nginx error log - request from unknown hosts - nginx

I am getting request from unknown hosts in nginx error.log trying to request files or requests which don't exist in the system.
Receiving below list of errors in error log,
directory index is forbidden, client: 61.157.96.126, request: "GET http://www.haosou.com/?rands=_688651072032161501826712 HTTP/1.1", host: "www.haosou.com"
[error] 10006#0: *67753 open() /favicon.ico" failed (2: No such file or directory), client: 95.25.186.223, request: "POST http://t3.proxy-checks.com/favicon.ico HTTP/1.1", host: "t3.proxy-checks.com"
[error] 10006#0: *66849 directory index of "--" is forbidden, client: 120.132.95.89, request: "GET http://www.qunar.com/ HTTP/1.1", host: "www.qunar.com"
What could be the issue here? Do I need to make any configuration changes on my server to stop such requests? or Is it ok to receive such requests on server?

Related

Wordpress on Azure 404 error on installation step 2

I'm installing a Wordpress site on an Azure WebApp. I have Wordpress on /home/site/wwwroot directory and when I access the web app url the installation begins. I can select the language, then I enter the DB information and when I click "Submit" I get a "404 Not Found" error from NGINX.
I have been troubleshooting and found this on th NGINX Error Log:
2021/09/13 17:58:36 [error] 71#71: *91 open() "/html/50x.html" failed
(2: No such file or directory), client: 172.16.7.1, server:
example.com, request: "GET / HTTP/1.1", u pstream:
"fastcgi://127.0.0.1:9000", host: "athoz-sales.azurewebsites.net"
2021/09/13 17:58:36 [error] 71#71: *93 open()
"/home/site/wwwroot/favicon.ico" failed (2: No such file or
directory), client: 172.16.7.1, server: example.com, request: "GE T
/favicon.ico HTTP/1.1", host: "athoz-sales.azurewebsites.net",
referrer: "https://athoz-sales.azurewebsites.net/"
Can you please help me how to troubleshoot this problem and continue with the Wordpress Site installation.
Thank you very much.

Nginx Cloudflare Wordpress Intermittent 521 Error

I have multiple Wordpress sites running on an EC2 instance. The instance runs nginx, and I configure the 2 wordpress sites and three static html sites to folders in /var/www/html.
Every few weeks, the entire thing goes down and I can't figure out why. There are a number of errors in the /var/log/nginx-error.log file. I can always restart the server with service nginx restart.
I'm not sure if this is because I have multiple sites or if someone has been hacking into my server. I have turned off comments on all of my sites to avoid potential issues.
The site receives very little real traffic, but Cloudflare is telling me there have been 17,885 requests in the last month.
Is there a way I can save this server so it doesn't continuously fall over?
Here are the final few rows of the error file from the latest fail. Happy to post more if it will help.
2021/01/05 17:44:19 [error] 15327#0: *43617 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 172.68.239.172, server: coreygarvey.com, request: "GET /up.php HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 18:04:18 [error] 15327#0: *43622 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 172.69.62.221, server: coreygarvey.com, request: "GET /wp-login.php HTTP/1.1", host: "www.coreygarvey.com", referrer: "http://coreygarvey.com/wp-login.php"
2021/01/05 19:34:26 [error] 15327#0: *43674 open() "/var/www/html/home/.env" failed (2: No such file or directory), client: 108.162.216.185, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "coreygarvey.com"
2021/01/05 19:34:26 [error] 15327#0: *43674 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 108.162.216.185, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "coreygarvey.com"
2021/01/05 19:58:22 [error] 15327#0: *43699 open() "/var/www/html/home/owa/auth/logon.aspx" failed (2: No such file or directory), client: 192.241.209.91, server: coreygarvey.com, request: "GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1", host: "52.7.66.46"
2021/01/05 19:58:22 [error] 15327#0: *43699 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 192.241.209.91, server: coreygarvey.com, request: "GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1", host: "52.7.66.46"
2021/01/05 20:05:39 [error] 15327#0: *43713 open() "/var/www/html/home/.env" failed (2: No such file or directory), client: 162.158.79.160, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 20:05:39 [error] 15327#0: *43713 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 162.158.79.160, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 20:18:46 [error] 15327#0: *43722 open() "/var/www/html/home/robots.txt" failed (2: No such file or directory), client: 108.162.246.22, server: coreygarvey.com, request: "GET /robots.txt HTTP/1.1", host: "coreygarvey.com"
2021/01/05 20:18:46 [error] 15327#0: *43722 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 108.162.246.22, server: coreygarvey.com, request: "GET /robots.txt HTTP/1.1", host: "coreygarvey.com"
2021/01/05 20:25:00 [error] 15327#0: *43725 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 173.245.52.168, server: coreygarvey.com, request: "GET /wp-content/plugins/ioptimizations/IOptimizes.php?hamlorszd HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 20:25:00 [error] 15327#0: *43727 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 162.158.62.203, server: coreygarvey.com, request: "GET /blog/wp-content/plugins/ioptimizations/IOptimizes.php?hamlorszd HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 20:25:03 [error] 15327#0: *43729 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 162.158.154.198, server: coreygarvey.com, request: "GET /wp/wp-content/plugins/ioptimizations/IOptimizes.php?hamlorszd HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 20:25:03 [error] 15327#0: *43729 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 162.158.154.198, server: coreygarvey.com, request: "GET /wordpress/wp-content/plugins/ioptimizations/IOptimizes.php?hamlorszd HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 22:23:03 [error] 15327#0: *43807 open() "/var/www/html/home/robots.txt" failed (2: No such file or directory), client: 162.158.78.139, server: coreygarvey.com, request: "GET /robots.txt HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 22:23:03 [error] 15327#0: *43807 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 162.158.78.139, server: coreygarvey.com, request: "GET /robots.txt HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 22:48:13 [error] 15327#0: *43836 open() "/var/www/html/home/.env" failed (2: No such file or directory), client: 40.86.206.98, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "52.7.66.46"
2021/01/05 22:48:13 [error] 15327#0: *43836 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 40.86.206.98, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "52.7.66.46"
We encountered ioptimizations (your log mentions /wordpress/wp-content/plugins/ioptimizations/IOptimizes.php) a year back, its pure malware, inspect the code, it creates a form to upload a file, and it will execute it (and can thus install more garbage). My bet is that this is where your troubles come from.
We use Wordfence as protection on the Wordpress website, it blocks anything that tries te execute outside of Wordpress, so it could do no damage in our case (so I recommend using it).
We have tried informing Wordpress dev team about this. Just having a malicious plugin is one thing, but how it manages to install itself on its own on your website is a serious concern (and would imply some vulnerability in Wordpress being exploited). But our complaints got ignored, and there is a serious lack of information to be found on this when try to google it (I happened to stumble upon yours to see if there was more information about it by now).
So I would recommend anti malware plugins (wordfence) and do a thorough cleaning, make sure to get rid of ioptimizations and look for any other damage it might have caused.
This is my first post on stackoverflow, I hope I did this right.
Good luck!

nginx + nodejs proxy error

2017/10/10 10:22:26 [crit] 1289#0: *1 connect() to 127.0.0.1:8080 failed (13: Permission denied) while connecting to upstream, client: 81.x.x.x, server: _, request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:8080/", host: "mydomain.com"
why does this not work?
I can access the 127.0.0.1:8080 via curl but nginx just displays a 502 error
Fixed this by disabling SELinux which should not have been enabled in the first place.

WordPress Crashing, nginx and fastcgi issue?

I currently have this problem with my wordpress website where it will work for about a day after a server restart, but then hit this set of errors:
2015/12/15 22:06:42 [crit] 12650#0: *28 connect() to unix:/var/run/php5-fpm.sock failed (2: No such file or directory) while connecting to upstream, client: 46.166.139.20, server: example.com, request: "POST /xmlrpc.php HTTP/1.0", $
2015/12/15 22:08:19 [error] 3216#0: *18 FastCGI sent in stderr: "PHP message: PHP Warning: trim() expects parameter 1 to be string, array given in /var/www/html/wp-includes/option.php on line 30
PHP message: PHP Warning: trim() expects parameter 1 to be string, array given in /var/www/html/wp-includes/option.php on line 30" while reading response header from upstream, client: 104.33.64.70, server: example.com, request: "P$
2015/12/15 22:40:08 [error] 3216#0: *197 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 180.76.15.142, server: example.com, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/$
2015/12/15 22:40:20 [error] 3216#0: *199 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 180.76.15.19, server: example.com, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/v$
2015/12/15 23:08:27 [error] 3216#0: *201 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 180.76.15.143, server: example.com, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/$
2015/12/15 23:08:39 [error] 3216#0: *203 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 180.76.15.12, server: example.com, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/v$
2015/12/15 23:20:20 [error] 3216#0: *205 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 104.33.64.70, server: example.com, request: "GET /wp-admin/upgrade.php?step=1&backto=%2Fwp$
2015/12/15 23:22:20 [error] 3216#0: *205 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 104.33.64.70, server: example.com, request: "GET /favicon.ico HTTP/1.1", upstream: "fastcg$
2015/12/15 23:57:09 [error] 3216#0: *367 connect() to unix:/var/run/php5-fpm.sock failed (11: Resource temporarily unavailable) while connecting to upstream, client: 46.166.139.20, server: example.com, request: "POST /xmlrpc.php HT$
2015/12/15 23:57:39 [error] 3216#0: *369 connect() to unix:/var/run/php5-fpm.sock failed (11: Resource temporarily unavailable) while connecting to upstream, client: 46.166.139.20, server: example.com, request: "POST /xmlrpc.php HT$
2015/12/15 23:57:41 [error] 3216#0: *371 connect() to unix:/var/run/php5-fpm.sock failed (11: Resource temporarily unavailable) while connecting to upstream, client: 46.166.139.20, server: example.com, request: "POST /xmlrpc.php HT$
2015/12/15 23:57:56 [error] 3216#0: *373 connect() to unix:/var/run/php5-fpm.sock failed (11: Resource temporarily unavailable) while connecting to upstream, client: 46.166.139.20, server: example.com, request: "POST /xmlrpc.php HT$
Afterwards, the error log just repeats that (11: Resource temporarily unavailable) code over and over. At this point trying to access the website itself just gives an nginx "an error has occurred" page, telling me to check error logs.
I don't know what exactly is causing the initial holdup, and it looks like after a few time outs the server just locks up entirely. Any advice? Thanks!
Someone from 46.166.139.20 tries to guess your password. If you don't use WP's XML-RPC you should disable it.

Kibana/nginx could not connect to elasticsearch

I have Elasticsearch and Kibana with nginx running on a EC2 instance but Kibana/nginx is not able to connect to Elasticsearch and I'm getting "Error Could not contact Elasticsearch at xxxxxxxx. Please ensure that Elasticsearch is reachable from your system".
When I see the nginx error logs, I get -
[error] 13067#0: *1 access forbidden by rule, client: xxxxx, server: 127.0.0.1, request: "GET /index.html HTTP/1.1", host: "xxxxx"
[error] 13283#0: *14 no user/password was provided for basic authentication, client: xxxxx, server: xxxxxx, request: "GET //cgi-bin/php5 HTTP/1.1", host: "xxxxx"
My conf file is - http://pastebin.com/JuxifP2n

Resources