iNTERAL 500 Error after Restoring VM from snapshot

Ok will do , but here is an update when i changed the virtualserver options \ users and groups to Run CGI programs as user from global , then the port 80 starts working , but as soon as i change it back to #578 and #515 i get the same error again

How ever the above trick does not work for SSL sites

Ok i just did the PHP execution mode to CGI and then i still get the same error

Anto

ok actually the 443 is working once I change it to as user from global but my WHMCS LOGIN AT https://olexor.com/support is showing an error about permission, could the snapshot restore have caused this But now I am scared if this would be a security loophole leaving the user from global on

Anto

I changed the PHP Script execution from FCGID to CGI, and I still had the 500 error, however leaving the FCGID on and changing the setting on the Apache server for the website to User from the global configuration on the Run CGI program as, I could get to the website.I am now reverting the change in the Run CGI to its original to reproduce the error.

the log output is below [Mon May 16 18:03:18.324099 2016] [cgi:error] [pid 14469] [client 148.251.246.209:50331] AH01215: Unable to open /home/arappai/public_html/wp-content/wflogs/ips.php for reading and writing. [Mon May 16 18:04:26.907095 2016] [cgi:error] [pid 14470] [client 46.235.103.30:26686] AH01215: Unable to open /home/arappai/public_html/wp-content/wflogs/ips.php for reading and writing., referer: http://olexor.com/wp-login.php [Mon May 16 18:14:14.331096 2016] [cgi:error] [pid 15854] [client 37.211.87.249:52918] End of script output before headers: php5.cgi [Mon May 16 18:14:14.344804 2016] [cgi:error] [pid 15854] [client 37.211.87.249:52918] End of script output before headers: php5.cgi [Mon May 16 18:14:15.618503 2016] [cgi:error] [pid 15855] [client 37.211.87.249:60249] End of script output before headers: php5.cgi, referer: http://olexor.com/ [Mon May 16 18:14:15.622625 2016] [cgi:error] [pid 15855] [client 37.211.87.249:60249] End of script output before headers: php5.cgi, referer: http://olexor.com/ [Mon May 16 18:14:28.324432 2016] [cgi:error] [pid 15855] [client 108.162.236.6:60124] End of script output before headers: php5.cgi [Mon May 16 18:14:28.360057 2016] [cgi:error] [pid 15855] [client 108.162.236.6:60124] End of script output before headers: php5.cgi [Mon May 16 18:14:51.073258 2016] [cgi:error] [pid 15853] [client 37.211.87.249:52936] End of script output before headers: php5.cgi [Mon May 16 18:14:51.077529 2016] [cgi:error] [pid 15853] [client 37.211.87.249:52936] End of script output before headers: php5.cgi [Mon May 16 18:14:52.063521 2016] [cgi:error] [pid 15856] [client 37.211.87.249:60271] End of script output before headers: php5.cgi, referer:

Output of the rpm -qa | grep php

rpm -qa | grep php php-imap-5.4.16-3.el7.x86_64 php-pdo-5.4.16-36.1.el7_2.1.x86_64 php-cli-5.4.16-36.1.el7_2.1.x86_64 php-pgsql-5.4.16-36.1.el7_2.1.x86_64 php-process-5.4.16-36.1.el7_2.1.x86_64 php-pear-1.9.4-21.el7.noarch php-5.4.16-36.1.el7_2.1.x86_64 php-odbc-5.4.16-36.1.el7_2.1.x86_64 php-xmlrpc-5.4.16-36.1.el7_2.1.x86_64 wbm-php-pear-1.5-1.noarch php-common-5.4.16-36.1.el7_2.1.x86_64 php-mysql-5.4.16-36.1.el7_2.1.x86_64 php-mbstring-5.4.16-36.1.el7_2.1.x86_64 php-gd-5.4.16-36.1.el7_2.1.x86_64 php-snmp-5.4.16-36.1.el7_2.1.x86_64 php-xml-5.4.16-36.1.el7_2.1.x86_64

ls -ld /home/arappai drwxr-x--- 32 arappai arappai 4096 May 13 12:13 /home/arappai ls -ld /home/arappai/public_html drwxr-x--- 15 arappai arappai 4096 May 16 18:18 /home/arappai/public_html ls -ld /home/arappai/public_html/wp-content/ drwxr-xr-x 10 arappai arappai 4096 May 15 21:38 /home/arappai/public_html/wp-content/ ls -ld /home/arappai/public_html/wp-content/wflogs/ips.php -rw-r--r-- 1 arappai arappai 51 May 4 09:10 /home/arappai/public_html/wp-content/wflogs/ips.php ls -l /home/arappai/public_html/wp-content/wflogs/ips.php -rw-r--r-- 1 arappai arappai 51 May 4 09:10 /home/arappai/public_html/wp-content/wflogs/ips.php

additonally do you think this has to do with the system updates and /or Snapshot restore ? that is the is the only thig i can think off .

and also like i mentioned chaecking the global user setting in the Apache seems at least get me into the site but still not my WHMCS under Https://olexor.com/support/cms

so I had another guy look at it and this is how he fixed it • Site worked with mod_php but not CGI of FCGI • Noticed the following errors in /var/log/secure. This told me that FCGI was not able to set the correct runuser, resulting in the 500 error- • More research showed that the suexec binary (/usr/bin/suexec) had 710 permissions. Changing permissions to 4510 resolved the problems

Any idea how this could have happened ?

Anto

rpm -qa | grep httpd httpd-2.4.6-31.el7.centos.1.vm.x86_64 httpd-tools-2.4.6-31.el7.centos.1.vm.x86_64

Is ssh for guys a better way to look into this ? i am actually worried if the current permission on the suexc is less secure ?

The status of your system is being checked to ensure that all enabled features are available, that the mail server is properly configured, and that quotas are active .. Your system has 988.17 MB of memory, which is at or above the Virtualmin recommended minimum of 256 MB. BIND DNS server is installed, and the system is configured to use it.

Mail server Postfix is installed and configured.

Postfix can support per-domain outgoing IP addresses, but is not currently configured to do so. This can be setup in the Postfix Mailserver module.

Apache is installed.

The following PHP versions are available : 5.4.16 (/bin/php-cgi), 5.6.5 (/opt/rh/rh-php56/root/usr/bin/php-cgi)

Webalizer is installed.

Apache is configured to host SSL websites.

MySQL is installed and running.

ProFTPD is installed.

Logrotate is installed.

SpamAssassin and Procmail are installed and configured for use.

ClamAV is installed and assumed to be running.

Plugin AWstats reporting is installed OK.

Plugin DAV Login is installed OK.

Plugin Protected web directories is installed OK.

Plugin Additional content styles is installed OK.

Plugin Additional content styles from OpenWebDesign.org is installed OK.

Plugin Virtualmin Support Links is installed OK.

Using network interface eth0 for virtual IPs.

IPv6 addresses are available, using interface eth0.

Default IPv4 address for virtual servers is 109.104.118.173.

Default IPv6 address for virtual servers is 2001:9d8:1000:1a2e:216:3eff:fe1d:59f6.

Default IP address is set to 109.104.118.173, which matches the detected external address.

Both user and group quotas are enabled for home and email directories.

All commands needed to create and restore backups are installed.

Resource limits are supported and configured correctly.

The selected package management and update systems are installed OK.

.. your system is ready for use by Virtualmin.

Hey, guys, i am still having some weird issues with my Virtualmin sites

One of my WP sites have some weird permission issue, it asks for an FTP cred while adding and deleting plugins, but not for my other sites on the same server, these are the things that I have done so far with my server inorder to fix the initial 500 error. And there is some weird permission issue with WHMCS as well 1.More research showed that the suexec binary (/usr/bin/suexec) had 710 permissions. Changing permissions to 4510 resolved the problems 2.Changed /home/username permissions to 711 from 750 to prevent cross-account file access.

some digging has made two points stand out from the WordPress blog "WordPress asks for your FTP credentials when it can't access the files directly. This is usually caused by PHP running as the apache user (mod_php or CGI) rather than the user that owns your WordPress files."

Response from WHMCS Support For folder permissions, "it is dependent upon the server configuration and what it needs for a folder to be writable by the user handling the incoming HTTP request. For example: on a standard cPanel server where Apache runs as the unprivileged "nobody" user, the folder needs to be 777 to ensure anyone (not just the owner, the cPanel account holder) can write to it. If you've configured Apache to handle requests as the same user as owns the folder (using something like SuEXEC or SuPHP), the permissions can be lower (usually 755). Again, the required permissions depend on your server - not WHMCS - and not something we can answer for you."

I have been working with a guy to help me out, but i have reached a dead end and i am in desperate need of some help, I am launching a new product and has been behind schedule for a month, the emailing back and forth and coordinating with multiple people is getting quite frustrating

What does it take to get someone from your team to SSH into my server and resolve this for once? i am ready to buy a support incident for one hour for a 1:1 session

please let me know

thanks Anto

yes please

cam i email you the cred ?

?

What if my business is losing money and my business is dependent on your product, and I need this fixed now ? is there some kind of support service you provide where I can just have you remote into this within a specified time.

How would I get that kind of support?

for, e.g., when I email WHMCS they will shh or FTP into the server and fix it no less than 6 hours, I mean something like that?

Ok, my domain olexor.com username arappai has the issue.It keeps asking me for an FTP cred when installing or deleting a plugin, also i installed a plugin called wordfence and it says it has no permission to write to the wflogs under the wp-contents folder.

but there is no problem with any of my other sites, i double checked the permissions and it is owned by arappai, it is not broken, i just can't add any plugins and activate the WordPress wordfence firewall.

chcek post #17

also, check out post 1 and 11 in this thread

not that I know off , I tried messing with Clam AV but that was long before I had the problem, the only thing I can think of is the VM restore , and I tried permission change on the /home/arappai to 711 and back to 750 and every other change is mentioned in the doc I send to Jamie.

Then the updates, the first symptom was none of the sites would load, it would just show 500 error then I had a guy look at it and he did this

-More research showed that the suexec binary (/usr/bin/suexec) had 710 permissions. Changing permissions to 4510 resolved the problems

I would like it reverted to its original state if we find the cause. I am just too paranoid about security.

I installed WordPress plugin called wordfence , but i really never had any issues until the restore.

yes i still have the error on the Wordfence and still asking for the FTP to delete the plugins

Anto

hey i can not get into two of my sites my main site olexor.com and madific.com , it shows an internal 500 error

nothing at all, i just changed the ClamAV script to run at midnight 12:00 am and send me a report at the same time

nothing else

ok the site is showing up now , let me check if the permission issue is sorted out now and i understand you have to head to bed now , thanks for looking into this.

hope you guys figure it out soon

thanks Anto

Got damn it is working now. Thank the dear lord baby Jesus and thank you guys.

If you could after you wake up take the time to give a report as to how this happened and what was done to fix it I can keep a record of it.

/home/madific/public_html/test.php: {HEX}php.exe.globals.403.UNOFFICIAL FOUND /home/arappai/public_html/test.php: {HEX}php.exe.globals.403.UNOFFICIAL FOUND

----------- SCAN SUMMARY ----------- Known viruses: 4396462 Engine version: 0.99.2 Scanned directories: 18805 Scanned files: 119330 Infected files: 2 Total errors: 2 Data scanned: 2531.70 MB Data read: 8289.07 MB (ratio 0.31:1) Time: 344.089 sec (5 m 44 s)

ok i found these in my clam scan results , you think this has something to do with the cause ?

yes i meant the plugin is working too and no more FTP permission issues

oh my, thanks that was some good info, so couple more questions. Is post number 42 an issue? It does not look like to me

Secondly, my knowledge of Linux is just weak, the most I have learned is in the past few days. What does it take to switch to the stock kernel ? is that something you can assist me with ? or I need to find a third party , I want to go as per your recommendations.

Thirdly i noticed the public_html on arappai and madific has permission set to 751, is that secure ?

I haven't done any Kernel switching, I wonder if it was the default image provided by my hosting provider ? it probably is

thanks

i could have sworn that it was 750 till yeaterday, and the contents of the test .php are below and i was pretty sure it was not there either

<?php
system("id -a");
phpinfo();
?>

what would be the out put of that command ?

one more question is 711 for the /home/username better than 750 ?

Ok , figured the test.php was done by you guys

But just wanted to double check if you guys had changed the permission on the /home/arappai to 751 ?

For now I have changed the permission back to 750 .

just FYI, I think the reason the provider used the other kernel was for some OnApp and Hostbill integration , still yet to confirm it though .

I will restart the Apache and check it out.

Thanks guys I am back in business .

One more thing regarding the the setuid, is that something you change for each virtual server site user ?and just a brief outline of the steps you did for changing this , so if something goes wrong I can be prepared

Because what puzzles me is that I had absolutely no problem with the other sites

Maybe the host name of the server and the website being same ? That is Olexor.com ?

Maybe using cloudflare DNS ?

ok, I restarted the Apache and set the permission to 750 and all still works - in fact, the best working condition since the migration, the site that was working while olexor.com was not was techshebang.com and the PHP execution was set to FCGid same as the others.

So all you had to do was change the permission on the suexec to 6755 ?

Again I wonder how this could have happened ? do you want me to do a snap shot and restore to see if this problem happens again on another server |?

ok one more thing , i just wanted to confirm that one you guys renamed the .htaccess files under arappai ? because today when i checked i realized the permalinks was not working on my site olexor.com

but it is working now because i changed it back

hey Just FYI on why the CentOS plus kernel was used

CentOS 7.x templates use centosplus kernel following issues with missing initrd lines when upgrading with yum.

We've decided to switch into the CentOS Plus's kernel. Corresponded repositories was enabled/added to install/upgrade (include) the kernel-plus* packages only. Native RHEL/CentOS 7.x kernel* packages were removed. The grubby was downgraded and excluded from the repositories to disable its upgrade until the initrd issue is fixed. RHEL/CentOS 7.x templates were updated to the recent 3.10.0-229.14.1.el7.centos.plus.x86_64 kernel

One would have to disable the kernel-plus packages and re-enable the native kernel packages as per CentOS / rhel docs to use the default kernels.

Hey so i just reverted my snapshot to another VM with a different IP, and I changed the IP address of the Virtualmin site as well, but guess what I have the same issue of 500 error, I had this problem on another server and you helped me with it, however I am unclear on the exact steps to resolve this , can you look from post no:35 and tell me how to set the user permissions

At least we can confirm that this is caused by the restoring the VM from snapshot and also

Thanks Anto

so the owner is correct of that domain , now what ?

if you look at post 44, that may be what i need to do , and how do i do that ? this is the exact same scenario as the previous

no I mean this part "He changed the suexec binary to be setuid" that is what you did to fix right ?

Anto

-r-x--x--- 1 root apache 15352 Jun 2 20:22 /usr/sbin/suexec

thats the out put

Hey, it worked, wait, so that was the culprit of the previous Virtualmin server error too? When I restored

Thanks Anto

Ok thanks man

Back in business

Anto