Facebook
TwitterWorld eSports
New Pleskian
- Server operating system version
- Alma_Linux
- Plesk version and microupdate number
- Plesk Obsidian 18.0.75 Web Host Edition
Hey there Plesk community!
I am creating this post because recently I enabled remote backup. I have a dedicated server with (plesk obsidian) and a vps (cloudpanel). I backed up plesk remotely to the VPS. It was successful in backing up the plesk installation. Yes, I know I could not restore these backups to CloudPanel nor am I trying too. I was just storing plesk backups on the VPS. I did not restore any of the backups however. Well, the very next day one of my websites in plesk is down throwing 403 errors throughout. I check the filesystem and noticed in my /public directory (it runs laravel) that there were wp directories such as wp-content, wp-admin, and wp-includes. For those who do not know, the /public directory in laravel is where the application is served inside index.php. Even the index.php was altered and had ini_set() and _GET statements that should never be inside index.php. At first I thought maybe there was a glitch in the backup process and it made a mistake by installing wp directories into a laravel site. Then I realized that I am not even using wp-toolkit for any website so it should have never been touched or even used in the backup. Even my file permissions for the /public directory was changed in an attempt to lock out the admin role from altering the files albeit they could not crack the admins password. I also found .htaccess files throughout the project directories and laravel does not use .htaccess lol nor does plesk add .htaccess files to existing laravel toolkit projects. I have never seen this type of behavior in Plesk, even when using remote backup. I could understand if it was just the wp directories as I do have wp-toolkit installed but not being used.
I deleted all those files from the /public directory yesterday (enabled the backup a couple days prior). I logged in today and guess what? All of those files are present again including the altered index.php.
I only have one question for y'all: was my server hacked or did i botch the backup process? If it is compromised, does anyone have a solution how to lock it down without reinstalling the entire server? I do have DDoS protection from my hosting provider (OVHCloud) but not application-layer protection.
Note: I had turned off ModSecurity because I thought it was blocking client http requests from the frontend. Turns out it was but I disabled the rule and added headers to the http request and they stopped getting blocked. However, I forgot to put ModSecurity back into detection mode. I know its my fault for not turning back on ModSecurity but fail2ban was still on as was the WAP for each domain in plesk.
I am creating this post because recently I enabled remote backup. I have a dedicated server with (plesk obsidian) and a vps (cloudpanel). I backed up plesk remotely to the VPS. It was successful in backing up the plesk installation. Yes, I know I could not restore these backups to CloudPanel nor am I trying too. I was just storing plesk backups on the VPS. I did not restore any of the backups however. Well, the very next day one of my websites in plesk is down throwing 403 errors throughout. I check the filesystem and noticed in my /public directory (it runs laravel) that there were wp directories such as wp-content, wp-admin, and wp-includes. For those who do not know, the /public directory in laravel is where the application is served inside index.php. Even the index.php was altered and had ini_set() and _GET statements that should never be inside index.php. At first I thought maybe there was a glitch in the backup process and it made a mistake by installing wp directories into a laravel site. Then I realized that I am not even using wp-toolkit for any website so it should have never been touched or even used in the backup. Even my file permissions for the /public directory was changed in an attempt to lock out the admin role from altering the files albeit they could not crack the admins password. I also found .htaccess files throughout the project directories and laravel does not use .htaccess lol nor does plesk add .htaccess files to existing laravel toolkit projects. I have never seen this type of behavior in Plesk, even when using remote backup. I could understand if it was just the wp directories as I do have wp-toolkit installed but not being used.
I deleted all those files from the /public directory yesterday (enabled the backup a couple days prior). I logged in today and guess what? All of those files are present again including the altered index.php.
I only have one question for y'all: was my server hacked or did i botch the backup process? If it is compromised, does anyone have a solution how to lock it down without reinstalling the entire server? I do have DDoS protection from my hosting provider (OVHCloud) but not application-layer protection.
Note: I had turned off ModSecurity because I thought it was blocking client http requests from the frontend. Turns out it was but I disabled the rule and added headers to the http request and they stopped getting blocked. However, I forgot to put ModSecurity back into detection mode. I know its my fault for not turning back on ModSecurity but fail2ban was still on as was the WAP for each domain in plesk.
