Akeeba Backup for Joomla!

Wednesday, 09 October 2013 19:03 CDT

user76239

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? All
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? No
Joomla! version: 3.1.5
PHP version: 5.3.13
MySQL version: 5.1.53
Host: Dreamhost
Akeeba Backup version: Akeeba Backup Professional 3.8.2 (2013-09-30)

EXTREMELY IMPORTANT: Please attach a ZIP file containing your Akeeba Backup log file in order for us to help you with any backup or restoration issue. If the file is over 2Mb, please upload it on your server and post a link to it.

Description of my issue:

I upgraded Admin tools and got a failed backup (Log 2)
I did a backup and the backup never stopped (Log 3)

Thursday, 10 October 2013 01:49 CDT

nicholas

The first problem I see is that either your connection to your host is abysmal, or your site is dead slow. The average time between Akeeba Backup finishing a backup step and your browser starting a new step is a whooping 4 seconds. Normally it's 0.25 seconds or 16 times less than what you have.

Most importantly, I see this VERY disconcerting block in your log file:

DEBUG   |131009 16:52:11|====== Starting Step number 166 ======
DEBUG   |131009 16:52:11|PHP NOTICE on line 239 in file &lt;root&gt;/administrator/components/com_akeeba/akeeba/core/kettenrad.php:
DEBUG   |131009 16:52:11|Undefined variable: object
DEBUG   |131009 16:52:11|Successful Smart algorithm on AECoreKettenrad
DEBUG   |131009 16:52:11|PHP NOTICE on line 245 in file &lt;root&gt;/administrator/components/com_akeeba/akeeba/core/kettenrad.php:
DEBUG   |131009 16:52:11|Undefined variable: object
WARNING |131009 16:52:11|Kettenrad :: Empty object found when processing domain 'Packing'. This should never happen.

As the log file reads, this should never happen! It means that something is sweeping your site's PHP files and corrupts them. I have a strong suspicion that your site is hacked. This would explain why every page load has a 4 seconds delay and why the temporary file written by Akeeba Backup in its output directory is destroyed after a while.

As a very temporary measure and only in the interest of taking a backup copy of your site before doing anything further I recommend going to Akeeba Backup's Configuration page and checking the "Use database storage for temporary data" option. This will allow you to run a backup but please DO scan your site for hacking scripts. The behaviour of your site is consistent with this kind of mishap.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Tuesday, 15 October 2013 19:37 CDT

user76239

Thanks for the help. Please forgive the looong post/reply. I am a beginner and am a little overwhelmed.

I have...

1) Run a backup as you suggested...."I recommend going to Akeeba Backup's Configuration page and checking the "Use database storage for temporary data" option ". The log I am sending now was run without "Use database storage for temporary data" option because my host said they found 4 hacked files that they were able to clean up.

2) Changed all passwords in admin and host and db. Deleted unused dbs.

3) Deleted cron job. I had attempted to use this to backup through Akeeba on a scheduled basis.

4) Scanned local computers with malwarebytes and found 1 issue which has been deleted.

5) I am not using the jos table prefix

6) It has been recommended that I remove ALL third-party plugins/themes/templates/components after upgrading your software installations, and from those that are already upgraded under an infected user. After everything is removed, reinstall only the ones you need from fresh/clean downloads via a trusted source.

If I follow this advice, isn't that the same as starting my site over from scratch? If that is the case, what good is having a backup? Is there a "Best practice" that you recommend for using Akeeba Backup so that all I have to do is overwrite my site from a backup? Wouldn't that eliminate any and all hacking activity once it has been discovered?

7) My site is offline. I did it using admintools. I contacted my host to make sure it was offline and they said "The domain is online, although it appears to be set in an endless
redirect loop, and most likely incorrectly configured. A better solution
would have been to simply use an .htaccess rule to only allow requests
from your local IP address."

8) I did get a warning while backing up (in case it isn't in the log that I have attached to this post).
"Unreadable file /home/me/mysite.com/administrator/components/com_admintools/akeeba/platform/jfscan/engines/archiver/jfscan.php. Check permissions

Edited by user76239 on 2013-10-15 19:39 CDT

Wednesday, 16 October 2013 01:43 CDT

nicholas

OK, this is going way off topic, so let me give you some pointers.

I have strong reasons to believe that your host's diagnosis of hacked files is mistaken and misleading. The file you reported as unreadable (administrator/components/com_admintools/akeeba/platform/jfscan/engines/archiver/jfscan.php) is part of Admin Tools' PHP File Change Scanner. Its job is to scan the files on your site and detect any hacked ones. In order to do so it needs to have the signatures of the hacked files. Some hosts use automated tools which report our file as hacked when it isn't – just because it contains the signatures of hacked files it needs to identify them.

DO NOT FOLLOW YOUR HOST'S ADVICE.

Instead please tell them about the above and have them give you a list of the "hacked files". I am pretty sure that they have blocked access to critical files of Admin Tools and Akeeba Backup due to their software issuing a false positive.

Finally, as far as the backup problem goes: please follow my instructions. I cannot provide any further support until you follow my instructions. If you improvise I have no idea what you've done, what effect it had on your site and whether what I'm seeing in the log is due to the server, a third party software, something on our software or your actions. I need to at least make sure that the list of unknown unknowns is fixed throughout the troubleshooting session. By process of elimination I can deduce a plausible explanation thus making the root cause a known unknown and with some imagination and experience come up with a viable solution.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Monday, 21 October 2013 07:58 CDT

user76239

Nicholas,

I'm just posting right now to keep the ticket open.

I'm still waiting to get word from my hosting company to see if they are blocking Akeeba backup and Admin tools.

Monday, 21 October 2013 08:53 CDT

nicholas

All right. When (if?) the host replies please keep me posted.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Wednesday, 23 October 2013 19:27 CDT

user76239

Nicholas,

Per your instructions...(I'm also sending what I've been told by my hosting service.)

"As a very temporary measure and only in the interest of taking a backup copy of your site before doing anything further I recommend going to Akeeba Backup's Configuration page and checking the "Use database storage for temporary data" option. This will allow you to run a backup but please DO scan your site for hacking scripts. The behavior of your site is consistent with this kind of mishap."

I have attempted a backup using the "Use database storage for temporary data" option and the log is attached.

This is the warning I'm getting from Akeeba at the end of backup. (Akeeba does say that the backup was completed successfully although the jpa files are not coming through to my email and they are not in the “manage backup).

Warnings
Failed to process file /home/brown/mysite.com/administrator/components/com_akeeba/backup/site-www.mysite.com-20131023-224035.jpa
Post-processing interrupted -- no more files will be transferred

My hosting service did a scan. Here is the result...

”In scanning your brown user we found 4 hacked files that we were able to try and clean.
/home/brown/mysite.com/administrator/components/com_admintools/akeeba/platform/jfscan/engines/archiver/jfscan.php
/home/brown/mysite.com.BACKUP.29JULY2013/administrator/components/com_admintools/akeeba/platform/jfscan/engines/archiver/jfscan.php
/home/brown/mysite.com/administrator/components/com_admintools/akeeba/platform/jfscan/engines/archiver/jfscan.php
/home/brown/mysite.com/Testbackup/administrator/components/com_admintools/akeeba/platform/jfscan/engines/archiver/jfscan.php

BELOW ARE QUESTIONS AND ANSWERS TO/FROM MY HOST

QUESTION#1 - Can Akeeba Backup and Akeeba Admin Tools can be used now?

ANSWER#1 - “Yes you can use Akeeba Backup and Akeeba Admin Tools now.
I restored 644 permissions on all jfscan.php files.
Permissions on mysite.com/configuration.php were not changed (The file permission is currently 444). Only the host was corrected. “

QUESTION/PROBLEM#1
My config.php file has had the public $host = 'mysql.mysite.com changed to 'mysql.testmysite.com'. I deleted the mysql.testmysite a couple days ago. But when I try to change it back and save it in my config.php I get an error "Cannot write the file to disk (Error code: 1001).

I cannot log in to my joomla admin and my website mysite.com is giving this error...."Error displaying the error page: Application Instantiation Error".

ANSWER#1
That is because the file homestest.dreamhosters.com/configuration.php is
read-only. I have made the change for you and force saved.

Our own scanning tools is flagging jfscan.php as a false positive. It
sets the files to 200 permissions. I have re-enabled with 644
permissions. It may still happen again until our developers get to
updating the code. If you have a repeat issue you can let us know to
reenable the permissions or you can too if you are familiar with
adjusting file permissions.

Thursday, 24 October 2013 02:41 CDT

nicholas

Regarding their scanning code setting jfscan.php permissions to 200 we can't do anything about it until they fix their code :(

About your backup issue, you are trying to send yourself a 39159867 (38Mb) file by email. Per our documentation, in the big, red box:

You MUST set the Part size for split archives setting of the Archiver engine to a value between 1-10 Megabytes. If you choose a big value (or leave the default value of 0, which means that no split archives will be generated) you run the risks of the process timing out, a memory outage error to occur or, finally, your email servers not being able to cope with the attachment size, dropping the email.

And as the log file clearly warns you:

WARNING |131023 15:42:34|The file is too big to be sent by email. Please use a smaller Part Size for Split Archives setting.
DEBUG   |131023 15:42:34|Memory limit 94371840 bytes -- Used memory 24541528 bytes -- File size 39159867 -- Attachment requires approx. 97899667.5 bytes

So just set a smaller part size for split archives. A value of 10Mb or smaller will work, according to the second log line I pasted above: you have about 69830312 bytes of free PHP memory. The attachment requires about three times its size, so a 10Mb attachment should easily fit in that remaining memory.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Tuesday, 29 October 2013 18:03 CDT

user76239

Nicholas

Thanks. I'm somewhat embarrassed but thankful.

I have a file

(/home/snbrown/homestest.dreamhosters.com/administrator/components/com_admintools/akeeba/platform/jfscan/engines/archiver/jfscan.php. Check permissions)

that Akeeba is saying is unreadable (file permission = 200). So I looked at your support documents. I see that there are obtions to exclude files, databases etc. from backing up. How are these determined? How can I be sure that what is in there is supposed to be in there?

Wednesday, 30 October 2013 03:45 CDT

nicholas

Please contact your host. This file is blocked because of a false positive thrown by their "security scanner". You will be the upteenth client to complain about it. They are already aware of the issue and they keep on ignoring it and their complaining clients.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support