Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #192632

Re: wiki

Show all headers | View raw

Le vendredi 16 février 2018, 19:53:44 CET Reco a écrit :
> 	Hi.
> 
> On Fri, Feb 16, 2018 at 10:38:49AM -0500, Greg Wooledge wrote:
> > On Fri, Feb 16, 2018 at 10:30:31AM -0500, Gene Heskett wrote:
> > > On Friday 16 February 2018 07:08:57 Rodary Jacques wrote:
> > > 
> > > > Le vendredi 16 février 2018, 06:42:52 CET rhkramer@gmail.com a écrit :
> > > > > On Thursday, February 15, 2018 08:42:14 PM Rodary Jacques wrote:
> > > > > > Why can't I access wikis from a Debian box:
> > > > > > Forbidden
> > > > > > <p>You are not allowed to access this!</p>
> > > > > > is the message I get.
> > > > >
> > > > > I think we need more information--which wiki are you having trouble
> > > > > with? (What is its URL?)
> > > >
> > > > I first had this message on  https://wiki.debian.org, then on various
> > > > problems.
> > > 
> > > Old but uptodate wheezy install here. firefox had no problems navigating 
> > > the site.
> > > Perhaps your http->S<- is defective somehow.
> > 
> > The original message was so incredibly vague that it could mean anything.
> > 
> > But.
> > 
> > If the actual complaint is "I get 403 Forbidden on https://wiki.debian.org"
> > then we need additional detail: what version of Debian the OP is using,
> > what browser, and any unusual aspects of the OP's network that could
> > be relevant (workplace firewall, China firewall, etc.).
> 
> My crystal ball says that OP is using home connection, and no, these
> details aren't needed. tcpdump/wireshark capture, combined with the SSL
> session key - that's what needed.
> Or someone from 11AS12322 willing to provide a temporary shell account.
> 
> E-mail headers say that e-mail came from 11AS12322 belonging to some
> French provider:
> 
> Received: from ns.rodary.net (unknown [88.170.1.143])
>         by smtp5-g21.free.fr (Postfix) with ESMTP id 154405FF27
>         for <debian-user@lists.debian.org>; Fri, 16 Feb 2018 02:42:15 +0100 (CET)
> 
> With MUA which is uncommon in dull enterprise world:
> 
> User-Agent: KMail/5.2.3 (Linux/4.9.0-5-amd64; KDE/5.28.0; x86_64; ; )
> 
> I believe we can exclude such possibilities as China Great Firewall
> (unless they installed it in France for some reason), or workplace SSL
> Bump (else OP won't see HTTP 403).
> 
> 
> > There have been several similar complaints in #debian IRC over the last
> > year or two, with random people coming in and saying that they get a
> > "403 Forbidden" on the Debian wiki, but the one thing they all have in
> > common is a LACK OF DETAIL.
> 
> Whose who know they way around don't have such problems. Whose who don't
> are unable to describe it. I see nothing unusual in this.
> 
> My suggestion to OP - try Tor, see if it works.
> 
> 
> > At this point nobody knows how to diagnose the problem, because nobody
> > who HAS the problem is willing or able to come forward and just say what
> > is happening and why.  Is it a DNS resolution error, in which they're
> > getting the wrong IP address?
> 
> No. Browsers do certificate validation, "wrong IP address" would be
> possible if the third party somehow produced a valid certificate for
> wiki.debian.org (you have to be a CA *or* the government to do this) and
> faked a DNS record (that's easy part).
> 
> > Does the wiki or its front-end web server have a firewall that
> > blacklists certain IP address ranges?
> 
> Even if it did, the firewall have not come into play.
> Since the user saw HTTP 403 it means that HTTPS connection was
> established successfully, and a front-end (or back-end) webserver gave
> 403 code, which was transferred to a user.
> 
> >  Is it a web browser bug?  Nobody knows!
I was using Opera  browser,so quick,  but I just tried with firefox, so slow, but both mozilla, and the result is the same when google search ( which I don't use with  Opera)  gives me a lot of choices , all with 403 result. My  public IP, 88.170.1.143 is the one my provider ( free.fr=proxad.fr)  gave me.
> 
> Hardly. Of course OP could use some ancient toy browser that does not do
> SNI, 
what is  SNI?
> but wiki.debian.org provides a correct certificate even for
> *those*. It's easy to check with (openssl does not use SNI unless you
> ask for it):
> 
> openssl s_client -host wiki.debian.org -port 443
> 
> Reco
> 
Will my comments help?
	Jacques

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-16 03:10 +0100
  Re: wiki Andy Smith <andy@strugglers.net> - 2018-02-16 05:30 +0100
  Re: wiki rhkramer@gmail.com - 2018-02-16 12:50 +0100
    Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-16 13:10 +0100
      Re: wiki Richard Owlett <rowlett@cloud85.net> - 2018-02-16 14:10 +0100
      Re: wiki Greg Wooledge <wooledg@eeg.ccf.org> - 2018-02-16 16:40 +0100
        Re: wiki Gene Heskett <gheskett@shentel.net> - 2018-02-16 17:30 +0100
        Re: wiki Andy Smith <andy@strugglers.net> - 2018-02-16 18:00 +0100
          Re: wiki Brian <ad44@cityscape.co.uk> - 2018-02-16 19:00 +0100
        Re: wiki Reco <recoverym4n@gmail.com> - 2018-02-16 18:00 +0100
          Re: wiki Gene Heskett <gheskett@shentel.net> - 2018-02-16 18:10 +0100
          SSL inspection Jonathan de Boyne Pollard <J.deBoynePollard-newsgroups@NTLWorld.COM> - 2018-02-18 08:50 +0100
            Re: SSL inspection Reco <recoverym4n@gmail.com> - 2018-02-18 09:40 +0100
          Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-19 03:40 +0100
            Re: wiki Roberto C. Sánchez <roberto@debian.org> - 2018-02-19 03:50 +0100
              Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-19 06:50 +0100
            Re: wiki Reco <recoverym4n@gmail.com> - 2018-02-19 06:20 +0100
              Re: wiki Curt <curty@free.fr> - 2018-02-19 12:10 +0100
                Re: wiki Reco <recoverym4n@gmail.com> - 2018-02-19 13:00 +0100
              Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-20 00:30 +0100
      Re: wiki Gene Heskett <gheskett@shentel.net> - 2018-02-16 16:40 +0100
  Suggest contacting wiki@debian.org - was [Re: wiki] Richard Owlett <rowlett@cloud85.net> - 2018-02-19 13:00 +0100
    Re: Suggest contacting wiki@debian.org - was [Re: wiki] Brian <ad44@cityscape.co.uk> - 2018-02-19 13:40 +0100
      Re: Suggest contacting wiki@debian.org - was [Re: wiki] Steve McIntyre <steve@einval.com> - 2018-02-19 14:30 +0100

csiph-web