[Solved] Web access not working (VPS).

[nazsky786]

Hi,

I have an issue where the user gzmo786 on the vps109.heliohost.us isn't accessible, and does not show up on the Control Panel.

So I created another account gzmo, but I've had the files transferred to the public_html folder but when search the IP of the server it just gives me the server is ready and set up no WooCommerce error.

I try to search with SSH and FTP and the files show up there no problems.

I'm trying to ultimalely just transfer the complete website from Siteground to Heliohost, but why is there a gzmo786 account not accessible, and why is the place in placing files making no changes to the website?

Regards

 

 

[nazsky786]

Also trying to add the gzmoperformance domain, which isn't working, I've added the name server to siteground, but it goes to a siteground error.

[wolstech]

Krydos should be able to help you troubleshoot your VPS.  

[Krydos]

1 hour ago, nazsky786 said:

user gzmo786 ... and does not show up on the Control Panel.

The account gzmo786 isn't a Hestia account, it's an SSH account. You have to create accounts through Hestia for them to be Hestia accounts, and gzmo786 was created when the OS was installed which was before Hestia was installed.

1 hour ago, nazsky786 said:

I've had the files transferred to the public_html folder but when search the IP of the server it just gives me the server is ready and set up no WooCommerce error.

What is the domain?

1 hour ago, nazsky786 said:

Also trying to add the gzmoperformance domain, which isn't working

What is the TLD of this domain? .com, .net, .org, .store?

[nazsky786]

Domain is gzmoperformance.co.uk, file location is gzmoperformance.co.uk/web/public_html/

TLD is .co.uk

[nazsky786]

1 hour ago, Krydos said:

The account gzmo786 isn't a Hestia account, it's an SSH account. You have to create accounts through Hestia for them to be Hestia accounts, and gzmo786 was created when the OS was installed which was before Hestia was installed.

What is the domain?

What is the TLD of this domain? .com, .net, .org, .store?

.co.uk

[Krydos]

The first problem I see is you have the NS records wrong. Our nameservers are ns1.heliohost.org and ns2.heliohost.org (not heliohost.us).

The second problem I see is you never requested that domain to be added to our nameservers. With our hosting you can use external DNS, one popular free option is Cloudflare, or our nameservers, but if you want to use our nameservers you need to let us know that you're using them so we can create the domain DNS zone for you. I have created the DNS zone now pointed at your VPS, but until you fix the NS records on your registrar it won't work.

After changing the NS records your domain could continue not working right for 2 to 48 hours depending on how long the wrong values stay cached. Give it at least 2 hours and if it's still not working we can take another look.

[nazsky786]

3 hours ago, Krydos said:

The first problem I see is you have the NS records wrong. Our nameservers are ns1.heliohost.org and ns2.heliohost.org (not heliohost.us).

The second problem I see is you never requested that domain to be added to our nameservers. With our hosting you can use external DNS, one popular free option is Cloudflare, or our nameservers, but if you want to use our nameservers you need to let us know that you're using them so we can create the domain DNS zone for you. I have created the DNS zone now pointed at your VPS, but until you fix the NS records on your registrar it won't work.

After changing the NS records your domain could continue not working right for 2 to 48 hours depending on how long the wrong values stay cached. Give it at least 2 hours and if it's still not working we can take another look.

So, changed the name servers for domain.

Just waiting on the domain to actually forward to the website WooCommerce store, its not done that as of yet.

Even if I Manually input IP, no site.

[Krydos]

It's working for me

root@control [~]# curl --silent -v -H 'Host: gzmoperformance.co.uk' --insecure https://65.19.154.75/
*   Trying 65.19.154.75:443...
* Connected to 65.19.154.75 (65.19.154.75) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
...
> GET / HTTP/2
> Host: gzmoperformance.co.uk
> user-agent: curl/7.76.1
> accept: */*
>
...
< HTTP/2 302
< server: nginx
< date: Sat, 24 Aug 2024 22:55:22 GMT
< content-type: text/html; charset=UTF-8
< content-length: 0
< location: https://gzmoperformance.co.uk/wp-admin/install.php
< expires: Wed, 11 Jan 1984 05:00:00 GMT
< cache-control: no-cache, must-revalidate, max-age=0
< x-redirect-by: WordPress
< strict-transport-security: max-age=31536000;

Your server is responding on that domain and it's redirecting to /wp-admin/install.php. You just need to be patient like I said and wait for the DNS cache to expire. If you don't want to be patient, I suppose you could start driving to every DNS server in the world, get console access somehow, and clear the cache manually. Seems easier to just wait though.

[Krydos]

Oh, another thing you can do prior to the DNS cache expiring is you can use your hosts file to force your browser to go to the right IP, and you can start installing Wordpress before anyone else can even see the site.

[nazsky786]

OK, so domain transfers me to a wordpress site Hacked by Mr Green, but not my site?

Where are these files supposed to be?

they are in the /web/gzmoperformance.co.uk/public_html

 

[nazsky786]

The amount of calls I received, customer thinking website has been hacked...... OMG!!!!

[Krydos]

You might want to re-upload your files from a backup that you know is clean.

root@vps109:/home/gzmo/web/gzmoperformance.co.uk/public_html# grep -i 'hacked' * -R
wp-content/plugins/592c20f10b444977882b7d2b6d18765c/Green.php:        echo "<center>Hacked BY MR.GREEN</center><br>
wp-includes/ID3/module.audio-video.quicktime.php:                       $QuicktimeSTIKLookup[5]  = 'Whacked Bookmark';
wp-includes/ID3/module.audio-video.riff.php:                    MDVD    Alex MicroDVD Video (hacked MS MPEG-4) (www.tiasoft.de)

It appears you really have been hacked.

Since it was redirecting to the install page yesterday, I'm guessing this Mr. Green bot just finished the Wordpress install for you and uploaded some backdoor plugins. I would delete everything in public_html and start over.

[nazsky786]

LMAO - now isn't Mr Green efficient. 

Just to confirm, I am placing the files in the right place?

 

[Krydos]

Yes.