12:46:01 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'wger', 'volumes_removed': ['wger_wger_data', 'wger_wger_media'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note
|
||||
12:46:09 [X] after remove: deployed=False leftovers='/opt/docker/stacks/wger'
|
||||
10:46:09 removed; deployed = False
|
||||
@@ -0,0 +1,15 @@
|
||||
# Strangers and lockouts (R-752), the one address behind the tunnel (R-753), the registry (R-750) — 2026-10-01 afternoon
|
||||
|
||||
Report and Part table: `felhom.eu/REPORT-lockouts-2026-10-01.md`.
|
||||
|
||||
| folder | what |
|
||||
|---|---|
|
||||
| `A/A1-client-address.txt` | demo-hp through its real tunnel (traefik + BookStack logs), 9202 echo container (tunnel hop simulated, LAN with forged headers), the answer table, why no box-wide fix |
|
||||
| `B/B1` | BookStack, Grafana (+ trickle), calibre-web (+ OPDS, + the daily limit, + restart) with the LIVE templates |
|
||||
| `B/B2a`, `B/B2` | wger control (B2a: a wrong login URL — 404 — kept as a record; B2: the real control) |
|
||||
| `B/B3` | the drill commits and 9202 pointed at the drill |
|
||||
| `B/B4`, `B/B5` | wger fix at 15 min (retries kept it closed 40+ min) and at 5 min (in at 7.5 min) |
|
||||
| `B/B6` | what an installed app gets: the stack file at sync, the running env only at Restart |
|
||||
| `C/C1-registry-read.txt` | Gitea read only: no cleanup rule, the database's first versions, the manual prune (HM-024), nothing scheduled |
|
||||
| `T/` | 9202 back on live, the drill reset |
|
||||
| `tools/` | `lk.py` (login probes), `b_three.py`, `b_wger.py`, `b_installed.py`, `echo.sh`, `walk.py`, `repoint.py` |
|
||||
@@ -0,0 +1,16 @@
|
||||
git:
|
||||
branch: main
|
||||
repo_url: https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
|
||||
sync_interval: 15m
|
||||
token: <redacted>
|
||||
username: ""
|
||||
hub:
|
||||
0
|
||||
|
||||
felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.285.0
|
||||
filebrowser gtstef/filebrowser:1.3.3-stable
|
||||
paperless-postgres postgres:18-alpine
|
||||
paperless-redis redis:7-alpine
|
||||
paperless-webserver ghcr.io/paperless-ngx/paperless-ngx:2.20.15
|
||||
traefik traefik:v3.6.7
|
||||
0
|
||||
@@ -0,0 +1,6 @@
|
||||
# drill reset 2026-10-01T10:47:28Z
|
||||
before: ea94447 live: 82fff32
|
||||
ea94447 DRILL wger: cool-off 6 (installed-app probe)
|
||||
6b0520e DRILL wger: cool-off 5 min (R-752 proof)
|
||||
2e9514d DRILL wger: axes by username, 15 min, database handler (R-752 proof on 9202)
|
||||
after: 82fff32
|
||||
@@ -0,0 +1,33 @@
|
||||
#!/usr/bin/env python3
|
||||
"""What an INSTALLED app gets when the catalog changes only a SETTING (R-752): wger installed from the drill
|
||||
(AXES_COOLOFF_TIME=5); then a drill-only commit sets 6; sync + rescan; read the stack-dir compose and the RUNNING
|
||||
container's env; press the app page's Restart (POST /api/stacks/wger/restart); read the env again. Removed after."""
|
||||
import subprocess, time
|
||||
import walk as w
|
||||
import lk
|
||||
|
||||
D = "/mnt/5_hdd/felhom.eu/drill/app-catalog-drill"
|
||||
ENV = "docker inspect wger --format '{{range .Config.Env}}{{println .}}{{end}}' | grep AXES_COOLOFF; docker inspect wger --format 'container created {{.Created}}'"
|
||||
FILE = "grep -h AXES_COOLOFF /opt/docker/stacks/wger/docker-compose.yml"
|
||||
w.login()
|
||||
lk.p("deploy:", w.deploy("wger", "fitness"))
|
||||
time.sleep(20)
|
||||
lk.p("running env:", w.guest(ENV).strip().replace("\n", " | "))
|
||||
r = subprocess.run(["bash", "-c", f"cd {D} && sed -i 's/^ - AXES_COOLOFF_TIME=5$/ - AXES_COOLOFF_TIME=6/' templates/wger/docker-compose.yml && "
|
||||
"git commit -qam 'DRILL wger: cool-off 6 (installed-app probe)' && git push -q origin main 2>&1 | grep -v ^remote; git log --oneline -1"],
|
||||
capture_output=True, text=True)
|
||||
lk.p("drill:", r.stdout.strip(), r.stderr.strip()[-200:])
|
||||
t0 = time.time()
|
||||
for _ in range(20):
|
||||
w.sync_rescan()
|
||||
f = w.guest(FILE).strip()
|
||||
if "=6" in f:
|
||||
break
|
||||
time.sleep(15)
|
||||
lk.p(f"stack-dir compose after {(time.time() - t0):.0f} s of sync rounds:", f)
|
||||
lk.p("running env (no action yet):", w.guest(ENV).strip().replace("\n", " | "))
|
||||
lk.p("press Restart:", w.ctl("POST", "/api/stacks/wger/restart"))
|
||||
time.sleep(30)
|
||||
lk.p("running env after Restart:", w.guest(ENV).strip().replace("\n", " | "))
|
||||
w.remove("wger")
|
||||
lk.p("removed; deployed =", w.stack("wger").get("deployed"))
|
||||
@@ -18,7 +18,7 @@ if MODE == "fix":
|
||||
for _ in range(12):
|
||||
w.sync_rescan()
|
||||
cat = w.guest("grep -rh AXES_LOCKOUT_PARAMETERS /var/lib/docker/volumes/felhom-controller-data/_data/ --include=docker-compose.yml 2>/dev/null | sort -u").strip()
|
||||
if "username" in cat:
|
||||
if "COOLOFF_TIME=5" in w.guest("grep -rh AXES_COOLOFF_TIME /var/lib/docker/volumes/felhom-controller-data/_data/ --include=docker-compose.yml 2>/dev/null"):
|
||||
break
|
||||
time.sleep(15)
|
||||
lk.p("the box's catalog copy:", cat)
|
||||
@@ -55,9 +55,10 @@ if MODE == "fix":
|
||||
r = lk.wger(who, p or pw)
|
||||
lk.p(f"+{(time.time() - t0) / 60:.1f} min {label}:", r)
|
||||
return r
|
||||
at(8, "admin RIGHT password DURING the lock (does it restart the 15 min?)")
|
||||
sched = [float(x) for x in (sys.argv[2].split(",") if len(sys.argv) > 2 else ["8", "16", "24", "32", "40"])]
|
||||
at(sched[0], "admin RIGHT password DURING the lock (does it restart the cool-off?)")
|
||||
lk.p("second member, same moment:", lk.wger("second", pw2))
|
||||
for m in (16, 24, 32, 40):
|
||||
for m in sched[1:]:
|
||||
if at(m, "admin RIGHT password") == "ok":
|
||||
break
|
||||
lk.p("a wrong one after:", lk.wger("admin", "wrong-after"), "| right again:", lk.wger("admin", pw))
|
||||
|
||||
Reference in New Issue
Block a user