[Wordpress]: Bot attack from own instance/misconfigured Firewall? about vms HOT 9 CLOSED

Wish somebody could reply... :(
It's pretty poor to end up with these effectively fatal errors and to have zero support. :(

from vms.

I'm having the similar problems, every 8 to 10 hours the server is inaccessible (can't login via ssh or anything).
I use the Bitnami image for Wordpress that comes with Amazon Lightsail.
AH01079 is the error seen in the apache logs.
From what I saw there are several threads on github about the same thing. We opted to redo the server with another image that is not bitnami

from vms.

I suggest you take a look at these guides to know if there is any performance issue or if there is a bot/attacker accessing your site with malicious intentions

https://docs.bitnami.com/general/faq/troubleshooting/troubleshoot-server-performance/
https://docs.bitnami.com/general/apps/wordpress/troubleshooting/deny-connections-bots-apache/

You will also need to review the PHP's log file to see if there is any error there. You can find a related thread here:

#907 (comment)

Finally, there are security plugins like Wordfence that will probably help you improve the security and performance of your site.

from vms.

ps -e -orss=,args= | sort -b -k1,1n | pr -TW$COLUMNS
```
0 [acpi_thermal_pm]
0 [blkcg_punt_bio]
0 [cpuhp/0]
0 [cpuhp/1]
0 [cpuhp/2]
0 [cpuhp/3]
0 [cpuhp/4]
0 [cpuhp/5]
0 [cpuhp/6]
0 [cpuhp/7]
0 [cryptd]
0 [ena]
0 [ext4-rsv-conver]
0 [ipv6_addrconf]
0 [jbd2/nvme0n1p1-]
0 [kauditd]
0 [kblockd]
0 [kcompactd0]
0 [kdevtmpfs]
0 [khugepaged]
0 [khungtaskd]
0 [kintegrityd]
0 [ksmd]
0 [ksoftirqd/0]
0 [ksoftirqd/1]
0 [ksoftirqd/2]
0 [ksoftirqd/3]
0 [ksoftirqd/4]
0 [ksoftirqd/5]
0 [ksoftirqd/6]
0 [ksoftirqd/7]
0 [kstrp]
0 [kswapd0]
0 [kthreadd]
0 [kthrotld]
0 [kworker/0:0H-events_highpri]
0 [kworker/0:1-events]
0 [kworker/0:1H-kblockd]
0 [kworker/0:2-events]
0 [kworker/1:0H-events_highpri]
0 [kworker/1:0-mm_percpu_wq]
0 [kworker/1:1-events]
0 [kworker/1:1H-kblockd]
0 [kworker/2:0-events]
0 [kworker/2:0H-events_highpri]
0 [kworker/2:1-events]
0 [kworker/2:1H-kblockd]
0 [kworker/3:0H-events_highpri]
0 [kworker/3:1H-kblockd]
0 [kworker/3:1-mm_percpu_wq]
0 [kworker/3:2]
0 [kworker/4:0-events]
0 [kworker/4:0H-events_highpri]
0 [kworker/4:1H-kblockd]
0 [kworker/4:1-mm_percpu_wq]
0 [kworker/5:0-events]
0 [kworker/5:0H-events_highpri]
0 [kworker/5:1-cgroup_destroy]
0 [kworker/5:1H-kblockd]
0 [kworker/5:2-events]
0 [kworker/6:0-events]
0 [kworker/6:0H-events_highpri]
0 [kworker/6:1-events]
0 [kworker/6:1H-kblockd]
0 [kworker/7:0H-events_highpri]
0 [kworker/7:1-events]
0 [kworker/7:1H-kblockd]
0 [kworker/7:2-events]
0 [kworker/u16:0-events_unbound]
0 [kworker/u16:1-events_unbound]
0 [kworker/u16:2-flush-259:0]
0 [kworker/u17:0]
0 [migration/0]
0 [migration/1]
0 [migration/2]
0 [migration/3]
0 [migration/4]
0 [migration/5]
0 [migration/6]
0 [migration/7]
0 [mm_percpu_wq]
0 [netns]
0 [nvme-delete-wq]
0 [nvme-reset-wq]
0 [nvme-wq]
0 [oom_reaper]
0 [rcu_gp]
0 [rcu_par_gp]
0 [rcu_sched]
0 [rcu_tasks_rude_]
0 [rcu_tasks_trace]
0 [writeback]
500 pr -TW108
540 sort -b -k1,1n
552 /usr/sbin/chronyd -F 1
1200 ps -e -orss=,args=
2204 /usr/sbin/atd -f
2612 (sd-pam)
2868 /usr/sbin/cron -f
3652 /usr/sbin/chronyd -F 1
4128 /usr/sbin/rsyslogd -n -iNONE
4224 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-on
4284 /usr/lib/openssh/sftp-server
4504 sshd: bitnami@notty
4664 sshd: bitnami@pts/0
4724 -bash
5204 /lib/systemd/systemd-udevd
5720 /sbin/dhclient -4 -v -i -pf /run/dhclient.ens5.pid -lf /var/lib/dhcp/dhclient.ens5.leases -I -df /var/
6068 /usr/sbin/haveged --Foreground --verbose=1
6892 /lib/systemd/systemd-logind
7648 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
7764 /sbin/dhclient -6 -v -pf /run/dhclient6.ens5.pid -lf /var/lib/dhcp/dhclient6.ens5.leases -I -df /var/l
8284 /lib/systemd/systemd --user
8688 sshd: bitnami [priv]
8744 sshd: bitnami [priv]
9368 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
9940 /sbin/init
13948 /opt/bitnami/gonit/bin/gonit
17376 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
17692 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
19652 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
19780 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
21528 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
24636 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
24796 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
25232 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
26472 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
26628 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
27388 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
30968 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
31120 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
32776 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
32836 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
34144 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
38756 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
38812 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
40132 php-fpm: master process (/opt/bitnami/php/etc/php-fpm.conf)
45044 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
45440 /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf
49000 /lib/systemd/systemd-journald
190616 php-fpm: pool www
190896 php-fpm: pool www
191420 php-fpm: pool www
193348 php-fpm: pool www
193720 php-fpm: pool www
196212 php-fpm: pool www
196364 php-fpm: pool www
197472 php-fpm: pool www
197500 php-fpm: pool www
198684 php-fpm: pool www
199760 php-fpm: pool www
199764 php-fpm: pool www
199864 php-fpm: pool www
200272 php-fpm: pool www
200824 php-fpm: pool www
202956 php-fpm: pool www
207332 php-fpm: pool www
208824 php-fpm: pool www
208916 php-fpm: pool www
208960 php-fpm: pool www
209016 php-fpm: pool www
209020 php-fpm: pool www
209020 php-fpm: pool www
209028 php-fpm: pool www
209248 php-fpm: pool www
209440 php-fpm: pool www
209544 php-fpm: pool www
209884 php-fpm: pool www
210024 php-fpm: pool www
210192 php-fpm: pool www
210748 php-fpm: pool www
211336 php-fpm: pool www
212032 php-fpm: pool www
213060 php-fpm: pool www
213152 php-fpm: pool www
213464 php-fpm: pool www
214592 php-fpm: pool www
215076 php-fpm: pool www
215112 php-fpm: pool www
215136 php-fpm: pool www
215160 php-fpm: pool www
215160 php-fpm: pool www
215176 php-fpm: pool www
215176 php-fpm: pool www
215188 php-fpm: pool www
215248 php-fpm: pool www
217408 php-fpm: pool www
217852 php-fpm: pool www
218028 php-fpm: pool www
218428 php-fpm: pool www
218740 php-fpm: pool www
219572 php-fpm: pool www
220656 php-fpm: pool www
221520 php-fpm: pool www
221536 php-fpm: pool www
221572 php-fpm: pool www
221732 php-fpm: pool www
222044 php-fpm: pool www
222540 php-fpm: pool www
223344 php-fpm: pool www
223696 php-fpm: pool www
223716 php-fpm: pool www
223780 php-fpm: pool www
223980 php-fpm: pool www
224248 php-fpm: pool www
225116 php-fpm: pool www
225548 php-fpm: pool www
225800 php-fpm: pool www
226292 php-fpm: pool www
226380 php-fpm: pool www
227392 php-fpm: pool www
227412 php-fpm: pool www
227436 php-fpm: pool www
227440 php-fpm: pool www
227440 php-fpm: pool www
227452 php-fpm: pool www
227452 php-fpm: pool www
227452 php-fpm: pool www
227468 php-fpm: pool www
227468 php-fpm: pool www
227496 php-fpm: pool www
227704 php-fpm: pool www
227748 php-fpm: pool www
228304 php-fpm: pool www
230140 php-fpm: pool www
230176 php-fpm: pool www
230528 php-fpm: pool www
230796 php-fpm: pool www
230952 php-fpm: pool www
231188 php-fpm: pool www
232052 php-fpm: pool www
232360 php-fpm: pool www
233404 php-fpm: pool www
234140 php-fpm: pool www
234332 php-fpm: pool www
234460 php-fpm: pool www
235232 php-fpm: pool www
235328 php-fpm: pool www
235416 php-fpm: pool www
235420 php-fpm: pool www
235436 php-fpm: pool www
235464 php-fpm: pool www
235536 php-fpm: pool www
235556 php-fpm: pool www
235572 php-fpm: pool www
235572 php-fpm: pool www
235576 php-fpm: pool www
235688 php-fpm: pool www
235692 php-fpm: pool www
235696 php-fpm: pool www
235720 php-fpm: pool www
235728 php-fpm: pool www
235736 php-fpm: pool www
235740 php-fpm: pool www
235744 php-fpm: pool www
235792 php-fpm: pool www
235800 php-fpm: pool www
235816 php-fpm: pool www
235836 php-fpm: pool www
235880 php-fpm: pool www
235904 php-fpm: pool www
235984 php-fpm: pool www
235992 php-fpm: pool www
236008 php-fpm: pool www
236156 php-fpm: pool www
236172 php-fpm: pool www
236212 php-fpm: pool www
236228 php-fpm: pool www
236244 php-fpm: pool www
236252 php-fpm: pool www
236260 php-fpm: pool www
236288 php-fpm: pool www
236344 php-fpm: pool www
236356 php-fpm: pool www
236360 php-fpm: pool www
236480 php-fpm: pool www
236524 php-fpm: pool www
236524 php-fpm: pool www
236528 php-fpm: pool www
236532 php-fpm: pool www
236608 php-fpm: pool www
236656 php-fpm: pool www
236664 php-fpm: pool www
236672 php-fpm: pool www
236684 php-fpm: pool www
236740 php-fpm: pool www
236752 php-fpm: pool www
236752 php-fpm: pool www
236756 php-fpm: pool www
236768 php-fpm: pool www
236808 php-fpm: pool www
236812 php-fpm: pool www
236840 php-fpm: pool www
236844 php-fpm: pool www
236864 php-fpm: pool www
236928 php-fpm: pool www
237012 php-fpm: pool www
237056 php-fpm: pool www
237068 php-fpm: pool www
237276 php-fpm: pool www
237276 php-fpm: pool www
237332 php-fpm: pool www
237360 php-fpm: pool www
237372 php-fpm: pool www
237436 php-fpm: pool www
237480 php-fpm: pool www
237544 php-fpm: pool www
237608 php-fpm: pool www
237684 php-fpm: pool www
237712 php-fpm: pool www
237824 php-fpm: pool www
237824 php-fpm: pool www
237996 php-fpm: pool www
238052 php-fpm: pool www
238144 php-fpm: pool www
238180 php-fpm: pool www
238568 php-fpm: pool www
238576 php-fpm: pool www
238616 php-fpm: pool www
238640 php-fpm: pool www
238824 php-fpm: pool www
239192 php-fpm: pool www
239236 php-fpm: pool www
239260 php-fpm: pool www
239588 php-fpm: pool www
239604 php-fpm: pool www
239616 php-fpm: pool www
239652 php-fpm: pool www
239708 php-fpm: pool www
240444 php-fpm: pool www
240528 php-fpm: pool www
241248 php-fpm: pool www
241740 php-fpm: pool www
241744 php-fpm: pool www
242472 php-fpm: pool www
246184 php-fpm: pool www
247372 php-fpm: pool www
252476 php-fpm: pool www
1465320 /opt/bitnami/mariadb/sbin/mysqld --defaults-file=/opt/bitnami/mariadb/conf/my.cnf --basedir=/opt/bit

 ps -e -o pcpu,nice,state,cputime,args --sort -pcpu | head -10
%CPU  NI S     TIME COMMAND
 2.8   0 S 00:02:07 php-fpm: pool www
 2.8   0 S 00:02:05 php-fpm: pool www
 2.8   0 S 00:02:05 php-fpm: pool www
 2.8   0 S 00:02:06 php-fpm: pool www
 2.8   0 S 00:02:09 php-fpm: pool www
 2.8   0 S 00:02:05 php-fpm: pool www
 2.8   0 S 00:02:06 php-fpm: pool www
 2.8   0 S 00:02:07 php-fpm: pool www
 2.8   0 S 00:02:07 php-fpm: pool www

 free -m
               total        used        free      shared  buff/cache   available
Mem:           31760       10535       20405         175         818       20655
Swap:              0           0           0

 tail -n 10000 access_log | awk '{print $1}'| sort| uniq -c
| sort -nr| head -n 10
   9351 35.176.XX.XXX
    144 45.47.16.226
    123 99.243.119.154
     77 172.9.34.245
     19 75.85.161.245
     18 185.192.71.231
     11 172.250.66.208
     10 64.140.235.252
      9 82.29.182.134
      9 82.10.0.115

Where 35.176.XX.XXX is our AWS Instance-as per my original post above!

Anyhelp would be greatly appreciated: our site has been down now for days! Thank you

from vms.

You have a huge number of PHP-FPM processes and that means that there are a lot of connections. I do not know why you own IP is the one generating that many requests by I think that a plugin is doing that. Have you installed one recently?

I suggest you install Wordfence to analyze your system and look for malicious code. I also suggest you disable the plugins to confirm the issue is solved. You can enable them one by one later to find the culprit.

from vms.

It seems that the issue is ANY caching plugin. Wp-Rocket, Redis Object Cache and LiteSpeed Cache all result in a high number of connections to the database being generated. Since it's three caching plugins that end up manifesting the same issue, would it be reasonable to assume that the problem aren't actually the plugins, but some other misconfiguration?

from vms.

A caching plugin shouldn't be generating that big amount of requests. They should generate a request when necessary. Please ask the developers of those plugins to get more information.

from vms.

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

from vms.

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.

from vms.