Server error, please try again later

[Divinum Fiat]

Hi all,

For some unexplainable reason I got logged out of my forum and when I try logging back in I get the message "server error, please try again later."

The page is frozen at that error page and no matter what tabs I click, I can't move away from the error page.

Does anyone have an idea of what this could be related to (my other domains, that share the same server, are up and running fine)?

 

[tenants]

I've just realised, your using the installation guide for IP protection, but have downloaded the user locks plugin.. is that right?

 

[Divinum Fiat]

Yes, I just downloaded the locks plugin but I'm not sure what you mean by 'installation guide for ip protection.'

 

[tenants]

(sorry that was meant to be sent to your PMs)

 

[borbole]

From what Matt is posting it looks like the server is not at fault after all.

 

[Cool]

??? if the server has been compromised and not just from a script-kiddy you will never find any login-data to this, so you can´t be sure that the server is not compromised.

mysql has some security issues witch will be not fixed before the next patch day... wich is ???

ssh access should only be possible thru key-file auth. and only for them who need it.

with some small code you can be informed about ssh logins. i´m not a centos guru but on debian-based systems
you will for ex. add:

echo 'ALERT - Root Shell Access on:' $(date) $(who) | mail -s "Alert: Root Access from $(who | cut -d"(" -f2 | cut -d")" -f1)" your@mail.tld

inside your ".profile" file. this will be send directly and long before a attacker can darken his work.

as everthing is totally open/uncleare and you don´t know what was/is going on at the server i personally would never ever set such server online without a serious analysis.

and a info as "we can´t restart your server" would anyway be the "Death shot" for that hoster.


all of you wich try to help Blueprint4Love should think over at that responsibility. server-admin is not a easy task wich i know since more then 2o years with own servers.

 

[Divinum Fiat]

Hi Cool, thank you for your post. I'm not quite sure my understanding of tech is polished enough to understand what you are saying. Maybe someone else knows?

Jake is looking into things now. It's not just doing the back up restore, it's also fixing the hole they dug so they can't get back in. It seems to have been pretty easy for them to do.

 

[MattW]

??? if the server has been compromised and not just from a script-kiddy you will never find any login-data to this, so you can´t be sure that the server is not compromised.

mysql has some security issues witch will be not fixed before the next patch day... wich is ???

ssh access should only be possible thru key-file auth. and only for them who need it.

with some small code you can be informed about ssh logins. i´m not a centos guru but on debian-based systems
you will for ex. add:

echo 'ALERT - Root Shell Access on:' $(date) $(who) | mail -s "Alert: Root Access from $(who | cut -d"(" -f2 | cut -d")" -f1)" your@mail.tld

inside your ".profile" file. this will be send directly and long before a attacker can darken his work.

as everthing is totally open/uncleare and you don´t know what was/is going on at the server i personally would never ever set such server online without a serious analysis.

and a info as "we can´t restart your server" would anyway be the "Death shot" for that hoster.


all of you wich try to help Blueprint4Love should think over at that responsibility. server-admin is not a easy task wich i know since more then 2o years with own servers.

I've added that to .bash_profile, and it's now working



I've set up a forwarder so send a copy of the e-mail to Blueprint4Love

I've also been doing server admin for the last 9 years, and I don't claim to be a security expert. I can set them up, and secure them myself, but beyond what I've already checked, should be left to a proper security expert specifically offering those services.

This VPS has been left basically as it came out of the box from Hostgator. I personally think it was only recently updated by Hostgator when they updated php and mysql.

ssh access should only be possible thru key-file auth. and only for them who need it.

Exactly. My servers don't allow direct root access, they only allow key-file auth, and SSH is moved to a none-standard port.

 

[MattW]

MattW, can you look through the access logs and search for the offending IP addresses (Blueprint4Love should be able to give you a list of the ip addresses).
From the server access logs, you should be able to determine where the entry point was.. this will give you huge clues of how / what they have done.

If it is a brute force of the admin account from the forum login, then it is what I saw and mentioned a long time ago... It will be fixed, but apparently not outside of a 1.2 release



I take it that's your host that said that, or a forum users post?

Access logs going back to 30th November

root@blu [/home/corefree/access-logs]# less corefreedom.com | grep admin.php | awk '{print $1}' | sort -n | uniq -c | sort -nr
2750 XXX.XXX.XXX.XXX
587 216.19.26.155
177 124.121.170.5
84 XXX.XXX.XXX.XXX
9 XXX.XXX.XXX.XXX
7 XXX.XXX.XXX.XXX
1 46.119.119.195

I've removed mine, Jakes, Chris and Blueprint4Love's IP addresses with XXX.XXX.XXX.XXX

 

[Divinum Fiat]

Wow, there were THAT many 'offending' IP addresses?? Assuming these were all proxies and can't be traced anywhere? Sure would love to send that person a Christmas card...

Matt, you're amazing! I'm really speechless at the support and help from everyone here. I wish I was a techie and could repay you and others in gratitude. If there is anything I can do for any of you, please just ASK.

Thank you, thank you, thank you!

 

[borbole]

Those ip 's seem to come from all over the world. According to whois, the first one comes from Arizona, US, the second from Great Britain and the third from Ukraine.

 

[Divinum Fiat]

Well, I'm in Arizona at the moment, so it could be that I logged on from a cafe or the library, not sure. Great Britain, isn't that where Matt is? And the Ukraine? No clue about that one. The one that HostGator found that logged in the night the forum was hacked was an anonymous proxy from Europe somewhere too.

 

[MattW]

Well, I'm in Arizona at the moment, so it could be that I logged on from a cafe or the library, not sure. Great Britain, isn't that where Matt is? And the Ukraine? No clue about that one. The one that HostGator found that logged in the night the forum was hacked was an anonymous proxy from Europe somewhere too.

Correct, I'm from the UK, but my IP is static and I've removed that from the list above.

 

[Chris D]

One of them (the UK one) is mine, I helped do the upgrade the other day.

 

[borbole]

One of them (the UK one) is mine, I helped do the upgrade the other day.

In that case I think it would be better if it was removed from the list.

 

[MattW]

In that case I think it would be better if it was removed from the list.

Done

 

[MattW]

On the plus side to all this.....check the uptime of the VPS!

root@blu [/etc/cron.hourly]# uptime
10:17:56 up 391 days,  6:08,  1 user,  load average: 0.14, 0.12, 0.14
root@blu [/etc/cron.hourly]#

 

[Divinum Fiat]

yeewwwhaawww!

Thank you!

 

[Ingenious]

I've read through this thread to try and understand what exactly went wrong with the forum, but I'm a bit lost. Was the admin account brute forced and if so, would that brute force add-on plus changing to a VERY long password help? It would be good to come out of this with some things we can do to pre-empt it happening to someone else.

 

[MattW]

I've read through this thread to try and understand what exactly went wrong with the forum, but I'm a bit lost. Was the admin account brute forced and if so, would that brute force add-on plus changing to a VERY long password help? It would be good to come out of this with some things we can do to pre-empt it happening to someone else.

I still don't know exactly what happened, and I've been on the server nearly all day

 

[Ingenious]

OK MattW, thanks for the update (and your time looking into this!). I'll keep an eye on this thread for any further info.