Lost all the websites - sent to default page

[Casey_Farquharson]

Good Evening,

I have suddenly lost all of the websites on the plesk panel server 12.0.18. One of the domains was being used to spam and so I started blocking stuff and removing some of the offending files and folders and the spamming stopped. However it got to a point where I needed to restart the server and although it was working before the restart, once I did restart it it stopped working. All domains are loading nothing and the access_log looks like nginx or FastCGI is trying to redirect the page somewhere. The bootstrapper repair log file states:

"Details: PHP Warning: include_once(Template/Writer/Webserver/Apache.php): failed to open stream: No such file or directory; File: /usr/local/psa/admin/plib/Loader.php, Line: 97"

Any suggestions or guidance much appreciated.

Thanks

 

[IgorG]

Do you have file /usr/local/psa/admin/plib/Template/Writer/Webserver/Apache.php ?
This file is a part of plesk-core package.

 

[Casey_Farquharson]

Thanks Igor. Please see log entry in sw-cp-server error log:
2014/12/05 03:24:15 [error] 1332#0: *340 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: [IPADDRESS], server: , request: "GET /javascript/promo-flags.js.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/sw-engine.sock:", host: "[WEBSITEADDRESS ON PLESK]:8880", referrer: "[SAME WEBSITEADDRESS ON PLESK]"
It is like the webserver is redirecting the web page requests...

 

[UFHH01]

Hi Casey_Farquharson,

what IgorG asked for was, if the file /usr/local/psa/admin/plib/Template/Writer/Webserver/Apache.php exists on your server, because this file is essential for Plesk and needed as you can see in your error in the repair - log.


You could as well try to repair a few things with the command:

/usr/local/psa/bin/repair --run

This command has as well several different options, which you might list with the command: /usr/local/psa/bin/repair --help

​

To restart your Plesk Control Panel, you could use the command: "service psa restart" ... I mention this, because in your above error - message from the sw-cp-server - error - log, the FastCGI error may appear, when the FastCGI socket was not properly created, due to several issues/failures.

 

[Casey_Farquharson]

Thanks Igor. It did exist but the folder it was in was called Webserver.hacked! Have you come across that before? It looks like more than just spamming may have gone on. I renamed the folder having checked the files look like the originals and ran the httpdmng reconfigure all command and managed to get some of the server working again. Not all sites are back and operational though. I have the following appearing in the access_log:
"127.0.0.1 - - [30/Nov/2014:06:18:40 +0000] "GET / HTTP/1.1" 200 10262 "-" "-" "
and the error_log has these (the ends have been cut off):
"[Sat Dec 06 00:00:13 2014] [notice] Apache/2.2.15 (Unix) DAV/2 mod_fcgid/2.3.9 $
[Sat Dec 06 00:01:54 2014] [notice] caught SIGTERM, shutting down
[Sat Dec 06 00:02:08 2014] [notice] SELinux policy enabled; httpd running as co$
[Sat Dec 06 00:02:08 2014] [notice] suEXEC mechanism enabled (wrapper: /usr/sbi$
[Sat Dec 06 00:02:08 2014] [warn] No JkLogFile defined in httpd.conf. Using def$
[Sat Dec 06 00:02:08 2014] [warn] No JkShmFile defined in httpd.conf. Using def$
[Sat Dec 06 00:02:08 2014] [warn] RSA server certificate CommonName (CN) `Paral$
[Sat Dec 06 00:02:08 2014] [warn] RSA server certificate CommonName (CN) `Paral$
[Sat Dec 06 00:02:08 2014] [warn] RSA server certificate CommonName (CN) `Paral$"

Any ideas? Do I need to just build a new server and install plesk again and transfer the sites across?

Thanks

 

[UFHH01]

Hi Casey_Farquharson,

if someone was able to rename your template folders at this location, then you seriously should consider backing up the domain - contents and as well the domain databases on your local harddrive and make a deep investigation of it. When you are through this, then please consider a complete fresh install of the complete server, with complete different passwords and usernames for the domains ( and for the user "admin" as well! ). Please make sure to secure your server BEFORE adding the domains again. I would not suggest to use any fresh installation with a Plesk backup, because in your case you can't be sure where else might have been foreign code implemented, even that this might result in quite a lot of installation work, if you have a lot of domains at your current server.