Hi everyone, I'm still relatively new to unraid and have had this issue for the last 24 hours, been looking for answers non stop but can't seem to find a solution. Plex cannot seem to connect to my server and I have no idea why, does anyone know? 

Thanks in advance!

mackiemedia-diagnostics-20210818-0932.zip

5 hours ago, DjW0mbat said:

Plex cannot seem to connect to my server

Unclear what you mean. Are you running Plex Server docker on your Unraid server, and your plex clients can't connect to it?

Or are you running Plex Server on another computer and it is trying to access Unraid storage for your media?

Apologies! My situation is the former, I am running binhex's Plex docker on my unraid server and all of a sudden I cannot access any of the content on my Unraid server through either the webui or other devices connected to my plex account (this was previously working well for around a month or so). 

 

Please let me know if you need to give any further clarifications, I really appreciate your responsiveness

Your logs are spammed by

Aug 17 18:53:54 MackieMedia sshd[4798]: Connection from 161.35.112.155 port 42640 on 192.168.1.54 port 22 rdomain ""
Aug 17 18:53:54 MackieMedia sshd[4768]: Failed password for root from 218.92.0.190 port 33988 ssh2
Aug 17 18:53:55 MackieMedia sshd[4798]: Invalid user mfg from 161.35.112.155 port 42640
Aug 17 18:53:55 MackieMedia sshd[4798]: pam_unix(sshd:auth): check pass; user unknown
Aug 17 18:53:55 MackieMedia sshd[4798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.112.155 
Aug 17 18:53:56 MackieMedia sshd[4768]: Received disconnect from 218.92.0.190 port 33988:11:  [preauth]
Aug 17 18:53:56 MackieMedia sshd[4768]: Disconnected from authenticating user root 218.92.0.190 port 33988 [preauth]
Aug 17 18:53:56 MackieMedia sshd[4768]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.190  user=root
Aug 17 18:53:57 MackieMedia sshd[4798]: Failed password for invalid user mfg from 161.35.112.155 port 42640 ssh2
Aug 17 18:53:58 MackieMedia sshd[4798]: Received disconnect from 161.35.112.155 port 42640:11: Bye Bye [preauth]
Aug 17 18:53:58 MackieMedia sshd[4798]: Disconnected from invalid user mfg 161.35.112.155 port 42640 [preauth]
Aug 17 18:54:05 MackieMedia sshd[4856]: Connection from 41.67.59.14 port 61304 on 192.168.1.54 port 22 rdomain ""
Aug 17 18:54:09 MackieMedia sshd[4856]: Invalid user support from 41.67.59.14 port 61304
Aug 17 18:54:09 MackieMedia sshd[4856]: pam_unix(sshd:auth): check pass; user unknown
Aug 17 18:54:09 MackieMedia sshd[4856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.67.59.14 
Aug 17 18:54:11 MackieMedia sshd[4856]: Failed password for invalid user support from 41.67.59.14 port 61304 ssh2
Aug 17 18:54:13 MackieMedia sshd[4856]: Received disconnect from 41.67.59.14 port 61304:11: Bye Bye [preauth]
Aug 17 18:54:13 MackieMedia sshd[4856]: Disconnected from invalid user support 41.67.59.14 port 61304 [preauth]
Aug 17 18:54:31 MackieMedia sshd[4952]: Connection from 185.253.185.42 port 56198 on 192.168.1.54 port 22 rdomain ""
Aug 17 18:54:31 MackieMedia sshd[4952]: Invalid user rosa from 185.253.185.42 port 56198
Aug 17 18:54:31 MackieMedia sshd[4952]: pam_unix(sshd:auth): check pass; user unknown
Aug 17 18:54:31 MackieMedia sshd[4952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.253.185.42 
Aug 17 18:54:33 MackieMedia sshd[4952]: Failed password for invalid user rosa from 185.253.185.42 port 56198 ssh2
Aug 17 18:54:35 MackieMedia sshd[4952]: Received disconnect from 185.253.185.42 port 56198:11: Bye Bye [preauth]
Aug 17 18:54:35 MackieMedia sshd[4952]: Disconnected from invalid user rosa 185.253.185.42 port 56198 [preauth]
Aug 17 18:54:49 MackieMedia sshd[5031]: Connection from 221.181.185.151 port 15357 on 192.168.1.54 port 22 rdoma

 

Is this activity normal ?

Is your server accessible directly on the internet ? (DMZ or other ?)

7 hours ago, ChatNoir said:

Is your server accessible directly on the internet ? (DMZ or other ?)

Apparently so.

 

@DjW0mbat

You need to fix this immediately. YOU ARE BEING HACKED!!!!

 

Just some examples from those already shown above:

https://www.abuseipdb.com/check/161.35.112.155  USA

https://www.abuseipdb.com/check/218.92.0.190   China

https://www.abuseipdb.com/check/41.67.59.14   Sudan

https://www.abuseipdb.com/check/185.253.185.42   Russia

 

And plenty of others in your syslog.

 

The internet is full of bots that will relentlessly try to get into your computers if you put them on the internet.

 

 

Oh wow this is super worrying!
 

I have immediately shut the server down. Is there anything in my diagnostics that could point to the problem? 

 

There are only two points that are open on my router, 82100 for WireGuard and 32400 for Plex. I also have a DynDns docker that tracks my IP address and that is liked to my cloudlfare to point to my domain, could any of these be the issue? 

 

Other than that I can’t think how the server would be accessible from the internet!
 

Really concerning, is there any evidence of anyone having gotten in?

 

Thanks in advance!

I didn't go through all your logs though, I am not really good at those security questions.

You might want to look at that :

 

 

Thanks @ChatNoir, I don't see anything in the above post that seems to be a clear deficiency, but I have created a new thread in the security forum, hoping someone will be able to point me in the right direction.

 

Thanks for flagging this!