Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #192483 > unrolled thread

wiki

Back to article view | Back to linux.debian.user

Contents

  wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-16 03:10 +0100
    Re: wiki Andy Smith <andy@strugglers.net> - 2018-02-16 05:30 +0100
    Re: wiki rhkramer@gmail.com - 2018-02-16 12:50 +0100
      Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-16 13:10 +0100
        Re: wiki Richard Owlett <rowlett@cloud85.net> - 2018-02-16 14:10 +0100
        Re: wiki Greg Wooledge <wooledg@eeg.ccf.org> - 2018-02-16 16:40 +0100
          Re: wiki Gene Heskett <gheskett@shentel.net> - 2018-02-16 17:30 +0100
          Re: wiki Andy Smith <andy@strugglers.net> - 2018-02-16 18:00 +0100
            Re: wiki Brian <ad44@cityscape.co.uk> - 2018-02-16 19:00 +0100
          Re: wiki Reco <recoverym4n@gmail.com> - 2018-02-16 18:00 +0100
            Re: wiki Gene Heskett <gheskett@shentel.net> - 2018-02-16 18:10 +0100
            SSL inspection Jonathan de Boyne Pollard <J.deBoynePollard-newsgroups@NTLWorld.COM> - 2018-02-18 08:50 +0100
              Re: SSL inspection Reco <recoverym4n@gmail.com> - 2018-02-18 09:40 +0100
            Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-19 03:40 +0100
              Re: wiki Roberto C. Sánchez <roberto@debian.org> - 2018-02-19 03:50 +0100
                Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-19 06:50 +0100
              Re: wiki Reco <recoverym4n@gmail.com> - 2018-02-19 06:20 +0100
                Re: wiki Curt <curty@free.fr> - 2018-02-19 12:10 +0100
                  Re: wiki Reco <recoverym4n@gmail.com> - 2018-02-19 13:00 +0100
                Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-20 00:30 +0100
        Re: wiki Gene Heskett <gheskett@shentel.net> - 2018-02-16 16:40 +0100
    Suggest contacting wiki@debian.org - was [Re: wiki] Richard Owlett <rowlett@cloud85.net> - 2018-02-19 13:00 +0100
      Re: Suggest contacting wiki@debian.org - was [Re: wiki] Brian <ad44@cityscape.co.uk> - 2018-02-19 13:40 +0100
        Re: Suggest contacting wiki@debian.org - was [Re: wiki] Steve McIntyre <steve@einval.com> - 2018-02-19 14:30 +0100

Page 1 of 2  [1] 2  Next page →

#192483 — wiki

Why can't I access wikis from a Debian box:
Forbidden
<p>You are not allowed to access this!</p>
is the message I get.

[toc] | [next] | [standalone]

#192486

Hi Rodary,

On Fri, Feb 16, 2018 at 02:42:14AM +0100, Rodary Jacques wrote:
> Why can't I access wikis from a Debian box:
> Forbidden
> <p>You are not allowed to access this!</p>
> is the message I get.

On this list we enjoy a challenge and I'm afraid that trying every
version of every different browser in every release of Debian against
every wiki on the Internet to try to replicate or understand your
problem is too simple for us.

Can you please try again at a later date with a query that contains
less information about your issue, in order to make it more suitable
to us.

Thanks,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [next] | [standalone]

#192496

On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques wrote:
> Why can't I access wikis from a Debian box:
> Forbidden
> <p>You are not allowed to access this!</p>
> is the message I get.

I think we need more information--which wiki are you having trouble with?  
(What is its URL?)

Maybe you have to register and then login on that wiki.

[toc] | [prev] | [next] | [standalone]

#192498

Le vendredi 16 février 2018, 06:42:52 CET rhkramer@gmail.com a écrit :
> On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques wrote:
> > Why can't I access wikis from a Debian box:
> > Forbidden
> > <p>You are not allowed to access this!</p>
> > is the message I get.
> 
> I think we need more information--which wiki are you having trouble with?  
> (What is its URL?)
I first had this message on  https://wiki.debian.org, then on various problems.
> Maybe you have to register and then login on that wiki.
and I was never asked to register before you mention it. 
		Jacques 

[toc] | [prev] | [next] | [standalone]

#192501

On 02/16/2018 06:08 AM, Rodary Jacques wrote:
> Le vendredi 16 février 2018, 06:42:52 CET rhkramer@gmail.com a écrit :
>> On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques wrote:
>>> Why can't I access wikis from a Debian box:
>>> Forbidden
>>> <p>You are not allowed to access this!</p>
>>> is the message I get.
>>
>> I think we need more information--which wiki are you having trouble with?
>> (What is its URL?)
> I first had this message on  https://wiki.debian.org, then on various problems.
>> Maybe you have to register and then login on that wiki.
> and I was never asked to register before you mention it.
> 	

I checked, https://wiki.debian.org is up and it is not a site requiring 
a login to view.

The next set of questions:
   1. What browser are you using?
        Do have any extensions/add-ons/etc enabled?
        Does your browser have a "safe" mode that disables them?
   2. Do other sites work?
     (e.g. can you access your preferred search engine?)
   3. Are there other sites with problems? Which?
HTH

[toc] | [prev] | [next] | [standalone]

#192506

On Fri, Feb 16, 2018 at 10:30:31AM -0500, Gene Heskett wrote:
> On Friday 16 February 2018 07:08:57 Rodary Jacques wrote:
> 
> > Le vendredi 16 février 2018, 06:42:52 CET rhkramer@gmail.com a écrit :
> > > On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques wrote:
> > > > Why can't I access wikis from a Debian box:
> > > > Forbidden
> > > > <p>You are not allowed to access this!</p>
> > > > is the message I get.
> > >
> > > I think we need more information--which wiki are you having trouble
> > > with? (What is its URL?)
> >
> > I first had this message on  https://wiki.debian.org, then on various
> > problems.
> 
> Old but uptodate wheezy install here. firefox had no problems navigating 
> the site.
> Perhaps your http->S<- is defective somehow.

The original message was so incredibly vague that it could mean anything.

But.

If the actual complaint is "I get 403 Forbidden on https://wiki.debian.org"
then we need additional detail: what version of Debian the OP is using,
what browser, and any unusual aspects of the OP's network that could
be relevant (workplace firewall, China firewall, etc.).

There have been several similar complaints in #debian IRC over the last
year or two, with random people coming in and saying that they get a
"403 Forbidden" on the Debian wiki, but the one thing they all have in
common is a LACK OF DETAIL.

At this point nobody knows how to diagnose the problem, because nobody
who HAS the problem is willing or able to come forward and just say what
is happening and why.  Is it a DNS resolution error, in which they're
getting the wrong IP address?  Does the wiki or its front-end web server
have a firewall that blacklists certain IP address ranges?  Is it a
web browser bug?  Nobody knows!

[toc] | [prev] | [next] | [standalone]

#192512

On Friday 16 February 2018 10:38:49 Greg Wooledge wrote:

> On Fri, Feb 16, 2018 at 10:30:31AM -0500, Gene Heskett wrote:
> > On Friday 16 February 2018 07:08:57 Rodary Jacques wrote:
> > > Le vendredi 16 février 2018, 06:42:52 CET rhkramer@gmail.com a 
écrit :
> > > > On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques wrote:
> > > > > Why can't I access wikis from a Debian box:
> > > > > Forbidden
> > > > > <p>You are not allowed to access this!</p>
> > > > > is the message I get.
> > > >
> > > > I think we need more information--which wiki are you having
> > > > trouble with? (What is its URL?)
> > >
> > > I first had this message on  https://wiki.debian.org, then on
> > > various problems.
> >
> > Old but uptodate wheezy install here. firefox had no problems
> > navigating the site.
> > Perhaps your http->S<- is defective somehow.
>
> The original message was so incredibly vague that it could mean
> anything.
>
> But.
>
> If the actual complaint is "I get 403 Forbidden on
> https://wiki.debian.org" then we need additional detail: what version
> of Debian the OP is using, what browser, and any unusual aspects of
> the OP's network that could be relevant (workplace firewall, China
> firewall, etc.).
>
> There have been several similar complaints in #debian IRC over the
> last year or two, with random people coming in and saying that they
> get a "403 Forbidden" on the Debian wiki, but the one thing they all
> have in common is a LACK OF DETAIL.
>
> At this point nobody knows how to diagnose the problem, because nobody
> who HAS the problem is willing or able to come forward and just say
> what is happening and why.  Is it a DNS resolution error, in which
> they're getting the wrong IP address?  Does the wiki or its front-end
> web server have a firewall that blacklists certain IP address ranges? 
> Is it a web browser bug?  Nobody knows!

That also is spot on Greg. Which is why I specified my install in my 
comment, but failed to mention it is a 32 bit install. Thats linuxcnc 
driven because a context switch takes measurably longer on a 64 bit 
system.

The changeover to 64 bit is forceing some of us to spend upwards of 200 
dollars to offload some of linuxcnc's work to fpga cards because even 
the rtai patched kernels just aren't fast enough to generate in 
software, the steady step signals the stepper motors need.  Thats about 
how much I have in the 4 card stack driving an 11x36 Sheldon lathe from 
a raspberry pi-3b. But we still need IRQ responses in not less than 
millisecond times. So we patch kernels, and on real machinery, then pin 
them so the software updater cannot kill the machine. But I think that 
has been discussed here previously.

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#192515

Hello,

On Fri, Feb 16, 2018 at 10:38:49AM -0500, Greg Wooledge wrote:
> There have been several similar complaints in #debian IRC over the last
> year or two, with random people coming in and saying that they get a
> "403 Forbidden" on the Debian wiki, but the one thing they all have in
> common is a LACK OF DETAIL.

I seem to recall some comments made by someone in the know that
there is extensive IP-based blocking used on wiki.debian.org within
the web server and this sometimes causes collateral damage, i.e.
some people unable even to read the site, let alone modify it.
Unfortunately I can't remember any more details than that.

I was going to say that it could be worth OP's time to create a bug
against the wiki, and I already see this one:

    <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=885433>

I think this would tend to support the possibility of this being
the culprit, though the lack of resolution here does suggest the OP
may have a long road ahead if that is the case.

Cheers,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [next] | [standalone]

#192521

On Fri 16 Feb 2018 at 16:58:49 +0000, Andy Smith wrote:

> Hello,
> 
> On Fri, Feb 16, 2018 at 10:38:49AM -0500, Greg Wooledge wrote:
> > There have been several similar complaints in #debian IRC over the last
> > year or two, with random people coming in and saying that they get a
> > "403 Forbidden" on the Debian wiki, but the one thing they all have in
> > common is a LACK OF DETAIL.
> 
> I seem to recall some comments made by someone in the know that
> there is extensive IP-based blocking used on wiki.debian.org within
> the web server and this sometimes causes collateral damage, i.e.
> some people unable even to read the site, let alone modify it.
> Unfortunately I can't remember any more details than that.

IP-based blocking is most probably the cause. The reason for it is
to prevent the wiki being spammed and reducing its usefulness for all
users. 

> I was going to say that it could be worth OP's time to create a bug
> against the wiki, and I already see this one:
> 
>     <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=885433>
> 
> I think this would tend to support the possibility of this being
> the culprit, though the lack of resolution here does suggest the OP
> may have a long road ahead if that is the case.

No bug reports, please. The preferred way is to report the details of
the issue by mail to wiki@debian.org.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#192516

	Hi.

On Fri, Feb 16, 2018 at 10:38:49AM -0500, Greg Wooledge wrote:
> On Fri, Feb 16, 2018 at 10:30:31AM -0500, Gene Heskett wrote:
> > On Friday 16 February 2018 07:08:57 Rodary Jacques wrote:
> > 
> > > Le vendredi 16 février 2018, 06:42:52 CET rhkramer@gmail.com a écrit :
> > > > On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques wrote:
> > > > > Why can't I access wikis from a Debian box:
> > > > > Forbidden
> > > > > <p>You are not allowed to access this!</p>
> > > > > is the message I get.
> > > >
> > > > I think we need more information--which wiki are you having trouble
> > > > with? (What is its URL?)
> > >
> > > I first had this message on  https://wiki.debian.org, then on various
> > > problems.
> > 
> > Old but uptodate wheezy install here. firefox had no problems navigating 
> > the site.
> > Perhaps your http->S<- is defective somehow.
> 
> The original message was so incredibly vague that it could mean anything.
> 
> But.
> 
> If the actual complaint is "I get 403 Forbidden on https://wiki.debian.org"
> then we need additional detail: what version of Debian the OP is using,
> what browser, and any unusual aspects of the OP's network that could
> be relevant (workplace firewall, China firewall, etc.).

My crystal ball says that OP is using home connection, and no, these
details aren't needed. tcpdump/wireshark capture, combined with the SSL
session key - that's what needed.
Or someone from 11AS12322 willing to provide a temporary shell account.

E-mail headers say that e-mail came from 11AS12322 belonging to some
French provider:

Received: from ns.rodary.net (unknown [88.170.1.143])
        by smtp5-g21.free.fr (Postfix) with ESMTP id 154405FF27
        for <debian-user@lists.debian.org>; Fri, 16 Feb 2018 02:42:15 +0100 (CET)

With MUA which is uncommon in dull enterprise world:

User-Agent: KMail/5.2.3 (Linux/4.9.0-5-amd64; KDE/5.28.0; x86_64; ; )

I believe we can exclude such possibilities as China Great Firewall
(unless they installed it in France for some reason), or workplace SSL
Bump (else OP won't see HTTP 403).


> There have been several similar complaints in #debian IRC over the last
> year or two, with random people coming in and saying that they get a
> "403 Forbidden" on the Debian wiki, but the one thing they all have in
> common is a LACK OF DETAIL.

Whose who know they way around don't have such problems. Whose who don't
are unable to describe it. I see nothing unusual in this.

My suggestion to OP - try Tor, see if it works.


> At this point nobody knows how to diagnose the problem, because nobody
> who HAS the problem is willing or able to come forward and just say what
> is happening and why.  Is it a DNS resolution error, in which they're
> getting the wrong IP address?

No. Browsers do certificate validation, "wrong IP address" would be
possible if the third party somehow produced a valid certificate for
wiki.debian.org (you have to be a CA *or* the government to do this) and
faked a DNS record (that's easy part).

> Does the wiki or its front-end web server have a firewall that
> blacklists certain IP address ranges?

Even if it did, the firewall have not come into play.
Since the user saw HTTP 403 it means that HTTPS connection was
established successfully, and a front-end (or back-end) webserver gave
403 code, which was transferred to a user.

>  Is it a web browser bug?  Nobody knows!

Hardly. Of course OP could use some ancient toy browser that does not do
SNI, but wiki.debian.org provides a correct certificate even for
*those*. It's easy to check with (openssl does not use SNI unless you
ask for it):

openssl s_client -host wiki.debian.org -port 443

Reco

[toc] | [prev] | [next] | [standalone]

#192517

On Friday 16 February 2018 11:53:44 Reco wrote:

> 	Hi.
>
> On Fri, Feb 16, 2018 at 10:38:49AM -0500, Greg Wooledge wrote:
> > On Fri, Feb 16, 2018 at 10:30:31AM -0500, Gene Heskett wrote:
> > > On Friday 16 February 2018 07:08:57 Rodary Jacques wrote:
> > > > Le vendredi 16 février 2018, 06:42:52 CET rhkramer@gmail.com a 
écrit :
> > > > > On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques 
wrote:
> > > > > > Why can't I access wikis from a Debian box:
> > > > > > Forbidden
> > > > > > <p>You are not allowed to access this!</p>
> > > > > > is the message I get.
> > > > >
> > > > > I think we need more information--which wiki are you having
> > > > > trouble with? (What is its URL?)
> > > >
> > > > I first had this message on  https://wiki.debian.org, then on
> > > > various problems.
> > >
> > > Old but uptodate wheezy install here. firefox had no problems
> > > navigating the site.
> > > Perhaps your http->S<- is defective somehow.
> >
> > The original message was so incredibly vague that it could mean
> > anything.
> >
> > But.
> >
> > If the actual complaint is "I get 403 Forbidden on
> > https://wiki.debian.org" then we need additional detail: what
> > version of Debian the OP is using, what browser, and any unusual
> > aspects of the OP's network that could be relevant (workplace
> > firewall, China firewall, etc.).
>
> My crystal ball says that OP is using home connection, and no, these
> details aren't needed. tcpdump/wireshark capture, combined with the
> SSL session key - that's what needed.
> Or someone from 11AS12322 willing to provide a temporary shell
> account.
>
> E-mail headers say that e-mail came from 11AS12322 belonging to some
> French provider:
>
> Received: from ns.rodary.net (unknown [88.170.1.143])
>         by smtp5-g21.free.fr (Postfix) with ESMTP id 154405FF27
>         for <debian-user@lists.debian.org>; Fri, 16 Feb 2018 02:42:15
> +0100 (CET)
>
> With MUA which is uncommon in dull enterprise world:
>
> User-Agent: KMail/5.2.3 (Linux/4.9.0-5-amd64; KDE/5.28.0; x86_64; ; )
>
> I believe we can exclude such possibilities as China Great Firewall
> (unless they installed it in France for some reason), or workplace SSL
> Bump (else OP won't see HTTP 403).
>
> > There have been several similar complaints in #debian IRC over the
> > last year or two, with random people coming in and saying that they
> > get a "403 Forbidden" on the Debian wiki, but the one thing they all
> > have in common is a LACK OF DETAIL.
>
> Whose who know they way around don't have such problems. Whose who
> don't are unable to describe it. I see nothing unusual in this.
>
> My suggestion to OP - try Tor, see if it works.
>
> > At this point nobody knows how to diagnose the problem, because
> > nobody who HAS the problem is willing or able to come forward and
> > just say what is happening and why.  Is it a DNS resolution error,
> > in which they're getting the wrong IP address?
>
> No. Browsers do certificate validation, "wrong IP address" would be
> possible if the third party somehow produced a valid certificate for
> wiki.debian.org (you have to be a CA *or* the government to do this)
> and faked a DNS record (that's easy part).
>
> > Does the wiki or its front-end web server have a firewall that
> > blacklists certain IP address ranges?
>
> Even if it did, the firewall have not come into play.
> Since the user saw HTTP 403 it means that HTTPS connection was
> established successfully, and a front-end (or back-end) webserver gave
> 403 code, which was transferred to a user.
>
> >  Is it a web browser bug?  Nobody knows!
>
> Hardly. Of course OP could use some ancient toy browser that does not
> do SNI, but wiki.debian.org provides a correct certificate even for
> *those*. It's easy to check with (openssl does not use SNI unless you
> ask for it):
>
> openssl s_client -host wiki.debian.org -port 443
>
> Reco

That is quite a verbose tool, thank you Reco for enlightening me.


-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#192609 — SSL inspection

[Multipart message — attachments visible in raw view] — view raw

Reco:

> Browsers do certificate validation, "wrong IP address" would be 
> possible if the third party somehow produced a valid certificate for 
> wiki.debian.org (you have to be a CA *or* the government to do this) 
> and faked a DNS record (that's easy part).
>
One can also do it if one is the person's employer and owns the machine 
that the employee is running, no DNS resource record modifications 
required, merely the employer as an additional root authority pushed out 
via group policy or suchlike and either custom proxy auto-configuration 
or transparent proxying at the borders.  This has been a known practice 
for many years, and there have been for that time a wide range of 
products sold to employers for specifically doing this.

* https://technet.microsoft.com/en-gb/library/ee658156.aspx

* http://cookbook.fortinet.com/why-you-should-use-ssl-inspection/

* https://securebox.comodo.com/ssl-sniffing/ssl-inspection/

* https://www.zscaler.com/products/ssl-inspection

* https://www.globalsign.com/en/blog/what-is-ssl-inspection/

... and so on.

[toc] | [prev] | [next] | [standalone]

#192611 — Re: SSL inspection

	Hi.

On Sun, Feb 18, 2018 at 07:30:06AM +0000, Jonathan de Boyne Pollard wrote:
> Reco:
> 
> > Browsers do certificate validation, "wrong IP address" would be possible
> > if the third party somehow produced a valid certificate for
> > wiki.debian.org (you have to be a CA *or* the government to do this) and
> > faked a DNS record (that's easy part).
> > 
> One can also do it if one is the person's employer and owns the machine that
> the employee is running, no DNS resource record modifications required,
> merely the employer as an additional root authority pushed out via group
> policy or suchlike and either custom proxy auto-configuration or transparent
> proxying at the borders.  This has been a known practice for many years, and
> there have been for that time a wide range of products sold to employers for
> specifically doing this.

It's true, and I'm familiar with the cases like this. But I find it
highly unlikely that this hypothetical employer allows using KDE (which
is used by OP) at a workplace.

Reco

[toc] | [prev] | [next] | [standalone]

#192632

Le vendredi 16 février 2018, 19:53:44 CET Reco a écrit :
> 	Hi.
> 
> On Fri, Feb 16, 2018 at 10:38:49AM -0500, Greg Wooledge wrote:
> > On Fri, Feb 16, 2018 at 10:30:31AM -0500, Gene Heskett wrote:
> > > On Friday 16 February 2018 07:08:57 Rodary Jacques wrote:
> > > 
> > > > Le vendredi 16 février 2018, 06:42:52 CET rhkramer@gmail.com a écrit :
> > > > > On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques wrote:
> > > > > > Why can't I access wikis from a Debian box:
> > > > > > Forbidden
> > > > > > <p>You are not allowed to access this!</p>
> > > > > > is the message I get.
> > > > >
> > > > > I think we need more information--which wiki are you having trouble
> > > > > with? (What is its URL?)
> > > >
> > > > I first had this message on  https://wiki.debian.org, then on various
> > > > problems.
> > > 
> > > Old but uptodate wheezy install here. firefox had no problems navigating 
> > > the site.
> > > Perhaps your http->S<- is defective somehow.
> > 
> > The original message was so incredibly vague that it could mean anything.
> > 
> > But.
> > 
> > If the actual complaint is "I get 403 Forbidden on https://wiki.debian.org"
> > then we need additional detail: what version of Debian the OP is using,
> > what browser, and any unusual aspects of the OP's network that could
> > be relevant (workplace firewall, China firewall, etc.).
> 
> My crystal ball says that OP is using home connection, and no, these
> details aren't needed. tcpdump/wireshark capture, combined with the SSL
> session key - that's what needed.
> Or someone from 11AS12322 willing to provide a temporary shell account.
> 
> E-mail headers say that e-mail came from 11AS12322 belonging to some
> French provider:
> 
> Received: from ns.rodary.net (unknown [88.170.1.143])
>         by smtp5-g21.free.fr (Postfix) with ESMTP id 154405FF27
>         for <debian-user@lists.debian.org>; Fri, 16 Feb 2018 02:42:15 +0100 (CET)
> 
> With MUA which is uncommon in dull enterprise world:
> 
> User-Agent: KMail/5.2.3 (Linux/4.9.0-5-amd64; KDE/5.28.0; x86_64; ; )
> 
> I believe we can exclude such possibilities as China Great Firewall
> (unless they installed it in France for some reason), or workplace SSL
> Bump (else OP won't see HTTP 403).
> 
> 
> > There have been several similar complaints in #debian IRC over the last
> > year or two, with random people coming in and saying that they get a
> > "403 Forbidden" on the Debian wiki, but the one thing they all have in
> > common is a LACK OF DETAIL.
> 
> Whose who know they way around don't have such problems. Whose who don't
> are unable to describe it. I see nothing unusual in this.
> 
> My suggestion to OP - try Tor, see if it works.
> 
> 
> > At this point nobody knows how to diagnose the problem, because nobody
> > who HAS the problem is willing or able to come forward and just say what
> > is happening and why.  Is it a DNS resolution error, in which they're
> > getting the wrong IP address?
> 
> No. Browsers do certificate validation, "wrong IP address" would be
> possible if the third party somehow produced a valid certificate for
> wiki.debian.org (you have to be a CA *or* the government to do this) and
> faked a DNS record (that's easy part).
> 
> > Does the wiki or its front-end web server have a firewall that
> > blacklists certain IP address ranges?
> 
> Even if it did, the firewall have not come into play.
> Since the user saw HTTP 403 it means that HTTPS connection was
> established successfully, and a front-end (or back-end) webserver gave
> 403 code, which was transferred to a user.
> 
> >  Is it a web browser bug?  Nobody knows!
I was using Opera  browser,so quick,  but I just tried with firefox, so slow, but both mozilla, and the result is the same when google search ( which I don't use with  Opera)  gives me a lot of choices , all with 403 result. My  public IP, 88.170.1.143 is the one my provider ( free.fr=proxad.fr)  gave me.
> 
> Hardly. Of course OP could use some ancient toy browser that does not do
> SNI, 
what is  SNI?
> but wiki.debian.org provides a correct certificate even for
> *those*. It's easy to check with (openssl does not use SNI unless you
> ask for it):
> 
> openssl s_client -host wiki.debian.org -port 443
> 
> Reco
> 
Will my comments help?
	Jacques

[toc] | [prev] | [next] | [standalone]

#192634

On Mon, Feb 19, 2018 at 03:29:50AM +0100, Rodary Jacques wrote:
> what is  SNI?

https://en.wikipedia.org/wiki/Server_Name_Indication

Essentially, there was a time when you could not host more than one
HTTPS-enabled site per IP address and port combination. This was a
problem for virtual hosting configurations where the server name in the
request was used to decide what content to serve. SNI allows for
identifying the server associated with the request early in the
connection so that a matching SSL certificate can be used for the
connection. Or something along those lines.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]

#192638

Le dimanche 18 février 2018, 21:47:59 CET Roberto C. Sánchez a écrit :
> On Mon, Feb 19, 2018 at 03:29:50AM +0100, Rodary Jacques wrote:
> > what is  SNI?
> 
> https://en.wikipedia.org/wiki/Server_Name_Indication
> 
> Essentially, there was a time when you could not host more than one
> HTTPS-enabled site per IP address and port combination. This was a
> problem for virtual hosting configurations where the server name in the
> request was used to decide what content to serve. SNI allows for
> identifying the server associated with the request early in the
> connection so that a matching SSL certificate can be used for the
> connection. Or something along those lines.
> 
> Regards,
> 
> -Roberto
	Reading all your posts, I realized that I didn't allow NEW connections by https (port 443) or by ssh (port 22) in my iptables setup. So I did but nothing changed neither with Opera, nor with Firefox.
 	So no wiki for me!  :-(

[toc] | [prev] | [next] | [standalone]

#192637

	Hi.

On Mon, Feb 19, 2018 at 03:29:50AM +0100, Rodary Jacques wrote:
> > Even if it did, the firewall have not come into play.
> > Since the user saw HTTP 403 it means that HTTPS connection was
> > established successfully, and a front-end (or back-end) webserver gave
> > 403 code, which was transferred to a user.
> > 
> > >  Is it a web browser bug?  Nobody knows!
> I was using Opera  browser,so quick,  but I just tried with firefox, so slow, but both mozilla, and the result is the same when google search ( which I don't use with  Opera)  gives me a lot of choices , all with 403 result. My  public IP, 88.170.1.143 is the one my provider ( free.fr=proxad.fr)  gave me.

As I wrote earlier - try Tor.
It seems that your network subnet was banned at wiki.debian.org.

Reco

[toc] | [prev] | [next] | [standalone]

#192644

On 2018-02-19, Reco <recoverym4n@gmail.com> wrote:

>> > >  Is it a web browser bug?  Nobody knows!
>> I was using Opera  browser,so quick,  but I just tried with firefox, so slow, but both mozilla, and the result is the same when google search ( which I don't use with  Opera)  gives me a lot of choices , all with 403 result. My  public IP, 88.170.1.143 is the one my provider ( free.fr=proxad.fr)  gave me.
>
> As I wrote earlier - try Tor.
> It seems that your network subnet was banned at wiki.debian.org.

So the French are right: there is an international conspiracy against
them.

> Reco


-- 
New York was no mere city. It was instead an infinitely romantic notion, the
mysterious nexus of all love and money and power, the shining and the
perishable dream itself. To think of 'living' there was to reduce the
miraculous to the mundane; one does not 'live' at Xanadu. --Joan Didion

[toc] | [prev] | [next] | [standalone]

#192647

	Hi.

On Mon, Feb 19, 2018 at 10:42:59AM +0000, Curt wrote:
> On 2018-02-19, Reco <recoverym4n@gmail.com> wrote:
> 
> >> > >  Is it a web browser bug?  Nobody knows!
> >> I was using Opera  browser,so quick,  but I just tried with firefox, so slow, but both mozilla, and the result is the same when google search ( which I don't use with  Opera)  gives me a lot of choices , all with 403 result. My  public IP, 88.170.1.143 is the one my provider ( free.fr=proxad.fr)  gave me.
> >
> > As I wrote earlier - try Tor.
> > It seems that your network subnet was banned at wiki.debian.org.
> 
> So the French are right: there is an international conspiracy against
> them.

No, you got it wrong. There's an international conspiracy against wget,
and the existance of conspiracy was proven in France ☺.

Reco

[toc] | [prev] | [next] | [standalone]

#192736

Le lundi 19 février 2018, 08:12:57 CET Reco a écrit :
> 	Hi.
> 
> On Mon, Feb 19, 2018 at 03:29:50AM +0100, Rodary Jacques wrote:
> > > Even if it did, the firewall have not come into play.
> > > Since the user saw HTTP 403 it means that HTTPS connection was
> > > established successfully, and a front-end (or back-end) webserver gave
> > > 403 code, which was transferred to a user.
> > > 
> > > >  Is it a web browser bug?  Nobody knows!
> > I was using Opera  browser,so quick,  but I just tried with firefox, so slow, but both mozilla, and the result is the same when google search ( which I don't use with  Opera)  gives me a lot of choices , all with 403 result. My  public IP, 88.170.1.143 is the one my provider ( free.fr=proxad.fr)  gave me.
> 
> As I wrote earlier - try Tor.
> It seems that your network subnet was banned at wiki.debian.org.
> 
> Reco
 	I finally dared to install Tor an it works! So I will use wiki t o understand why the  "reply to" link in the list doesn't copy the subject 'Re.;Re: < suject> in Kmail, as it did in Jessie without any setup by me. 
	Thank you all  for your time.
		Jacques 

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user

csiph-web