Problems with main web page going down

[madmadeline]

I have been having a reoccurring problem where my unRaid main web site goes down after a couple of days.  I am currently on 6.10 Beta.  I'm still able to Telnet to server and all my shares are accessible.  All apps installed continue to run without problems.

 

Are there any other questions I need to answer?

 

Thanks for the help and please help!

 

Is it normal that I have so many attempts to ssh my box from the outside world?

syslog.zip

[JonathanM]

Disable all ports forwarded through your router to unraid and see if the issue continues.

[madmadeline]

Will do.  Are you thinking the attempts on the box are causing the box to crash?

 

[JonathanM]

Possible to likely. Unraid is not hardened at all, especially the web gui. It's much preferable to set up a VPN if you want to access your server from outside your router.

[madmadeline]

Sure.  I only had one port open for Plex.  All others are closed.

 

What can I do about Plex?

 

To confirm, all those failed attempts are someone trying to ssh to my box, correct?

[JonathanM]

That snippet of syslog sure looks like your unraid box is in the DMZ for your router, and is taking heavy attacks from outside. Are you SURE only 1 port was forwarded? Did you perhaps put the unraid IP into the DMZ to test out something and forgot to disable it?

[madmadeline]

Checking right now.

[madmadeline]

Something was definitely up with my AT&T firewall.  I found the hole, reset the firewall and fixed the problem.  Really weird problem as one of my devices, an iPod, was on the network and mapped to my static IP address running in the DMZ.  I could not reset it. Problem was not my unRaid box, but it was the subject of the attacks.  Anyway, locked down tight now.

 

Thanks for the help.

[madmadeline]

Ok.  I spoke too soon.  I seem to be having a firewall issue with my AT&T uVerse router.  I shut down all port forwarding and confirmed  that all ports are shut down.

 

Installing Wireshark right now to go deeper.  My question for unRaid users is that if my log files shows ip addresses trying to ssh into my unRaid box then i must presume they are getting past my firewall.  Firewall logging is pretty weak and i have no control.

 

Can someone please help me confirm that if my log file is showing all these requests to log on, then the log file is capturing an attempted login.

[dgaschk]

The log files shows attempted logins form all over the world. Enter any of the addresses in http://www.iplocation.net