Issue plesk does Server down?

[Sprayy]

Server operating system version

Ubuntu 22.04

Plesk version and microupdate number

18.0.54

Hello together,
im kinda new into ubuntu and Servers. 4 Months ago i got my first one and everything seemed perfect, but today for some reason i couldnt get to the Server UI (login-page) and all my sites are down. Pinging the Server and the websites seems to be working fine. I tried restarting the server multiple times (soft and hard), but it dindnt help.
I didnt change anything, the server just stopped working (it worked in the morning, didnt work when i came back home 7 hours later).
Any help would be appreciated, thanks.

 

[WebHostingAce]

What is the actual error when you are trying to login to the server?

 

[Sprayy]

I cant even establish a connection to the URL / IP

 

[Peter Debik]

Do you find your own access point IP (or the first three octets of it) in /var/log/fail2ban.log?

 

[The 8th]

Do you find your own access point IP (or the first three octets of it) in /var/log/fail2ban.log?

I had the same issue when working on WordPress. The server went down and will not be back till I restart the server. my server specification is attached, I'm using Debian 12.7, and only have one website on this server WordPress

 

[WebHostingAce]

As Peter explained, the "IP Address Banning (Fail2Ban)" feature might be the culprit.

What could have happened is that while you were editing the WordPress website, the "Web Application Firewall (ModSecurity)" may have triggered a false positive. As a result, "IP Address Banning (Fail2Ban)" blocked your IP based on this false positive from the WAF.

You can check the /var/log/fail2ban.log file to see if your remote IP address is listed in the log.

[Also please ensure that all your server IPs are included in the "Trusted IP Addresses" section of "IP Address Banning (Fail2Ban)." as well]

 

[The 8th]

As Peter explained, the "IP Address Banning (Fail2Ban)" feature might be the culprit.

What could have happened is that while you were editing the WordPress website, the "Web Application Firewall (ModSecurity)" may have triggered a false positive. As a result, "IP Address Banning (Fail2Ban)" blocked your IP based on this false positive from the WAF.

You can check the /var/log/fail2ban.log file to see if your remote IP address is listed in the log.

[Also please ensure that all your server IPs are included in the "Trusted IP Addresses" section of "IP Address Banning (Fail2Ban)." as well]

I found a banned IP in the log, but that IP is accessing SSH from another country. Could it be plugin access?

 

[The 8th]

As Peter explained, the "IP Address Banning (Fail2Ban)" feature might be the culprit.

What could have happened is that while you were editing the WordPress website, the "Web Application Firewall (ModSecurity)" may have triggered a false positive. As a result, "IP Address Banning (Fail2Ban)" blocked your IP based on this false positive from the WAF.

You can check the /var/log/fail2ban.log file to see if your remote IP address is listed in the log.

[Also please ensure that all your server IPs are included in the "Trusted IP Addresses" section of "IP Address Banning (Fail2Ban)." as well]

Mostly goes down when opening the WordPress dashboard, and most of the ban is about SSH, how can we solve this WordPress falling because of ban

 

[The 8th]

is this right to solve the issue : as per screenshot, moved WordPress to be excluded rule.

 

[The 8th]

is this right to solve the issue : as per screenshot, moved WordPress to be excluded rule.


View attachment 27114

I removed G Sit kit Plugin and it's working fine now, that was a strange issue because of that plugin.

 

[Maarten]

WordPress is known to generate false positives with ModSecurity.

If it happens again, click on "Error Log File" on the same page and search for ID's.
They look like this: [id "210492"].

Add that number in the "Security rule IDs" field and ModSecurity will ignore it.

 

[The 8th]

WordPress is known to generate false positives with ModSecurity.

If it happens again, click on "Error Log File" on the same page and search for ID's.
They look like this: [id "210492"].

Add that number in the "Security rule IDs" field and ModSecurity will ignore it.

thanks for info