0

At some point yesterday the functions: file_get_contents, get_headers, and curl have stopped working with error: Connection refused. Ex:

Curl: (7) Failed to connect to www.alebalweb.com port 443: Connection refused.

I do not understand why, I was just uploading files and no one touched anything on the server. Until a moment before everything worked and it worked for years. With Curl, I do the cronjob of my site once a day, and never had any problems. I thought the SSL certificates had expired, but it seems not. The site is online and it works, if I try to access the site via curl from my local PC, curl works smoothly. I thought I was banned at UFW or fail2ban for some reason, but I changed my local IP and nothing changed. And anyway I see a lot of errors in the Apache logs, from many different IPs. The problem occurs on all sites on my server.

I really can't understand what could have happened, everything worked perfectly until yesterday afternoon.

The Server is Ubuntu 18.04 on vultr.

I also found some strange errors in syslog, probably related.

Apr  8 06:25:03 Vultr_LA_18 rsyslogd:  [origin software="rsyslogd" swVersion="8.32.0" x-pid="689" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
Apr  8 06:25:07 Vultr_LA_18 popularity-contest: unable to submit report to https://popcon.ubuntu.com/popcon-submit.cgi.
Apr  8 06:25:07 Vultr_LA_18 popularity-contest: unable to submit report.


Apr  8 06:32:04 Vultr_LA_18 rsyslogd: unexpected GnuTLS error -53 - this could be caused by a broken connection. GnuTLS reports: Error in the push function.   [v8.32.0$
Apr  8 06:32:04 Vultr_LA_18 rsyslogd: omfwd: TCPSendBuf error -2078, destruct TCP Connection to log.nixstats.com:10514 [v8.32.0 try http://www.rsyslog.com/e/2078 ]
Apr  8 06:32:04 Vultr_LA_18 rsyslogd: action 'action 1' suspended (module 'builtin:omfwd'), retry 0. There should be messages before this one giving the reason for sus$
Apr  8 06:32:04 Vultr_LA_18 rsyslogd: action 'action 1' resumed (module 'builtin:omfwd') [v8.32.0 try http://www.rsyslog.com/e/2359 ]

Apr  8 06:36:06 Vultr_LA_18 systemd-resolved[631]: Server returned error NXDOMAIN, mitigating potential DNS violation DVE-2018-0001, retrying transaction with reduced $

1 Answer 1

-1

I reset Fail2ban, and something seems to have come back to work...

But I have absolutely no idea how the server managed to block itself via Fail2ban...

Any ideas? Above all, any ideas to prevent this from happening again in the future?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .