504 Gateway Time-out

Hi Shivanand Sharma ! I already used Malcure Scanner some years ago on a website which was infected, for the novice developer just used WordPress plugins not really approved… Whereas other scanners didn’t find anything, I was happily surprised with Malcure which detected the bad intruser ! Today I met a some strange issue with W3 Total Cache on a shop website, when the files of the plugin had almost suddenly disappeared, bringing an error on the back-end (the front-end was still working, but I was not completely sure). I reinstalled the plugin and everything worked fine again, but I’m still suspiscious about this issue and would like to scan the website. Malcure installation is OK but when I go on the admin page, I get a 504 error after 1 minute. I went on the forum to look after similar situations, but the only answers I found were talking about slow servers… Mine (I would say : my customer’s one) is a dedicated server, running on Debian with enough ressources to run nginx server. The proxy_read_timeout, proxy_connect_timeout and proxy_send_timeout are set to 300, and the web root directory contains about 150000 files (which is quite a lot, of course, but shouldn’t disturb the scan). What could I do to try to solve this issue ? Thanks in advance Does the error happen when you click the “Start Scan” button or does it happen when the scan is already running? Thanks for your reactivity ! The error occurs just after installation, when I click on the green button on top of the dashboard, telling me to start analysis. Nginx is a proxy server. The backend server may be Apache using PHP-FPM. What is the max_execution_time on the site? For large sites we recommend 300. When the scan initiates, it tries to index all files before scanning them. On large sites this can take a lot of time which exceeds PHP max_execution_time and can throw 504 HTTP code. Feel free to share screenshots etc. I think you can upload somewhere and link them here. NginX is the web server, and there’s no Apache instance running on it, as you can see in the result of a ps command : USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.0 227908 9944 ? Ss 2023 413:08 /sbin/init root 2 0.0 0.0 0 0 ? S 2023 0:14 [kthreadd] root 4 0.0 0.0 0 0 ? I< 2023 0:00 [kworker/0:0H] root 6 0.0 0.0 0 0 ? I< 2023 0:00 [mm_percpu_wq] root 7 0.0 0.0 0 0 ? S 2023 8:50 [ksoftirqd/0] root 8 0.0 0.0 0 0 ? I 2023 422:54 [rcu_sched] root 9 0.0 0.0 0 0 ? I 2023 0:00 [rcu_bh] root 10 0.0 0.0 0 0 ? S 2023 0:28 [migration/0] root 11 0.0 0.0 0 0 ? S 2023 3:49 [watchdog/0] root 12 0.0 0.0 0 0 ? S 2023 0:00 [cpuhp/0] root 13 0.0 0.0 0 0 ? S 2023 0:00 [cpuhp/1] root 14 0.0 0.0 0 0 ? S 2023 3:50 [watchdog/1] root 15 0.0 0.0 0 0 ? S 2023 0:28 [migration/1] root 16 0.0 0.0 0 0 ? S 2023 9:03 [ksoftirqd/1] root 18 0.0 0.0 0 0 ? I< 2023 0:00 [kworker/1:0H] root 19 0.0 0.0 0 0 ? S 2023 0:00 [cpuhp/2] root 20 0.0 0.0 0 0 ? S 2023 4:15 [watchdog/2] root 21 0.0 0.0 0 0 ? S 2023 0:28 [migration/2] root 22 0.0 0.0 0 0 ? S 2023 17:36 [ksoftirqd/2] root 24 0.0 0.0 0 0 ? I< 2023 0:00 [kworker/2:0H] root 25 0.0 0.0 0 0 ? S 2023 0:00 [cpuhp/3] root 26 0.0 0.0 0 0 ? S 2023 3:41 [watchdog/3] root 27 0.0 0.0 0 0 ? S 2023 0:28 [migration/3] root 28 0.0 0.0 0 0 ? S 2023 8:54 [ksoftirqd/3] root 30 0.0 0.0 0 0 ? I< 2023 0:00 [kworker/3:0H] root 31 0.0 0.0 0 0 ? S 2023 0:00 [kdevtmpfs] root 32 0.0 0.0 0 0 ? I< 2023 0:00 [netns] root 33 0.0 0.0 0 0 ? S 2023 0:00 [rcu_tasks_kthre] root 34 0.0 0.0 0 0 ? S 2023 0:00 [kauditd] root 36 0.0 0.0 0 0 ? S 2023 1:28 [khungtaskd] root 37 0.0 0.0 0 0 ? S 2023 0:00 [oom_reaper] root 38 0.0 0.0 0 0 ? I< 2023 0:00 [writeback] root 39 0.0 0.0 0 0 ? S 2023 0:00 [kcompactd0] root 40 0.0 0.0 0 0 ? SN 2023 0:00 [ksmd] root 41 0.0 0.0 0 0 ? SN 2023 0:38 [khugepaged] root 42 0.0 0.0 0 0 ? I< 2023 0:00 [crypto] root 43 0.0 0.0 0 0 ? I< 2023 0:00 [kintegrityd] root 44 0.0 0.0 0 0 ? I< 2023 0:00 [kblockd] root 45 0.0 0.0 0 0 ? I< 2023 0:00 [ata_sff] root 46 0.0 0.0 0 0 ? I< 2023 0:00 [md] root 47 0.0 0.0 0 0 ? I< 2023 0:00 [edac-poller] root 48 0.0 0.0 0 0 ? I< 2023 0:00 [devfreq_wq] root 49 0.0 0.0 0 0 ? I< 2023 0:00 [watchdogd] root 52 0.0 0.0 0 0 ? S 2023 21:02 [kswapd0] root 53 0.0 0.0 0 0 ? I< 2023 0:00 [kworker/u9:0] root 54 0.0 0.0 0 0 ? S 2023 0:00 [ecryptfs-kthrea] root 98 0.0 0.0 0 0 ? I< 2023 0:00 [kthrotld] root 99 0.0 0.0 0 0 ? I< 2023 0:00 [acpi_thermal_pm] root 101 0.0 0.0 0 0 ? S 2023 0:00 [scsi_eh_0] root 102 0.0 0.0 0 0 ? I< 2023 0:00 [scsi_tmf_0] root 103 0.0 0.0 0 0 ? S 2023 0:00 [scsi_eh_1] root 104 0.0 0.0 0 0 ? I< 2023 0:00 [scsi_tmf_1] root 110 0.0 0.0 0 0 ? I< 2023 0:00 [ipv6_addrconf] root 119 0.0 0.0 0 0 ? I< 2023 0:00 [kstrp] root 136 0.0 0.0 0 0 ? I< 2023 0:00 [charger_manager] root 194 0.0 0.0 0 0 ? S 2023 0:00 [scsi_eh_2] root 195 0.0 0.0 0 0 ? I< 2023 0:00 [scsi_tmf_2] root 271 0.0 0.0 0 0 ? I< 2023 52:05 [kworker/2:1H] root 317 0.0 0.0 0 0 ? I< 2023 0:00 [raid5wq] root 366 0.0 0.0 0 0 ? I< 2023 50:34 [kworker/1:1H] root 368 0.0 0.0 0 0 ? S 2023 398:22 [jbd2/sda1-8] root 369 0.0 0.0 0 0 ? I< 2023 0:00 [ext4-rsv-conver] root 424 0.0 0.0 0 0 ? I< 2023 49:00 [kworker/3:1H] root 436 0.0 0.0 0 0 ? I< 2023 51:53 [kworker/0:1H] root 458 0.0 0.3 146952 51800 ? S<s 2023 83:31 /lib/systemd/systemd-journald root 465 0.0 0.0 105908 920 ? Ss 2023 0:00 /sbin/lvmetad -f root 466 0.0 0.0 0 0 ? I< 2023 0:00 [iscsi_eh] root 469 0.0 0.0 43580 3984 ? Ss 2023 26:22 /lib/systemd/systemd-udevd root 470 0.0 0.0 0 0 ? I< 2023 0:00 [ib-comp-wq] root 471 0.0 0.0 0 0 ? I< 2023 0:00 [ib-comp-unb-wq] root 472 0.0 0.0 0 0 ? I< 2023 0:00 [ib_mcast] root 473 0.0 0.0 0 0 ? I< 2023 0:00 [ib_nl_sa_wq] root 474 0.0 0.0 0 0 ? I< 2023 0:00 [rdma_cm] root 628 0.0 0.0 0 0 ? S< Jan20 0:00 [loop5] systemd+ 671 0.0 0.0 141788 3192 ? Ssl 2023 4:06 /lib/systemd/systemd-timesyncd systemd+ 837 0.0 0.0 79924 3384 ? Ss 2023 3:58 /lib/systemd/systemd-networkd systemd+ 860 0.0 0.0 70924 4180 ? Ss 2023 51:03 /lib/systemd/systemd-resolved root 956 0.0 0.0 110492 2504 ? Ssl 2023 55:08 /usr/sbin/irqbalance –foreground root 962 0.0 0.0 71620 5300 ? Ss 2023 36:44 /lib/systemd/systemd-logind root 968 0.0 0.0 169788 13420 ? Ssl 2023 0:03 /usr/bin/python3 /usr/bin/networkd-dispatcher –run-startup-triggers memcache 969 0.0 0.0 424772 2452 ? Ssl 2023 243:48 /usr/bin/memcached -m 64 -p 11211 -u memcache -l 127.0.0.1 -P /var/run/memcached/memcached.pid daemon 973 0.0 0.0 28336 1904 ? Ss 2023 0:02 /usr/sbin/atd -f root 978 0.0 0.0 286368 4564 ? Ssl 2023 42:58 /usr/lib/accountsservice/accounts-daemon root 981 0.0 0.0 826888 4348 ? Ssl 2023 8:52 /usr/bin/lxcfs /var/lib/lxcfs/ syslog 982 0.0 0.0 263048 4040 ? Ssl 2023 16:55 /usr/sbin/rsyslogd -n message+ 991 0.0 0.0 50312 4008 ? Ss 2023 100:26 /usr/bin/dbus-daemon –system –address=systemd: –nofork –nopidfile –systemd-activation –syslog-only root 1012 0.0 0.0 186232 14872 ? Ssl 2023 0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown –wait-for-signal root 1016 0.0 0.0 30004 2292 ? Ss 2023 3:41 /usr/sbin/cron -f root 1021 0.0 0.1 300788 21320 ? Ssl 2023 846:11 /usr/bin/python3 /usr/bin/fail2ban-server -xf start root 1022 0.0 0.0 29156 2120 ? Ss 2023 1:30 /usr/sbin/vsftpd /etc/vsftpd.conf root 1028 0.0 0.0 288884 4116 ? Ssl 2023 14:06 /usr/lib/policykit-1/polkitd –no-debug root 1033 0.0 0.0 72304 4024 ? Ss 2023 42:26 /usr/sbin/sshd -D root 1041 0.0 0.0 14672 1568 ttyS0 Ss+ 2023 0:00 /sbin/agetty -o -p — \u –keep-baud 115200,38400,9600 ttyS0 vt220 root 1047 0.0 0.0 14896 1456 tty1 Ss+ 2023 0:00 /sbin/agetty -o -p — \u –noclear tty1 linux mysql 1189 3.7 9.1 2341060 1376680 ? S<sl 2023 35850:30 /usr/sbin/mysqld root 6114 0.0 0.0 0 0 ? S< Mar11 0:00 [loop4] root 8772 0.0 0.0 0 0 ? S< Feb22 0:00 [loop2] root 10973 0.0 0.0 0 0 ? S< Apr08 0:00 [loop3] root 11421 0.0 0.0 0 0 ? I 02:00 0:00 [kworker/1:3] root 14309 0.0 0.0 107988 7104 ? Ss 02:20 0:00 sshd: ubuntu [priv] ubuntu 14311 0.0 0.0 76656 7876 ? Ss 02:20 0:00 /lib/systemd/systemd –user ubuntu 14312 0.0 0.0 261876 5160 ? S 02:20 0:00 (sd-pam) ubuntu 14388 0.0 0.0 107988 4536 ? S 02:20 0:01 sshd: ubuntu@pts/0 ubuntu 14389 0.0 0.0 26492 8428 pts/0 Ss 02:20 0:01 -bash root 14985 0.0 0.0 0 0 ? I 02:26 0:00 [kworker/3:3] root 16197 0.0 0.0 107988 7212 ? Ss 02:48 0:00 sshd: ubuntu [priv] ubuntu 16268 0.0 0.0 107988 3592 ? S 02:48 0:00 sshd: ubuntu@pts/1 ubuntu 16269 0.0 0.0 26488 8528 pts/1 Ss+ 02:48 0:00 -bash root 17319 0.0 0.0 0 0 ? I 03:00 0:00 [kworker/0:4] root 17456 0.0 0.2 483108 33688 ? Ss 03:00 0:01 php-fpm: master process (/etc/php/7.4/fpm/php-fpm.conf) www-data 17504 0.3 1.4 880004 218392 ? S< 03:00 0:45 php-fpm: pool www www-data 17505 1.7 1.4 867180 219744 ? S< 03:00 3:43 php-fpm: pool www www-data 17506 1.0 1.6 906252 254432 ? S< 03:00 2:14 php-fpm: pool www root 17596 0.0 0.0 0 0 ? I< 2023 0:00 [xfsalloc] root 17597 0.0 0.0 0 0 ? I< 2023 0:00 [xfs_mru_cache] root 19406 0.0 0.0 0 0 ? S< Feb19 0:00 [loop0] root 21585 0.0 0.0 0 0 ? S< Mar06 0:00 [loop1] root 21610 0.0 0.2 1543532 34104 ? Ssl Mar06 9:01 /usr/lib/snapd/snapd clamav 24925 0.0 0.2 231204 30960 ? Ss 03:27 0:00 /usr/bin/freshclam -d –foreground=true clamav 25417 0.2 9.4 1683748 1421592 ? Ssl 03:27 0:31 /usr/sbin/clamd –foreground=true www-data 26337 2.3 1.4 869552 222124 ? S< 03:55 3:36 php-fpm: pool www www-data 26340 3.2 1.4 867560 221092 ? S< 03:55 5:02 php-fpm: pool www www-data 26343 0.3 1.4 868988 217364 ? S< 03:55 0:32 php-fpm: pool www www-data 26354 0.3 1.5 877180 229328 ? S< 03:55 0:31 php-fpm: pool www www-data 26359 0.3 1.4 867008 217468 ? S< 03:56 0:33 php-fpm: pool www www-data 26361 0.3 1.3 866692 205004 ? S< 03:56 0:32 php-fpm: pool www www-data 26362 0.3 1.4 867160 217892 ? S< 03:56 0:33 php-fpm: pool www www-data 26365 1.2 1.3 868160 209940 ? S< 03:56 1:59 php-fpm: pool www www-data 26366 1.2 1.4 869296 211772 ? S< 03:56 1:59 php-fpm: pool www www-data 26367 0.3 1.4 869496 221828 ? S< 03:56 0:31 php-fpm: pool www www-data 26368 0.3 1.4 865932 218156 ? S< 03:56 0:31 php-fpm: pool www www-data 26369 0.3 1.4 868908 222004 ? S< 03:56 0:31 php-fpm: pool www www-data 26370 0.3 1.4 864900 214708 ? S< 03:56 0:28 php-fpm: pool www www-data 26371 0.2 1.3 865884 204240 ? S< 03:56 0:26 php-fpm: pool www www-data 26372 0.3 1.4 870320 214368 ? S< 03:56 0:30 php-fpm: pool www www-data 26375 0.3 1.4 870252 224012 ? S< 03:56 0:32 php-fpm: pool www root 26662 0.0 0.0 0 0 ? I 04:09 0:00 [kworker/3:1] root 27355 0.0 0.0 168832 2132 ? Ss 04:44 0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on; www-data 27358 0.0 0.0 172220 11580 ? S 04:44 0:01 nginx: worker process www-data 27360 0.0 0.0 171748 11536 ? S 04:44 0:01 nginx: worker process www-data 27363 0.0 0.0 172004 11472 ? S 04:44 0:01 nginx: worker process www-data 27364 0.0 0.0 171880 11372 ? S 04:44 0:01 nginx: worker process root 27514 0.0 0.0 0 0 ? I 04:47 0:00 [kworker/2:2] root 27520 0.0 0.0 0 0 ? S< 04:47 0:00 [loop8] root 27543 0.0 0.0 0 0 ? I 04:47 0:00 [kworker/0:0] www-data 27727 0.3 1.3 866268 207168 ? S< 05:04 0:16 php-fpm: pool www root 27870 0.0 0.0 0 0 ? S< Jan11 0:01 [loop7] root 28392 0.0 0.0 0 0 ? I 05:39 0:00 [kworker/2:0] root 28503 0.0 0.0 0 0 ? I 05:56 0:00 [kworker/u8:1] root 28559 0.0 0.0 0 0 ? I 06:07 0:00 [kworker/u8:0] root 28728 0.0 0.0 0 0 ? I 06:09 0:00 [kworker/1:1] root 28964 0.0 0.0 0 0 ? I 06:28 0:00 [kworker/u8:2] root 30025 0.0 0.0 63976 4316 pts/0 S+ 06:32 0:00 sudo ps wwwauxxx root 30026 0.0 0.0 40100 3656 pts/0 R+ 06:32 0:00 ps wwwauxxx In the NginX conf, timeouts are set to 300 (in /etc/nginx/sites-enabled/website.conf) : server { … proxy_read_timeout 300; proxy_connect_timeout 300; proxy_send_timeout 300; … } What seems strange is that the 504 error occurs after 1 minute exactly. If it’s happening in one minute, the PHP max_execution_time may be around 90 seconds. Can you verify that? Yes, you’re right ! There are 3 timeouts configured thru the nginx configuration, but there’s also specific configuration for PHP-FPM in the /etc/php/7.4/fpm/php.ini...