Forbidden Access

Been getting denied access to one of my sites quite a lot recently. Couldn't get access via OTP either. Tried deleting the dynamic blacklist record but still happened. Eventually had to switch SCP off using phpmyadmin

Looking at the firewall logs this is the common entry:

User session protection :IP and User-agent have changed during an active session

Any ideas on why this is happening?

Hi Chris,

It's odd you couldn't get access using the OTP; does your user have the authenticator or yubikey enabled?

Regarding to what caused this, check the user session-protection feature. If the "elements to check in session hijack" is set to "IP or user-agent", you will be blocked if any of those settings change (for instance, if do you use two different browsers to access to the site with the same account). I recommend to set this value to "IP AND user-agent".

Regards,
Jose

Thanks Jose, that seems to have sorted the problem. Ended up turning off SCP and resetting my password in phpmyadmin. OTP always enabled.

Had tried using different browsers and a VPN to switch ips but might just have been making things worse!

I can access the site now without grief!

Glad to hear you're in again

Regards,
Jose