IIS throwing Event ID 1310 Exception message: Unsecured Passwords Format Detected

The Error Message

Exception information: Exception type: ConfigurationErrorsException Exception message: Unsecured Passwords Format Detected. The Membership Provider that contains the unsecure passwords format is: AspNetSqlMembershipProvider. The obsoleted password format is: Encrypted. For more information, see https://go.microsoft.com/fwlink/?linkid=834784.

Request information: Request URL: Request path: User host address: User: Is authenticated: False Authentication Type: Thread account name: IIS APPPOOL\DefaultAppPool

The Problem was actually simple and a “user error”

We tried to connect the website up to the wrong database. i.e. When we copied the database and moved it, we inadvertently copied the wrong database. This caused the above error due to the fact that the machinekey data in the web.config file was wrong for the database.

This caused the error 1310 to be thrown and the Application Pool associated with the new incorrectly setup site to stop.

The fix. 

Connect to the correct database!

Update

Further to this we encountered a really weird set of errors after this. Initially the error appears to be a connection issue. But then we started getting failings that would come an go.

Error logs showing plenty of Event ID 1310 but also in the DNN logs:

DotNetNuke.Services.Log.EventLog.DBLoggingProvider – System.Data.SqlClient.SqlException (0x80131904): Could not allocate space for object ‘dbo.EventLog’.’PK_EventLogMaster’ in database ‘bla’ because the ‘PRIMARY’ filegroup is full. Create disk space by deleting unneeded files, dropping objects in the filegroup, adding additional files to the filegroup, or setting autogrowth on for existing files in the filegroup.

   at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction)

   at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose)

   at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady)

   at System.Data.SqlClient.SqlDataReader.TryConsumeMetaData()

   at System.Data.SqlClient.SqlDataReader.get_MetaData()

   at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString, Boolean isInternal, Boolean forDescribeParameterEncryption)

   at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, Boolean inRetry, SqlDataReader ds, Boolean describeParameterEncryptionRequest)

   at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean& usedCache, Boolean asyncWrite, Boolean inRetry)

   at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method)

   at System.Data.SqlClient.SqlCommand.ExecuteScalar()

   at PetaPoco.Database.ExecuteScalar[T](String sql, Object[] args)

   at DotNetNuke.Data.PetaPoco.PetaPocoHelper.ExecuteScalar[T](String connectionString, CommandType type, String sql, Object[] args)

   at DotNetNuke.Data.SqlDataProvider.ExecuteScalar[T](String procedureName, Object[] commandParameters)

   at DotNetNuke.Data.DataProvider.AddLog(String logGUID, String logTypeKey, Int32 logUserID, String logUserName, Int32 logPortalID, String logPortalName, DateTime logCreateDate, String logServerName, String logProperties, Int32 logConfigID, ExceptionInfo exception, Boolean notificationActive)

   at DotNetNuke.Services.Log.EventLog.DBLoggingProvider.WriteLog(LogQueueItem logQueueItem)

ClientConnectionId:e495809e-60d5-44f2-b883-fe81fbe1126f

Error Number:1105,State:2,Class:17

The Problem

The issue turned out to be that the database was a legacy database we received from another host. They had defined a database limit size in the SQL database it’s self. This caused the database to strop responding to DNN in a way we had never seen. After some time, the maintenance would drop the size of the database just below the limit and the DNN site would fire up. Until it reached the SQL database limit again.

Not likely to be a problem for many people, but something to check in the SQL dates settings.

The fix update

Increase or remove the size of the SQL database limit.

Accessing your Google Analytic Data via API

To allow a third party module or application to view and display your Google Analytics data for your website. You need to get a few things organised.

1. You need to have a Google Analytic account with your website registered.

Go to: http://www.google.com/analytics/   and follow their instructions to set up your URL under an account that you can manage and access with Admin permissions. We are not going to go through these steps here as it is a given that you will have this. Seek help from Google if you can’t manage.

2. Set up an API for your Google Analytics Account at the Google Developers Portal.

Go to: https://developers.google.com/  and login with your account.

To get started using Google Analytics API, you need to first create or select a project in the Google Developers Console and enable the API. Using this link guides you through the process and activates the Google Analytics API automatically.

Alternatively, you can activate the Google Analytics API yourself in the Developers Console by doing the following:

1. Go to the Google Developers Console.
2. Select a project, or create a new one.
3. In the sidebar on the left, expand APIs & auth. Next, click APIs. Select the Enabled APIs link in the API section to see a list of all your enabled APIs. Make sure that the Google Analytics API is on the list of enabled APIs. If you have not enabled it, select the API from the list of APIs, then select the Enable API button for the API.
    
4. In the sidebar on the left, select Credentials.
    

In either case, you end up on the Credentials page and can create your project’s credentials from here.

Create a client ID

From the Credentials page, click Create new Client ID under the OAuth heading to create your OAuth 2.0 credentials.

1. For the APPLICATION TYPE select Service account.
2. Click Create Client ID.
3. For the KEY TYPE select P12 key. (The system will download a .P12 file. You will need this file to upload to the module)
4. A dialog box appears. To proceed, click Okay, got it.

3. Add service account to Google Analytics account

The newly created service account will have an email address, <projectId>-<uniqueId>@developer.gserviceaccount.com; Use this email address to add a user to the Google analytics account you want to access via the API. For this tutorial only Read & Analyzepermissions are needed.

Select User Management (in the Analytics Admin)

Enter the weird email address from the API credentials step above to give Read & Analyze permissions.

In Summary

1. You have created a Google Developer Account.
2. Created an API and Given Permission to “Analytics API”
3. You have Downloaded a P12 Credentials file.
4. You have Authorised the associated weird google email address from the P12 account to have read permissions on your Analytics Account.

If you get all that right, then the module we use, will work to access your Google Analytics data from within your module.

After Upgrading DNN 7 and browsing to the ADMIN>Site Settings you find an error: A critical error has occurred. Object reference not set to an instance of an object.

FileHelpers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=3e0c08d59cc3d657′

Error: File Management is currently unavailable. DotNetNuke.Services.Exceptions.ModuleLoadException: (0): error CS1705: Assembly ‘DotNetNuke.Modules.DigitalAssets, Version=7.1.1.385, Culture=neutral, PublicKeyToken=null’ uses ‘Telerik.Web.UI, Version=2013.2.611.40, Culture=neutral, PublicKeyToken=121fae78165ba3d4’ which has a higher version than referenced assembly ‘Telerik.Web.UI, Version=2013.1.403.40, Culture=neutral, PublicKeyToken=121fae78165ba3d4’ —> System.Web.HttpCompileException: (0): error CS1705: Assembly ‘DotNetNuke.Modules.DigitalAssets, Version=7.1.1.385, Culture=neutral, PublicKeyToken=null’ uses ‘Telerik.Web.UI, Version=2013.2.611.40, Culture=neutral, PublicKeyToken=121fae78165ba3d4’ which has a higher version than referenced assembly ‘Telerik.Web.UI, Version=2013.1.403.40, Culture=neutral, PublicKeyToken=121fae78165ba3d4’ at System.Web.Compilation.AssemblyBuilder.Compile() at System.Web.Compilation.BuildProvidersCompiler.PerformBuild() at System.Web.Compilation.BuildManager.CompileWebFile(VirtualPath virtualPath) at System.Web.Compilation.BuildManager.GetVPathBuildResultInternal(VirtualPath virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean throwIfNotFound, Boolean ensureIsUpToDate) at System.Web.Compilation.BuildManager.GetVPathBuildResultWithNoAssert(HttpContext context, VirtualPath virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean throwIfNotFound, Boolean ensureIsUpToDate) at System.Web.Compilation.BuildManager.GetVPathBuildResult(HttpContext context, VirtualPath virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean ensureIsUpToDate) at System.Web.UI.TemplateControl.LoadControl(VirtualPath virtualPath) at DotNetNuke.UI.Modules.WebFormsModuleControlFactory.CreateModuleControl(TemplateControl containerControl, ModuleInfo moduleConfiguration) at DotNetNuke.UI.Modules.ModuleControlFactory.LoadModuleControl(TemplateControl containerControl, ModuleInfo moduleConfiguration) at DotNetNuke.UI.Modules.ModuleHost.LoadModuleControl() — End of inner exception stack trace —

The problem

The problem relates to a missing file that can be updated to the website /bin folder. The file is part of a free library that can be found here: http://sourceforge.net/projects/filehelpers/files/File%20Helpers%20Downloads/Version%202.0.0/

The file you need is: FileHelpers.dll  front he 2.0 release from way back in 2010.

The Fix

Download the file directly here: https://www.dropbox.com/s/otusnlf1jmy9f6o/FileHelpers.dll?dl=0

Extract it into the /bin folder.

And save that to the /BIN folder in your DNN website, this will fix the issue and leave any third party modules that reference it working. 

DotNetNuke DNN Sites getting spam registrations – How to stop them

In recent weeks, many of our DNN websites have systematically been targeted for Spam New User Registrations. There has been some discussion around the how and why, and as much as we can tell, the problem is this:
1. Some script kiddy has bothered to write a bot that finds DNN websites. It is not even a good bot, because it is not capable of validating registrations to automated active email addresses. (If you are the creator of the bot… “YOU ARE DOING IT WRONG” as it is not going to bring the Google results you are looking for.)
2. The bot will attempt access to:  www.yoursite.com /?ctl=Register

3. This brings into play the default DNN registration process module.
4. This page is currently available if your site has either Public or Verified registrations enabled.
5. Tricks on derating the bot by raising the password complexity appeared to work a short time only.
6. Enabling the inbuilt Captcha is as good as useless, as almost any OCR application can break it.
7. A better simple solution is needed.
 

ReCaptcha is the FIX that is working well

Here at InteractiveWebs, we decided that we would enable Recapcha (a cleaver Google Initiative https://www.google.com/recaptcha/ ) that is harder to be machine broken, and test the results. We found that all the spam registrations stopped once Recaptcha was used.
To do this we created two Free DNN Modules to add Recaptcha to the URL that this bot is using to register on sites. The two modules are to support DNN 6.2 +  and 7x +.
The modules replace the standard captcha control to a recaptcha
From this:

To this:

This is a good link explaining how Recaptcha came into existence, and why it works well: https://www.youtube.com/watch?v=cQl6jUjFjp4

The Free Solution and Installing iWebs Regsiter

The free modules are available of download here: http://www.interactivewebs.com/DotNetNukeModules/ModuleDownloads.aspx
To install them and fix your site you will need to follow the instructions below:

Step 1 – Register your site for Recaptcah

Go to: https://www.google.com/recaptcha/intro/index.html  and register your domain, or domains. This will give you the ability to use recaptcha on your DNN sites on any domain you like.

Step 2 – Copy the Public Key and Private Key for your Domain

You are going to need they keys that this site provides:

Similar to these.
 

Step 3 – For you DNN site, Turn on the DNN Captcha system.

ADMIN>>SITE SETTINGS>> USER ACCOUNT SETTINGS>>  “Use CAPTCHA for registration” Ticked.

Step 4 – Download and Install iWebs – Register

Install our “iwebs- register” module, making sure you pick the one that is for your DNN version.

• DNN 6.2 And laters: iWebsRegister 62.6.3.0 PA.zip (at time of writing this)
• DNN 7 and later:  iWebsRegister 72.7.1.0 PA.zip (at time of writing this)

Once installed, you need to add the module to a page as you would any other. We recommend adding it to it’s own page in the DNN Admin menu, and keeping the page Admin Only.
 

Step 5 – Configure the iWebs Register Module.

The module you are looking for is called: iWeb’s – Register – You can select the Settings from the module drop down as you would any other DNN module.

 
Enter the Public Key and Private Keu information that you received from your Google Recaptcha registration of your domain. THEN SELECT UPDATE to save the information.

Step 6 – Install the Register Control

After saving your public and private keys by clicking “update” you are ready to:
Click on the “Install Register Control”
This will inject the recaptcha setting into your website. So when you hit any registration URL (www.yoursite.com /?ctl=Register) you now get the recaptcah box.

Update to V2 of Recaptcha

Google has released what they call V2 of Recaptcha. We have update the module to support this. The process of updating to V2 goes like this.
1. By default, previously created recaptcha keys are V1. Any updated installs of our module will need to be put into V1 mode (in the settings) to keep working with your V1 keys that you have previously configured into the module. So after updating our module to the latest release, go into the module settings and enable V1 mode for the module to keep working.
2. V2 recaptcha is better than V1. So we would suggest that all users of the module update to V2. To do this, you update our module to the latest release, then go into the Google Recaptcha management page, and delete your domains security keys, then generate new keys for V2. They have instructions on that process, all be is hard to understand.
Once you have new V2 recaptcha keys, you update these new keys back into our module and ensure that the V1 mode is NOT enabled. The V2 recaptcha will then run on your site.

To Remove and Uninstall

Step 1. From the iwebs – Register module settings, click the “Restore Register Control”

2. Uninstall the iwebs – Register module as you would any other DNN module.

Thoughts

This was a quick solution to some script kiddies attempt to attack DNN. I’m actually struggling to find the purpose (if you wrote the bot and you are reading this, I would love to hear why).  There is little threat by the registrations that I can find. More annoying that anything else. While Recaptcah can be broken, it would take some smarts or costs to use online services for the bot, so I suspect they will not bother and recaptcha will reign for this problem. In any case, if they spend some time and effort making the bot work for recaptcah, it is easy enough for us to implement some of the loads of other solutions available to stop them.

Donations

We included a donation button. If you find the solution, blog, research we did, modules we created and responses we provide to be helpful. Please consider throwing us a few $

In the recent DNN 7 releases, they have unfortunately made by default a popup greeting after sign in, that in theory would drive clients to signup for their spam.

Problem is (like lots of recent DNN features) that the “tick to never show again” does not work, and in some really recent releases, the popup goes crazy and does not allow you to progress into the site.

In other words, they killed their own product with spam crap.

Easy fix. Open the file in the web root, called: Default.aspx.cs

Look for this line: ManageGettingStarted();

Just throw a // before it to comment it out.

Save and restart the IIS site. Should fix it fast and for good.

DotNetNuke Upgrade Fails. Cannot login with Host.

If you are trying to upgrade your DotNetNuke site and found that you are presented with the Welcome to the DotNetNuke Upgrade Page, but can’t login with your Host (SuperUser) account.

DotNetNuke Upgrade – Version 06.02.07

Current Version – 06.02.05

Welcome to the DotNetNuke Upgrade Page.

The first step is to choose the language you wish to use for the Upgrade.

You are about to upgrade your website to a more recent version of the DotNetNuke application. Applying upgrades on a consistent basis is the best way to ensure that you are protecting the integrity of your investment and the security of your users and assets. Before proceeding with the automated upgrade process please ensure that:

• you have made plans to first attempt this process in a staging environment
• you have documented your current installation characteristics including doing research on the compatibility of any third party modules which you may be using
• you have created the necessary backups of your environment so that you will be able to restore your website in the event of an unexpected upgrade failure.

Solution

Just simply close your browsers, or better yet, grab a browser that you have not accessed for some time. Then try hitting your URL and loggin in with the new browser session. While I did not bother to work out what the cache issue was, I did find it was cache related to an open browser session that was trying to authenticate to a previous session.

Easy when you know how~!