Sites performance shockingly bad past few days

philbean

• August 26, 2023 11:17

Running 2 sites on 2 separate accounts on my server. For the past 48 hours, performance has been woeful. On both sites. Checked all the usual things - everything seems normal. Server load is actually lower than usual (I expect because people can't get on the sites). Pages on the sites eventually load.. after approx 20 secs delay. So I asked my host tech support to take a look at the server, see if there was a hardware/network issue and there isn't. But he's said this... [QUOTE] OK, I went to the VSI through the KVM console, and when I got to the login prompt I saw a large number of random external IP requests being blocked by your iptable firewall ((picture attached)). None of the IPs seem to be coming from a single source. This looks like some kind of IP packet flood (not sure). I see that you don't have an external firewall to fight these attacks for you, so your VSI is having to fend off these IPs instead. This is looking like some kind of possible attack since it is continuous and not slowing down. This looks like what is slowing down your website responses.
I use CSF firewall on the server. Is there anything I can do to fix this? I'm a bit out of my depth tbh. :confused:

• 

  philbean

  • August 26, 2023 16:22

  Just looking through CSF I'm getting hundreds of these [QUOTE] Aug 26 16:46:28 vs01 lfd[36157]: (sshd) Failed SSH login from 218.92.0.112 (CN/China/-): 5 in the last 3600 secs - *Blocked in csf* [LF_SSHD]
  Different IP each time. Every minute or so.

  0
• 

  retechpro

  • August 26, 2023 20:01

  Just looking through CSF I'm getting hundreds of these Different IP each time. Every minute or so.

  
  Change the default SSH port. Disable direct root login. Use cphulk Use mod_security

  0
• 

  cPRex Jurassic Moderator

  • August 28, 2023 15:11

  That's not a great reply from the host, in my opinion. It's a lot of "I think" and "it looks like" when they should be able to tell what is happening easily based on the connections. The details from CSF are helpful, and changing the SSH port to something else will likely take care of a majority of the issues if that is what is happening.

  0

Please sign in to leave a comment.