Forum Replies Created

Viewing 2 replies - 1 through 2 (of 2 total)
  • Thread Starter hellovintagepost

    (@hellovintagepost)

    Yikes scary. Thanks so much for your quick replies!

    To their defence, they didn’t know about the hack. I didn’t know it was kept in the same location so thought it was irrelevant. (dumb me) But they have received that email so should know about it now and are hopefully sorting it out. I haven’t heard from them yesterday so hopefully they are working on it.

    I’ll give them one more chance as they have been amazing up until now. Done so much great work on the site I’m otherwise really impressed with them and don’t want to lose the relationship. Hopefully they can nut out the issue.

    Do you have anything I can send to them that may give them a clue as to what is happening? Where they should start or check?

    Thread Starter hellovintagepost

    (@hellovintagepost)

    Thanks so much Catacaustic.
    I have showed that to the hosts, and have done lots of scans and come back to me with this…

    Trish,

    It looks like the index.php and some admin attempts are hanging for some reason – I can see what looks like a hang on file descriptor 4, so it’s likely to be a code error causing this. It’s not a server problem; we would have had other reports from the other users on the server.

    When I attach to the index.php process, it is hanging on read for some reason – not normal behaviour, though I’m unsure of the cause. Something in the code no doubt.

    Something to give your developer with more notes below:

    root@laika [/home/trishhun/public_html/thevintagepost.com.au/test]# ps -ef | grep trishh
    trishhun 21661 21587 0 13:35 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 22032 21999 0 13:35 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 22436 21595 2 13:36 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 22677 21566 0 13:36 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/index.php
    root 22691 1916 0 13:36 pts/2 00:00:00 grep trishh
    root@laika [/home/trishhun/public_html/thevintagepost.com.au/test]# strace -p 21661
    Process 21661 attached – interrupt to quit
    read(3, <unfinished …>
    Process 21661 detached
    root@laika [/home/trishhun/public_html/thevintagepost.com.au/test]# ps -ef | grep trishh
    trishhun 21661 21587 0 13:35 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 22032 21999 0 13:35 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 22436 21595 0 13:36 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 22926 22543 0 13:36 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 23185 21998 1 13:37 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 23357 22517 0 13:37 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/index.php
    root 23364 1916 0 13:37 pts/2 00:00:00 grep trishh

    Note that the number of queued jobs rises over time!! So something is definitely wrong.

    I connected to a number of jobs and they are all hanging reading from file descriptor 3 – which is a socket in this case. This could be due to a file open (or similar) failing and the code not catching the failure and then cascading into some other code reading the wrong file descriptor.

    I’d prefer this be tested on another server as you can see the processes are accumulating and affecting other users.

    5 mins later:
    root@laika [/home/trishhun/public_html/thevintagepost.com.au/test]# ps -ef | grep trishh
    trishhun 21661 21587 0 13:35 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 22032 21999 0 13:35 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 22436 21595 0 13:36 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 22926 22543 0 13:36 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 23185 21998 0 13:37 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 23406 22785 0 13:37 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 23640 21969 0 13:38 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 23877 23688 0 13:38 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 24134 23435 0 13:39 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 24530 24516 0 13:40 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 24771 23587 1 13:40 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 24960 24607 6 13:41 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/thevintagepost.com.au/test/wp-admin/admin-ajax.php
    trishhun 25015 22545 44 13:41 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/index.php
    trishhun 25031 24880 28 13:41 ? 00:00:00 /usr/bin/php /home/trishhun/public_html/index.php
    root 25034 1916 0 13:41 pts/2 00:00:00 grep trishh

    Cheers,

    and then another email from the hosting…

    Hi Trish,

    I was able to run an export of the database without apparent problems and the exported file is in trishhun_tvpdb.sql.gz in your home folder. It looks like, in that mysqldump output, that no data was exported for those tables as the developers say so it’s possible the database is corrupted. if so, cpanel offers repair options or the devs can revert to one of their backups.

    What I sent previously showed that the site is hanging on a read of an unknown file descriptor. I think it’s likely that’s a code problem, not a mysql problem. At this stage though, as I’ve been able to export the database, I’d say that excludes a database problem.

    It might be an idea for the devs to install Wordfence and run a check of all files to ensure the hacks of the parent site haven’t propagated into the test site – just a thought.

    Also, it looks like the developers have mixed the test site in with the production database – in fact, there are now 3 sites in the one database! This is terrible development practice and means that during development it’s possible (and easy) to corrupt the main database, and difficult to isolate the databases for the separate sites. Best practice is to separate the databases and that should be done here to avoid future maintenance problems. I understand they’re using different prefixes, and that’s a great idea, but each site should be done in a separate database.

    Does this help at all? *stress head*

Viewing 2 replies - 1 through 2 (of 2 total)