Home / user-507892

Sulli's questions

Martin Hope
Sulli
Asked: 2019-02-14 00:54:16 +0800 CST
  • -1

I'm trying to set up a cron job to run this command every day:

wget -q -O - https://example.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1

The website example.com is located on the same server I'm running the cron job from. But I keep getting an error 403 in my logs:

"GET /wp-cron.php?doing_wp_cron HTTP/1.1" 403 428 "-" "Wget/1.17.1 (linux-gnu)"

When I try to access the same url from my browser it works though:

"GET /wp-cron.php?doing_wp_cron HTTP/1.1" 200 304 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"

So I guess there is something blocking requests from my own server in my apache2.conf (or .htaccess file), but I have no idea what to look for. Any idea what line could be responsible of this?

apache-2.4
Martin Hope
Sulli
Asked: 2019-02-09 03:16:43 +0800 CST
  • 2

I would like to block all requests starting with /search?q= as they generate unwanted load on my server.

Following this question https://stackoverflow.com/questions/4640807/how-to-block-bot-requests-to-urls-that-match-a-common-pattern-in-apache , I tried the following code:

<Location />
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/search?q=[^/] [NC]
RewriteRule ^.*$ - [F,L]
</Location>

but it's blocking way too many URLs (like everything starting with search)

I tried different variations but they didn't work. What would be the correct syntax?

apache-2.4
Martin Hope
Sulli
Asked: 2019-02-08 14:33:47 +0800 CST
  • 1

My VPS is continously running out of memory, my apache server goes down and when I login to reboot, I get a "memory fault" error and have to reboot through my hosting company dashboard.

However, before rebooting I'm able to look at the memory usage with top, and I see nothing suspicious. Mysqld sometimes peaking at 6% memory, a couple of php-cgi7 processes at 1%, and that's it, all other processes don't seem to consume much memory.

So is top missing something for some reason? What else can I do to debug this situation?

memory
Martin Hope
Sulli
Asked: 2019-02-04 03:56:12 +0800 CST
  • 2

I noticed my apache server was down today, and going to my hosting dashboard I see a spike in disk throughput and IOPS. At the same time, my log is full of these lines:

108.162.215.47 - - [03/Feb/2019:06:25:01 +0100] "POST /xmlrpc.php HTTP/1.1" 403 426 "-" "python-requests/2.21.0"
108.162.215.47 - - [03/Feb/2019:06:25:02 +0100] "POST /xmlrpc.php HTTP/1.1" 403 426 "-" "python-requests/2.21.0"
108.162.215.47 - - [03/Feb/2019:06:25:04 +0100] "POST /xmlrpc.php HTTP/1.1" 403 426 "-" "python-requests/2.21.0"
172.69.33.204 - - [03/Feb/2019:06:25:04 +0100] "POST /xmlrpc.php HTTP/1.1" 403 2471 "-" "python-requests/2.21.0"

xmlrpc.php is a file used by Wordpress to communicate with a remote server. It is known to be the source of many attacks and it's often recommended to block access to it (see https://www.hostinger.com/tutorials/xmlrpc-wordpress for instance)

  • So am I right that these xmlrpc attacks can be the cause of the disk throughput spike, even though I don't see any CPU spike at the same time?
  • The log shows that these requests have been blocked (403), so why would my apache server go down?
  • What should I do so that this does not happen again in the future? I have fail2ban installed on my server but maybe I need a special configuration for xmlrpc (I'm still a noob regarding server administration)
xmlrpc