0

For the last 4 days, somebody is constantly attacking my website , making it to go into SQLSTATE[HY000] [2006] MySQL server has gone away error. What he does basically is open up multiple pages , adds to cart several products, and/or adds to compare list. Then the site overloads and it goes dead, giving me the MySQL error. In addition, in WHM (i use a VPS) i have Server Load 27.39 (2 CPUs) which is very high. Every time, the hosting company has to kill his proceeses and ban his ip (which is constantnly changing). The requests on the server look like this :

supergeneratoare.ro:80 GET /putere?dir=desc&limit=all&order=price HTTP/1.1
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/401/uenc/aHR0cDovL3
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/362/uenc/aHR0cDovL3
supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/406/uenc/aHR0cDovL3
supergeneratoare.ro:80 GET /checkout/cart/ajaxDelete/id/3833/uenc/aHR0cDovL3d3dy5zdXBl
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/375/uenc/aHR0cDovL3

Now, i removed the add to compare function and add to cart function, and for a day it was good, but now he found a way to do it again, site is down again.

Can anybody help me with this ? Nor my programmer,nor the hosting company support don't know what's going on .

Improve this question
4
  • What makes you sure its an attack those look like normal URLs to me. Magento has a reputation for being resource hungry, so running on a shared server where there could be many people using it at once limiting your virtual server's resources could lead to high server load.
    – John Cuthbert
    May 19, 2015 at 6:56
  • Two Cpus is the bare minimum especially with MySQL running on the same VPS. That said, one way to combat this is to disallow access to the same session within a certain timeframe. This is rather complex as you need to make certain exemptions for Ajax requests. The plug and play solution comes in the form of a web application firewall that is capable of learning attack sequences rather then just request signatures.
    – user4351
    May 19, 2015 at 7:42
  • So you think i should increase VPS resources ?
    – Chris
    May 19, 2015 at 7:55
  • All those requests were coming from same IP. The pattern was like this : 1. site went down 4 days ago, hosting told me because of requests coming from one ip. Banned, server restart, everything was working fine. 2. site kept going down, because similar requests from different IPs, each time hosting had to kill processes and ban the IPs. ; Site was up and running for a month, it's seems rather strange that all of a sudden now there are not enough resources for it , don't you think ?
    – Chris
    May 19, 2015 at 8:01

1 Answer 1

Reset to default
0

post your mysqltuner.pl output

first of all you need to configure your server, make sure you have properly allocated resources, mysql has gone error means that you need to check your database config. it was discussed so many times in here, just use search.

with load average 27 you probably have a lot of processes running. not sure about your traffic sources, but these could be msn/bing bot
use rate/connection limits per location, especially for:
checkout|wishlist|customer

then you need to configure proper firewall rules. use cache

Improve this answer
2
  • Thanks for your answer ADM . My tech knowledge is not so great, what you said is more than i know to do. The processes always come from one IP, hence i thought it was an attack of some kind. I disabled compare function and add to cart function but it still found a way to put the site down , giving me that MYSQL error in return.Anyway i could hire your services ?
    – Chris
    May 19, 2015 at 13:12
  • 1
    you have the administration services included in your hosting package, it's time to kick ass of your support team and tell them to fix the problem.
    – user2857
    May 19, 2015 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.