Wordpress Suspicious Sucuri Alerts

Please fill in any relevant information that applies to you:

• CentOS Version: i.e. CentOS 6 32bit or 64bit / CentOS 7 64bit ?
• Centmin Mod Version Installed: i.e. 123.08stable or 123.09beta01
• Nginx Version Installed: i.e. 1.15.3
• PHP Version Installed: i.e. 5.6.37, 7.0.31, 7.1.21, 7.2.9
• MariaDB MySQL Version Installed: i.e. 10.0.x or 10.1.xx or 10.2.xx
• When was last time updated Centmin Mod code base ? : i.e. run centmin.sh menu option 23 submenu option 2 or cmupdate command
• Persistent Config: Do you have any persistent config file options set in /etc/centminmod/custom_config.inc ? You can check via this command:
  
  Code (Text):

  cat /etc/centminmod/custom_config.inc
  

  
  Post output in CODE tags.

1. how was wordpress installed ? manually or via centmin.sh menu option 22 https://community.centminmod.com/th...l-vs-centmin-sh-menu-option-22-install.15435/
2. if installed via centmin.sh menu option 22, which caching method did you choose ? keycdn cache enabler, redis nginx level cache or wp super cache ?
3. are you behind cloudflare and did you setup proper real ip pass through ? see below
4. tried contacting woocommerce folks ?

If you use a reverse proxy like Cloudflare, Sucuri, or Incapsula in front of Centmin Mod Nginx, you need to setup nginx realip to be passed onto Nginx. See Getting Started Guide step 5 and setting correct real ip via nginx module config at http://centminmod.com/nginx_configure_cloudflare.html.

If using Centmin Mod 123.09beta01 and newer, there's an added tools/csfcf.sh script to aid in this. Details at:

• Beta Branch - csfcf.sh - automate Cloudflare Nginx & CSF Firewall setups | Centmin Mod Community

 

also what's output for command to grep search CSF Firewall for IP 71.6.146.186

Code (Text):

csf -g 71.6.146.186

example output as Centmin Mod 123.09beta01 on initial install tries to block all known shodan scanner IPs out of the box already

Code (Text):

csf -g 71.6.146.186

Table  Chain            num   pkts bytes target     prot opt in     out     source               destination        
No matches found for 71.6.146.186 in iptables


IPSET: Set:chain_DENY Match:71.6.146.186 Setting: File:/etc/csf/csf.deny


ip6tables:

Table  Chain            num   pkts bytes target     prot opt in     out     source               destination        
No matches found for 71.6.146.186 in ip6tables

csf.deny: 71.6.146.186 # inspire.census.shodan.io - Sun Nov 11 15:34:05 2018

for posting code or output from commands to keep the formatting, you might want to use CODE tags for code How to use forum BBCODE code tags

 

yup

also update 123.09beta01 build 94 is pretty old with build 131 being the latest, so update that first, then do nginx 1.15.12 and php 7.3.4 updates too

Upgrading Centmin Mod Code to Latest Version

Getting Started Guide step 19 outlines also how to keep Centmin Mod code updated or how to switch version branches or you can run cmupdate command that was recently added.

Centmin Mod LEMP stack's script code is constantly updated for improvements, bug fixes and security fixes so keeping the Centmin Mod code up to date is important. With Centmin Mod 1.2.3-eva2000.08) (123.08stable) and higher releases, a newly added centmin.sh menu option 23 allows much easier code updates and version branch switching via Git backed environment you can setup.

For 123.08stable that means centmin.sh menu option 23 submenu option 2 (if you previously ran submenu option 1) first, then exit centmin.sh, re-enter /usr/local/src/centminmod and re-run centmin.sh menu.

For 123.09beta01 and higher that means running SSH command = cmupdate and then re-enter /usr/local/src/centminmod and re-run centmin.sh menu.

Example of using 123.09beta01 cmupdate command to update Centmin Mod code on your server

Code (Text):

cmupdate
No local changes to save
Updating 5f92047..9d06ee8
Fast-forward
 stackscripts/stackscript.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

For full details read the following links:

• New centmin.sh menu option 23 updating
• Centmin Mod Upgrades
• Cronjob Auto Updating Centmin Mod Code Guide
• How to upgrade Centmin Mod + backing up customisations

Upgrading Centmin Mod involves 2 parts.

1. Upgrading the actual Centmin Mod code outlined at Upgrade Centmin Mod. This is heart of Centmin Mod where the code is the engine that runs centmin.sh shell based menu and all the automation you're accustomed to. You can easily update within a Centmin Mod version branch or switch version branches via centmin.sh menu option 23 outlined here.
2. Upgrade software that Centmin Mod installed or manages. For this part following outline at How to upgrade Centmin Mod software installed on your server.

So essentially, you can upgrade from one version branch to another i.e. 123.08stable to 123.09beta01 or higher in place, but not everything is upgraded as some things like server initial environment setup isn't changed i.e. how swap, tmp setup and allocation are created etc. The main parts from part 2 above are what in place upgrades do i.e. Nginx and PHP-FPM compilation and config/settings parameters and MariaDB version from 5.5 to 10.0.x. If you want the full environment changed including tmp and swap setup to 123.09beta01 etc configuration, then you would need a fresh OS install and fresh 123.09beta01 initial install. You can think of it like upgrading Windows 7 to Windows 8. An in place upgrade will upgrade code but won't change your computer environment from when you installed Windows 7 i.e. disk configuration and partition sizes won't change from when you initially installed Windows 7. Only way to change that would be fresh Windows 8 install.

 

you must have a pretty old 123.09beta01 install before shodan scanners were automatically blocked

 

yes if you run tools/csf-advancetweaks.sh it will add those shodan scanners to CSF Firewall block/deny list along with additional CSF Firewall blocklist options