Moodle in English: Site Down due to security problem!!!!! HELP

Site Down due to security problem!!!!! HELP

by Nima Zarin Parsa - Tuesday, June 2, 2020, 11:23 PM

I have recently upgrade from 3.8.0 Moodle to the last version.

My host company suspended my account telling me that they received below security warnings from their firewall.

I really dont understand what are these & how to solve.

My website is down & I am frustrated.

this is the log which they sent to me:

Scanning /home/expertac/public_html:

'/home/expertac/public_html/moodle/admin/tool/installaddon/tests/installer_test.php'
Regular expression match = [\n(?!\s*(//|\#|\*)).*/etc/passwd]

'/home/expertac/public_html/moodle/admin/tool/installaddon/tests/fixtures/testable_installer.php'
Regular expression match = [\n(?!\s*(//|\#|\*)).*/etc/passwd]

'/home/expertac/public_html/moodle/backup/converter/moodle1/tests/moodle1_converter_test.php'
Regular expression match = [\n(?!\s*(//|\#|\*)).*/etc/passwd]

'/home/expertac/public_html/moodle/cache/stores/redis/version.php'
Script version check [OLD] [Moodle v3.0.4 (Build: 20160509) < v3.8.2]

'/home/expertac/public_html/moodle/enrol/autoenrol/version.php'
Script version check [OLD] [Moodle v2.1.1 < v3.8.2]

'/home/expertac/public_html/moodle/filter/oembed/version.php'
Script version check [OLD] [Moodle v3.8.0 (Build - 2019112600) < v3.8.2]

'/home/expertac/public_html/moodle/filter/tex/mimetex.exe'
MS Windows Binary/Executable [application/x-winexec]

'/home/expertac/public_html/moodle/filter/tex/mimetex.freebsd'
Linux Binary/Executable [application/x-executable]

'/home/expertac/public_html/moodle/filter/tex/mimetex.linux'
Linux Binary/Executable [application/x-executable]

'/home/expertac/public_html/moodle/lib/antivirus/clamav/classes/scanner.php'
Regular expression match = [\n(?!\s*(//|\#|\*)).*/etc/passwd]

'/home/expertac/public_html/moodle/lib/behat/classes/behat_config_manager.php'
Regular expression match = [symlink\s*\(]

'/home/expertac/public_html/moodle/lib/editor/tinymce/version.php'
Script version check [OLD] [Moodle v3.5.11 < v3.8.2]

'/home/expertac/public_html/moodle/lib/tcpdf/include/tcpdf_fonts.php'
Regular expression match = [symlink\s*\(]

'/home/expertac/public_html/moodle/lib/tests/filestorage_zip_archive_test.php'
Regular expression match = [\n(?!\s*(//|\#|\*)).*/etc/passwd]

'/home/expertac/public_html/moodle/lib/tests/moodlelib_test.php'
Regular expression match = [\b0day]

'/home/expertac/public_html/moodle/lib/tests/scss_test.php'
Regular expression match = [\n(?!\s*(//|\#|\*)).*/etc/passwd]

'/home/expertac/public_html/moodle/lib/tests/upgradelib_test.php'
Universal decode regex match = [universal decoder]

'/home/expertac/public_html/moodle/local/contact/version.php'
Script version check [OLD] [Moodle v1.0.0 < v3.8.2]

'/home/expertac/public_html/wp-content/languages'
World writeable directory

'/home/expertac/public_html/wp-content/languages/plugins'
World writeable directory

Re: Site Down due to security problem!!!!! HELP

by Howard Miller - Wednesday, June 3, 2020, 12:50 AM

You'd better find a different host then...

Their tests appear to be true but they're not security problems in Moodle.

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Leon Stringer - Wednesday, June 3, 2020, 1:11 AM

These mainly look like false positives. For example, the first one:

'/home/expertac/public_html/moodle/admin/tool/installaddon/tests/installer_test.php'
Regular expression match = [\n(?!\s*(//|\#|\*)).*/etc/passwd]

This looks like it's complaining because the string "/etc/passwd" has been found in file admin/tool/installaddon/tests/installer_test.php. But if we check this file in the official version control repository we find that this string is supposed to be there.

All of the listed issues are similar false positives except for:

'/home/expertac/public_html/wp-content/languages'
World writeable directory

'/home/expertac/public_html/wp-content/languages/plugins'
World writeable directory

These are WordPress directories and nothing to do with Moodle. You should check the WordPress documentation for the recommended directory permissions.

So aside from the WordPress directories, everything looks correct. Once you've reviewed the WordPress directories you'll need to go back to the hosting company and tell them that the items they've flagged are the correct files and ask them to unblock your site or to provide further information as to why the site is blocked.

If they do not assist you I'd recommend looking for a better hosting company.

Average of ratings:Useful (1)

Re: Site Down due to security problem!!!!! HELP

by Visvanath Ratnaweera - Wednesday, June 3, 2020, 1:21 AM

From a layman's (no security expert) point of view, the fundamental question is whether the code your host is complaining about are part of the Moode distribution or whether somebody has smuggled malicious code? I didn't check the list, but the code in the first complaint:
> 'moodle/admin/tool/installaddon/tests/installer_test.php'
> Regular expression match = [\n(?!\s*(//|\#|\*)).*/etc/passwd]d
is there in the Moodle in a slightly different form:
public function test_get_addons_repository_url() {
$installer = testable_tool_installaddon_installer::instance();
$url = $installer->get_addons_repository_url();
$query = parse_url($url, PHP_URL_QUERY);
$this->assertEquals(1, preg_match('~^site=(.+)$~', $query, $matches));
$site = rawurldecode($matches[1]);
$site = json_decode(base64_decode($site), true);
$this->assertInternalType('array', $site);
$this->assertEquals(3, count($site));
$this->assertSame('Nasty site', $site['fullname']);
$this->assertSame('file:///etc/passwd', $site['url']);
$this->assertSame("2.5'; DROP TABLE mdl_user; --", $site['majorversion']);
);

So, the hosting company does not want Moodle.

Side note:
> 'wp-content/languages'
> World writeable directory

That is odd. Half the World Wide Web traffic is WordPress (not counting video). This hosting company doesn't know WordPress?

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Nima Zarin Parsa - Wednesday, June 3, 2020, 3:09 AM

Thanks all,

I talked with host company & said that these files are normal in Moodle. They surprisingly said "that these files are searched & found by "SOFTWARE"",
Me: what the hell????
Then they claimed that the main problem is that your website sends spam emails!!
I remembered that exactly after putting a site announcement this problem occurred. This means that notification emails for announcements are recognized as spam by Host.

I am trying to set SMTP of gmail for not using default host email in this regard. But not succeeded also.
Its hard for me changing the host also I am not sure if the new host will be better or not.
I am struggling!

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Visvanath Ratnaweera - Wednesday, June 3, 2020, 3:44 AM

Yes, we all see that you are struggling: error 524 when clicking on "Site Administration". It is hard to understand why you don't have a choice in the Web.

The outgoing e-mail (SMTP) topic is something different. Please start a new thread for a new question.

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Nima Zarin Parsa - Wednesday, June 3, 2020, 4:36 AM

Yeah, So much problems,
Recently the host said that they limited the email quantity to 20No/hour and want more fee for more emails.
This cause a lot of problems.
I have the option to migrate to Greengeeks host which I owned in Canada. Maybe tommorrow I have to do it.
I dont know exactly how to do it safely. I can backup DB+Files. Then how to restore....

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Visvanath Ratnaweera - Wednesday, June 3, 2020, 4:51 AM

Avoid doing the site migration under pressure. Quit your provider giving them notice long enough for you to practice the https://docs.moodle.org/en/Moodle_migration.

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Nima Zarin Parsa - Saturday, June 6, 2020, 2:30 PM

Thanks Everybody,

I really appreciate!

I decided to migrate the website to GreenGeeks host. I tried too maintain this situation but the old host didnt help me. Their so called firewall blocked my interactions randomly, also I always was in afraid of putting anything to site announcements due to the email notification limitation of the host.

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Marcus Green - Sunday, June 7, 2020, 5:58 AM

Which of their plans are you thinking of buying?

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Nima Zarin Parsa - Sunday, June 7, 2020, 1:23 PM

I bought a "Pro" plan 2 months ago. Price is 5.95$/m now. Their support is very nice & fast. Always online.

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Marcus Green - Sunday, June 7, 2020, 3:37 PM

The one in the middle here?
https://www.greengeeks.com/web-hosting
Let us know how it goes with that.

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Nima Zarin Parsa - Sunday, June 7, 2020, 4:54 PM

Yes

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Rick Jerz - Sunday, June 7, 2020, 8:35 PM

I do not know about every hosting company and what they can or cannot do. However, the middle plan looks like a "hosted" server, and many of these cannot run Moodle because they do not meet Moodle's minimum requirements. Make sure that you can get a refund if you find that Moodle doesn't work. Also, do not install Moodle with any "one-click" utility from your hosting company or you will continue to have problems. Make sure to install Moodle from scratch.

Unfortunately, right now with most hosting companies, a VPS is required to run Moodle. But again, I don't know about greengeeks, maybe their low-cost servers will work. I am just providing a small warning.

Average of ratings:Useful (1)

Re: Site Down due to security problem!!!!! HELP

by Marcus Green - Monday, June 8, 2020, 12:08 AM

I pay $USD11 a month for a Virtual server with Digital Ocean. That is my own money and nothing to do with my job working with Moodle. I know several other people who use them to good effect. The downside is that it might require a little more learning than a hosted solution, but they seem very good.

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Rick Jerz - Monday, June 8, 2020, 3:32 AM

Yep, I could not remember "Digital Ocean." I still need to give them a try.

Average of ratings: -

Re: Site Down due to security problem!!!!! HELP

by Howard Miller - Monday, June 8, 2020, 3:56 AM

Another vote for DO.

I don't use them for Moodle. I use them for everything else - but the service is very good. I just have a "vanilla" Ubuntu server install. No nasty panels

Average of ratings:Useful (1)

Installing and upgrading help

Site Down due to security problem!!!!! HELP