Got a message from my hosting provider!

David Exodus Posted in Technical Support 2 months ago

I'm not quite sure what's wrong but my provider messaged me and told me that the file /libraries/ossn.lib.route.php is making massive problems, well ... somehow im a bit disappointed... for that quite bit of money I've spent in this software and premium features and so on, i modified a lot myself. And i noticed a lot of bits that didn't seem professional... Can someone please telle me whats wrong with this file and fix it? Well its already quit odd how variables there get somehow forced as an object into the rest of the code.

Replies
German Arsalan Shah Replied 2 months ago

Not sure what is wrong. It was working and then it suddenly stopped. Did you changed anything last night before morning?

ch David Exodus Replied 2 months ago

EDIT: server log + the internal ossn log are both empty.

ch David Exodus Replied 2 months ago

Guys, i got another problem now... I don't know how and why but this morning when i wanted to go on the site it was just completely white and blank. Also the source code in the browser is empty. Then i noticed all the files in the root folder were missing?? the folders are all still, so i copied a backup on the server but the page isn't changing anything...

ch David Exodus Replied 2 months ago

Okay guys, I think i fixed the problem... i currently have SSL issues so im not sure if its really working or not, but everything is fine so far the error_log stays empty... not quite sure if that's also normal...

ch David Exodus Replied 2 months ago

Sorry, i completely forgot or didn't think that OSSN has an own log... Well actually... There are over 1000 lines. I also noticed that somehow my Data Folder for OSSN isn't complete, I'll load a backup of it and restart logging for clearer results because a lot of errors are currently related to that Data folder.

German ~Z~ Man Replied 2 months ago

David,
'massive problems' ... 'bigger cases' ... that's nothing we can really work with.
Turn on Error Reporting from your Ossn admin backend and provide what's being logged.
You said there are issues with ossn.lib.route.php - ok, then there will be logs pointing to the exact line where these issues are happening. It's that easy.

ch David Exodus Replied 2 months ago

Well as I wrote before my provider said there's no actual server issues, that's also why I'm asking here, I don't know how and where to start debugging without logs. I have no idea what actually the problem is but my provider says it's a bigger case.

German ~Z~ Man Replied 2 months ago

Okay,
so some attacker scripts are trying to get a working wordpress login at your site.
Sad to say, but that's quite normal these days - the more your site gets known, the more of these brute force attempts you will notice.
What's missing though, is any line referring to ossn.lib.route.php - showing your massive problem.

ch David Exodus Replied 2 months ago

last message from my provider:

Ich kann leider keine Fehler in den Logs feststellen, da es kein serverseitiges Problem ist, gibt es keinen Log Eintrag.
Wenn diese Datei korrigiert wird, wird die Seite wieder aufrufbar sein.

translated:

Unfortunately I cannot find any errors in the logs, since it is not a server-side problem, there is no log entry.
If this file is corrected, the page will be accessible again.

ch David Exodus Replied 2 months ago

Log:

[Thu Jul 30 10:13:54.875068 2020] [logconfig:warn] [pid 3029240] (32)Broken pipe: [client 51.38.212.179:42606] AH00646: Error writing to |/usr/local/psa/admin/sbin/pipelog 7081
[Thu Jul 30 22:12:25.327638 2020] [proxy
fcgi:error] [pid 7074] [client 13.92.45.139:42858] AH01071: Got error 'Primary script unknown\n'
[Thu Jul 30 22:25:05.330556 2020] [proxyfcgi:error] [pid 11956] [client 51.103.50.159:44948] AH01071: Got error 'Primary script unknown\n'
[Fri Jul 31 00:06:05.540790 2020] [proxy
fcgi:error] [pid 7078] [client 185.81.157.112:58456] AH01071: Got error 'Primary script unknown\n'
[hostname "www.metal-schweiz.ch"] [uri "/robots.txt"] [uniqueid "XyX9Skfoe0GsIq405wGyzgAAAAk"]
[Sun Aug 02 14:02:43.222348 2020] [proxy
fcgi:error] [pid 1066189] [client 36.89.251.105:44534] AH01071: Got error 'Primary script unknown\n', referer: http://metal-schweiz.ch/wp-login.php
[Sun Aug 02 14:06:28.251417 2020] [proxyfcgi:error] [pid 1067135] (104)Connection reset by peer: [client 216.245.221.85:45282] AH01075: Error dispatching request to :, referer: https://metal-schweiz.ch
[Sun Aug 02 14:06:40.182352 2020] [proxy
fcgi:error] [pid 1068535] (104)Connection reset by peer: [client 51.38.212.179:45358] AH01075: Error dispatching request to :
[Sun Aug 02 14:06:53.418095 2020] [proxyfcgi:error] [pid 1066189] (104)Connection reset by peer: [client 216.245.221.85:45534] AH01075: Error dispatching request to :, referer: https://metal-schweiz.ch
[Sun Aug 02 14:58:28.087197 2020] [proxy
fcgi:error] [pid 1077908] [client 200.150.202.184:54618] AH01071: Got error 'Primary script unknown\n', referer: http://metal-schweiz.ch/wp-login.php
[Mon Aug 03 07:25:21.447788 2020] [proxyfcgi:error] [pid 1313206] [client 164.68.110.47:48572] AH01071: Got error 'Primary script unknown\n', referer: http://metal-schweiz.ch/wp-login.php
[Mon Aug 03 17:36:49.884238 2020] [proxy
fcgi:error] [pid 1446378] [client 178.62.59.59:44320] AH01071: Got error 'Primary script unknown\n', referer: http://metal-schweiz.ch/wp-login.php