Unexplained disk access and missing files on my server

[Gothan]

Hi everyone,

 

I've been having a problem for a few days with my Unraid server.
For several days, my Unraid server has been constantly accessing disks and I don't understand why. The activity of one or more hard drives is not visible on the main UI page which is supposed to show reads/writes to the drives.
I also notice that all my photos have disappeared from the disk on which they were stored: only the main directory is visible but all the subdirectories containing the photos have disappeared!
I don't know what is happening on the server and 2 or 3 restarts have not fixed the problem.
So I ran the diagnostic on the NAS and I attached the result file in the hope that someone can enlighten me on what happens when reading the files.
I sincerely hope that I haven't lost all of my personal photos....
Thank you in advance for your help.

node-diagnostics-20240214-1647.zip

[trurl]

Do you recognize these IP addresses?

Feb 13 13:49:32 NODE webGUI: Successful login user root from 77.128.153.87
Feb 13 23:16:23 NODE webGUI: Successful login user root from 81.250.250.99

Looks like one of these is definitely suspect

https://www.abuseipdb.com/check/77.128.153.87 FRANCE

 

Have you put your server on the internet?

[Gothan]

Hi,

 

I don't think that my NAS is connected to internet.

Can you help me to check if it is really the case because I don't recognize those IP addresses ?

 

Thanks for your help.

[trurl]

https://docs.unraid.net/unraid-os/manual/security/good-practices/

[Gothan]

I'm going to check but i'm pretty sure that my NAS is not connected to internet.

How you can explain that the HDD drives are working but nothing is visible on the HDD activity on the main page of the UI ?

The activity on the HDD(s) is going on even when the array is stopped.

I really don't know what to do at the moment and i really don't understand what is going on.....

[Gothan]

I've checked the configuration done in my router and here are the redirections regsrding the ports :

 

I'm not very knowledgeable about networks and redirections but after reading the document mentioned above I don't think my NAS is connected to the internet.
Please let me know if you think the setup is wrong.
If the problem is not external, what can explain these permanent disk accesses which are not seen in the disk activities page on the user interface and which occur even when the array is stopped ?
Thank you once again for any help you can give me.

[Mainfrezzer]

if 

"secure Shell Server _SSH_"
"Web Server _HTTP__TCP_80"
and to some extent
"Web Server _HTTP__TCP_1880"

"Secure Web Server _HTTPS__TCP_1444"

"Secure Web Server _HTTPS__TCP_18443"

link to your computer thats running unraid, you exposed it to the internet with a fancy invitation letter.

[Gothan]

OK, not a good news...

As previously said, I'm not knowledgeable on this point : what is your suggestion ?

The redirections regarding the Secure Web Server (Secure Web Server _HTTPS__TCP_14444) is not needed for Unraid Connect ?

I really appreciate any advice or any changes to make to secure my connection but also to understand why one of the disks (or several) has these accesses which I cannot explain.

 

Edited February 16 by Gothan

[Mainfrezzer]

Just now, Gothan said:

 

I also to understand why one of the disks (or several) has these accesses which I cannot explain.

given that you had successful logings from external ips, its a gamble, could be anything. File Activity plugin can help you to find out which files are being accessed but that should be the least of your worries now. 

[Gothan]

I've now deactived all the redirections, except the one for Unraid access.

i'm pretty sure that i've not been hacked because even if the redirection configuration was awful, i have a stroing password on the serevr and most of my share are in private mode.

 

Thinking about what Trurl says :

77.128.153.87 is pointing to SFR, my mobile phone provider. This can't be due to a connexion made from my phone through Unraid connect? I sometimes proceed like this when i'm not at home for my job.

 

And how to explain the huge amount of disks access (even when the array is stopped)?

 

Here is my configuration for the server :

I have 3 disks for the storage (6 To + 6 To + 12 To connected to the SATA connectors on the motherboard) + 1 parity disk (12 To) and 1 SSD disk for the cache (1 To - connected through a PCI SATA controller card because there's only 4 SATA ports on the motherboard).

Could this be a physical problem (the SATA controller card for example)

 

Everything were working properly for months with some disks access per minute (the activity led was blinking time to time). Since some days from now, the disks access are really huge and i can hear and see this huge activity that i can't explain. (the activity led is stay on all the time)...

 

Thank you once again for any help you can give me to resolve this issue.

 

Edited February 25 by Gothan

[Gothan]

Hi all,

 

At the end, the issue was due to the Fan Auto Control plugin : the refresh interval was set to 0 minutes.

I've reinstalled the system (the solution was not found at this time) and everything was fine and i was able to reproduce the problem.

 

Regards,