Resolved Sudden 502 bad gateway

[Edi Duluman]

Hello. Out of the sudden and as a first in half a year since Plesk is running, all the websites on the server went down, returning 502 bad gateway.

Then I went in and stopped nginx .. errors in the nginx error log were like "connection refused to upstream etc" ..

Everything worked normally if I stopped it. When starting it back, same error. Did a bit of research, found out that I need to stop the fial2ban service for it to work... and so I did. Started nginx, works fine.

If I start fail2ban, and then nginx, it return 502 bad gateway. I just left it stopped anyway.

After few minutes, a client reached saying he has issues, being unable to do anything with the mail account. I looked his domain up, went to email addresses .. and boom. Nothing in it. His email is not there anymore ...

I need to say that nobody has access to the plesk panel aside me. No customer has access data to it and nohting else was damaged.

His emails are all gone. Any idea what might have happened ? It is very weird ... only things I have done was to do the system updates plesk is giving me. And I'm not an "early adopter" ..

 

[UFHH01]

Hi Edi Duluman,

Then I went in and stopped nginx .. errors in the nginx error log were like "connection refused to upstream etc" ..

Everything worked normally if I stopped it. When starting it back, same error. Did a bit of research, found out that I need to stop the fial2ban service for it to work... and so I did. Started nginx, works fine.

If I start fail2ban, and then nginx, it return 502 bad gateway. I just left it stopped anyway.

Could you confirm, that you whitelisted localhost ( 127.0.0.1/8 ) and your server IP(s) in the Fail2Ban - configuration ( Trusted IP Addresses )? And did you make sure, that none of these IPs are on the ban - list of Fail2Ban?

After few minutes, a client reached saying he has issues, being unable to do anything with the mail account. I looked his domain up, went to email addresses .. and boom. Nothing in it. His email is not there anymore ...

I need to say that nobody has access to the plesk panel aside me. No customer has access data to it and nohting else was damaged.

His emails are all gone. Any idea what might have happened ? It is very weird ... only things I have done was to do the system updates plesk is giving me. And I'm not an "early adopter" ..

This is a complete different issue/error/problem. Pls. consider to open a new thread with this issue.

 

[Edi Duluman]

Hi Edi Duluman,


Could you confirm, that you whitelisted localhost ( 127.0.0.1/8 ) and your server IP(s) in the Fail2Ban - configuration ( Trusted IP Addresses )? And did you make sure, that none of these IPs are on the ban - list of Fail2Ban?




This is a complete different issue/error/problem. Pls. consider to open a new thread with this issue.

Hei! Thanks for the reply. Regarding the mail thread, I'll surely do so.

As for the ip's , yes. The local one is whitelisted, and there was nothing at that point in time, nor now, in the blacklist.

Though.. I have noticed a high CPU usage for the apache service in the past three days, spiking up to 80 in some cases. is it any way that could cause this ? If so, how can I check the domain causing the high cpu usage, since as far as I know, that feature is in development

 

[UFHH01]

Hi Edi Duluman,

Though.. I have noticed a high CPU usage for the apache service in the past three days, spiking up to 80 in some cases. is it any way that could cause this ?

No.


Consider to post the corresponding apache, nginx AND fail2ban - log - files and don't forget the domain - specific logs, for further investigations.

Plesk for Linux services logs and configuration files ( KB - article: 213403509 )​

 

[David Krimmel]

Hei! Thanks for the reply. Regarding the mail thread, I'll surely do so.

As for the ip's , yes. The local one is whitelisted, and there was nothing at that point in time, nor now, in the blacklist.

Though.. I have noticed a high CPU usage for the apache service in the past three days, spiking up to 80 in some cases. is it any way that could cause this ? If so, how can I check the domain causing the high cpu usage, since as far as I know, that feature is in development

I noticed the same issue today. In fail2ban I had an entry for the local IP under apache-bad-bots. I added an exception for the internal address and the sites came back online. Hope this helps...

 

[Lotte Gaebel]

I noticed the same issue today. In fail2ban I had an entry for the local IP under apache-bad-bots. I added an exception for the internal address and the sites came back online. Hope this helps...

Hatte dasselbe Phänomen (IP des Plesk-Servers) in Apache-Bad-Bods. Nach Whitelisting läuft Ngnix wieder einwandfrei.

 

[UFHH01]

Hi @Lotte Gaebel

pls. note, that the forum rules only allow ENGLISH as communication language, so that all forum users are able to read and understand the postings.

 

[Lotte Gaebel]

Hi @Lotte Gaebel

pls. note, that the forum rules only allow ENGLISH as communication language, so that all forum users are able to read and understand the postings.

Sorry ... Had the same phenomenon: Plesk server IP in Apache bad bods. After whitelisting, nginx is running correctly.

 

[Rowan]

while i had the same issue I had a different solution, the whitelist didnt seem to exist anymore so i created it:

touch /etc/asl/whitelist

I followed it with running and only applying configuration again.

plesk repair web

 

[Peter Debik]

@Rowan That is a different issues and just re-creating whitelist is insufficient. It needs to have at least the content "127.0.0.1/8" because else local request will also be scanned, and such local requests should be considered safe. Please see Important - Atomic Tortix ruleset for ModSecurity breaks Apache configuration due to missing files in /etc/asl for your case.

 

[Rowan]

Correct, however as I "suddenly" received the 502 like this thread and resolved it with the help of this thread I added my resolution for others.

Thank you mentioning to add "127.0.0.1/8" as I haven't done that yet.