0

Magento 1.9.1.0 with the Porto theme

VPS with:

SSD hard disk 
6144 MB of RAM 
8 Cores CPU

The load has been very high - it started yesterday where it was consistently around 20. I contacted the hosting and they kept saying I just need a dedicated server blah blah but it worked fine before (for years and even on worse hardware than what I have now).

Today - they wrote me this:

  1. Currently the load on the server was high due to our server being hit from this IP: 64.20.37.67. It had 553 hits on our website in less then an hour. This looked like an attack so they blocked it from our server.
  2. We have also many hits from all kinds of bots, and when they have too many requests at the website at once it also causes the load to spike. Should I/can I block all the bots except for Google? They do recommend that I should: "...check your website and protect it a bit more in regards to unknown bots."
  3. I suppose to make sure all of my files and folders have correct permissions (folders 755, and files 644) since unsecured permissions can also get our website under attack. How is it with the file and folder permissions? Which ones need the 777 and which ones don't?

Any other suggestions? :-*

  • Do you have all the last patches installed ? – Raphael at Digital Pianism Oct 3 '16 at 14:53
  • no - I tried to upgrade to 1.9.2.4 but it crashed the site and it took all day to restore from a backup. What do I need to do? – Allysin Oct 3 '16 at 15:16
  • First go to magereport.com to check what patches you need ? Then install the patches one by one by downloading them from the magento website – Raphael at Digital Pianism Oct 3 '16 at 15:17
2

Which ones need the 777 and which ones don't?

No directories should have 777 permissions. If 755 does not work for you, change group permissions instead.

Look at the files created by Magento to see with which user PHP runs:

ls -la media/catalog/product/cache

you'll see something like this in the first line:

drwxrwx---  7 web-user web-user  4096 Sep 21 12:27 .

which tells you, the user is "web-user"

If your SSH/SFTP login is the same, chmod 0755 for directories and chmod 0644 for files is sufficient, even a more restrictive 700 and 600 should work.

But your login is probably different. In that case, make sure that you belong to the PHP user's group. Type

groups

to see which groups you belong to. If you see the one from above (web-user in my example), that's great. If not, let your hoster know that in order to set secure permissions they should add you to this group.

Then only the following permissions are needed:

  • 770 for /media and /var
  • 750 for all other directories
  • 640 for files

That being said: The statement

unsecured permissions can also get our website under attack

is technically correct but this nothing to do with your current problem (high load due to bots or dos attacks)

What you can do:

  • block IPs on a case to case base, as you are already doing
  • use a monitoring or profiling tool to find out which requests are problematic, then figure out a way to optimize them: optimize database queries, improve/add caching, block certain requests or requests that come in high frequency altogether
| improve this answer | |
2

use:

Linux Malware Detect

Linux Malware Detect (LMD) is a malware scanner for Linux released under the GNU GPLv2 license, that is designed around the threats faced in shared hosted environments. It uses threat data from network edge intrusion detection systems to extract malware that is actively being used in attacks and generates signatures for detection.

csf firewall

A Stateful Packet Inspection (SPI) firewall, Login/Intrusion Detection and Security application for Linux servers.

file2ban

Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, courier, ssh, etc).

.htaccess filters

Bad Bot Blocker

223 Apache htaccess rules to block bad bots.

Bad bots are defined as:

E-mail harvesters Content scrapers Spam bots Vulnerability scanners Aggressive bots that provide little value Bots linked to viruses or malware Government surveillance bots Russian search engine Yandex Chinese search engine Baidu

csf firewall conflicts with fail2ban, use either one.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.