Nginx Cloudflare Wordpress 间歇性 521 错误

Question

我在一个 EC2 实例上运行了多个 Wordpress 站点。该实例运行 nginx，我将 2 个 wordpress 站点和三个静态 html 站点配置到 /var/www/html 中的文件夹。

每隔几个星期，整个事情就会崩溃，我不知道为什么。 /var/log/nginx-error.log 文件中有许多错误。我总是可以用service nginx restart重新启动服务器。

我不确定这是因为我有多个网站还是有人入侵了我的服务器。我已关闭所有网站上的 cmets 以避免潜在问题。

该网站收到的实际流量很少，但 Cloudflare 告诉我上个月有 17,885 个请求。

有什么方法可以保存此服务器，使其不会不断倒下？

这是最近失败的错误文件的最后几行。如果有帮助，很高兴发布更多内容。

2021/01/05 17:44:19 [error] 15327#0: *43617 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 172.68.239.172, server: coreygarvey.com, request: "GET /up.php HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 18:04:18 [error] 15327#0: *43622 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 172.69.62.221, server: coreygarvey.com, request: "GET /wp-login.php HTTP/1.1", host: "www.coreygarvey.com", referrer: "http://coreygarvey.com/wp-login.php"
2021/01/05 19:34:26 [error] 15327#0: *43674 open() "/var/www/html/home/.env" failed (2: No such file or directory), client: 108.162.216.185, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "coreygarvey.com"
2021/01/05 19:34:26 [error] 15327#0: *43674 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 108.162.216.185, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "coreygarvey.com"
2021/01/05 19:58:22 [error] 15327#0: *43699 open() "/var/www/html/home/owa/auth/logon.aspx" failed (2: No such file or directory), client: 192.241.209.91, server: coreygarvey.com, request: "GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1", host: "52.7.66.46"
2021/01/05 19:58:22 [error] 15327#0: *43699 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 192.241.209.91, server: coreygarvey.com, request: "GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1", host: "52.7.66.46"
2021/01/05 20:05:39 [error] 15327#0: *43713 open() "/var/www/html/home/.env" failed (2: No such file or directory), client: 162.158.79.160, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 20:05:39 [error] 15327#0: *43713 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 162.158.79.160, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 20:18:46 [error] 15327#0: *43722 open() "/var/www/html/home/robots.txt" failed (2: No such file or directory), client: 108.162.246.22, server: coreygarvey.com, request: "GET /robots.txt HTTP/1.1", host: "coreygarvey.com"
2021/01/05 20:18:46 [error] 15327#0: *43722 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 108.162.246.22, server: coreygarvey.com, request: "GET /robots.txt HTTP/1.1", host: "coreygarvey.com"
2021/01/05 20:25:00 [error] 15327#0: *43725 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 173.245.52.168, server: coreygarvey.com, request: "GET /wp-content/plugins/ioptimizations/IOptimizes.php?hamlorszd HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 20:25:00 [error] 15327#0: *43727 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 162.158.62.203, server: coreygarvey.com, request: "GET /blog/wp-content/plugins/ioptimizations/IOptimizes.php?hamlorszd HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 20:25:03 [error] 15327#0: *43729 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 162.158.154.198, server: coreygarvey.com, request: "GET /wp/wp-content/plugins/ioptimizations/IOptimizes.php?hamlorszd HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 20:25:03 [error] 15327#0: *43729 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 162.158.154.198, server: coreygarvey.com, request: "GET /wordpress/wp-content/plugins/ioptimizations/IOptimizes.php?hamlorszd HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 22:23:03 [error] 15327#0: *43807 open() "/var/www/html/home/robots.txt" failed (2: No such file or directory), client: 162.158.78.139, server: coreygarvey.com, request: "GET /robots.txt HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 22:23:03 [error] 15327#0: *43807 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 162.158.78.139, server: coreygarvey.com, request: "GET /robots.txt HTTP/1.1", host: "www.coreygarvey.com"
2021/01/05 22:48:13 [error] 15327#0: *43836 open() "/var/www/html/home/.env" failed (2: No such file or directory), client: 40.86.206.98, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "52.7.66.46"
2021/01/05 22:48:13 [error] 15327#0: *43836 open() "/var/www/html/home/404.html" failed (2: No such file or directory), client: 40.86.206.98, server: coreygarvey.com, request: "GET /.env HTTP/1.1", host: "52.7.66.46"

Answer 1

一年前我们遇到过 ioptimizations（您的日志提到 /wordpress/wp-content/plugins/ioptimizations/IOptimizes.php），它是纯恶意软件，检查代码，它会创建一个表单来上传文件，然后它会执行它（因此可以安装更多垃圾）。我敢打赌，这就是你的麻烦所在。

我们在 Wordpress 网站上使用 Wordfence 作为保护，它会阻止尝试在 Wordpress 之外执行的任何内容，因此在我们的案例中它不会造成任何损害（因此我建议使用它）。

我们已尝试将此通知 Wordpress 开发团队。仅仅拥有一个恶意插件是一回事，但它如何设法在您的网站上自行安装是一个严重的问题（并且意味着 Wordpress 中的某些漏洞被利用）。但是我们的投诉被忽略了，当尝试用谷歌搜索时，严重缺乏这方面的信息（我碰巧偶然发现了你的信息，看看现在是否有更多信息）。

所以我会推荐反恶意软件插件（wordfence）并进行彻底清理，确保摆脱 ioptimizations 并寻找它可能造成的任何其他损害。

这是我在 stackoverflow 上的第一篇文章，希望我做得对。 祝你好运！