Naxsi or Proxy_Cache causing issues with ManageWP for WordPress about autom8n

[brianjking]

I noticed these hits in my error.log

2015/11/23 15:49:22 [error] 3682#0: *19192 NAXSI_FMT: ip=192.155.230.147&server=dockdogs.com&uri=/&learning=1&vers=0.54&total_processed=13&total_blocked=2&block=1&cscore0=$SQL&score0=2858&cscore1=$XSS&score1=3200&cscore2=$TRAVERSAL&score2=1672&zone0=BODY&id0=1000&var_name0=notice&zone1=BODY&id1=1001&var_name1=notice&zone2=BODY&id2=1003&var_name2=notice&zone3=BODY&id3=1008&var_name3=notice&zone4=BODY&id4=1009&var_name4=notice&zone5=BODY&id5=1010&var_name5=notice&zone6=BODY&id6=1011&var_name6=notice&zone7=BODY&id7=1013&var_name7=notice&zone8=BODY&id8=1015&var_name8=notice&zone9=BODY&id9=1016&var_name9=notice&zone10=BODY&id10=1205&var_name10=notice&zone11=BODY&id11=1302&var_name11=notice&zone12=BODY&id12=1303&var_name12=notice&zone13=BODY&id13=1000&var_name13=network_notice&zone14=BODY&id14=1001&var_name14=network_notice&zone15=BODY&id15=1003&var_name15=network_notice&zone16=BODY&id16=1008&var_name16=network_notice&zone17=BODY&id17=1009&var_name17=network_notice&zone18=BODY&id18=1010&var_name18=network_notice&zone19=BODY&id19=1011&var_name19=network_notice&zone20=BODY&id20=1013&var_name20=network_notice&zone21=BODY&id21=1015&var_name21=network_notice&zone22=BODY&id22=1016&var_name22=network_notice&zone23=BODY&id23=1205&var_name23=network_notice&zone24=BODY&id24=1302&var_name24=network_notice&zone25=BODY&id25=1303&var_name25=network_notice&zone26=BODY&id26=1205&var_name26=master_url&zone27=BODY&id27=1205&var_name27=master_cron_url&zone28=BODY&id28=1205&var_name28=site_url&zone29=BODY&id29=1002&var_name29=public_key&zone30=BODY&id30=1009&var_name30=public_key&zone31=BODY&id31=1009&var_name31=signature&zone32=BODY&id32=1205&var_name32=signature&zone33=BODY&id33=1205&var_name33=url&zone34=BODY&id34=1009&var_name34=wordpress_b6329d6a6e134d0927b23f7b685052c6&zone35=BODY&id35=1205&var_name35=wordpress_b6329d6a6e134d0927b23f7b685052c6&zone36=BODY&id36=1009&var_name36=wordpress_logged_in_b6329d6a6e134d0927b23f7b685052c6&seed_start=750, client: 192.155.230.147, server: dockdogs.com, request: "POST / HTTP/1.0", host: "dockdog
2015/11/23 15:49:22 [error] 3682#0: *19192 NAXSI_FMT: seed_end=750&zone37=BODY&id37=1205&var_name37=wordpress_logged_in_b6329d6a6e134d0927b23f7b685052c6&zone38=BODY&id38=1009&var_name38=add_site_signature&zone39=BODY&id39=1205&var_name39=add_site_signature&zone40=BODY&id40=1000&var_name40=wppage, client: 192.155.230.147, server: dockdogs.com, request: "POST / HTTP/1.0", host: "dockdogs.com", referrer: "https://managewp.com"
2015/11/23 15:49:24 [error] 3682#0: *19196 NAXSI_FMT: ip=192.155.230.147&server=dockdogs.com&uri=/&learning=1&vers=0.54&total_processed=15&total_blocked=3&block=1&cscore0=$SQL&score0=2840&cscore1=$XSS&score1=3200&cscore2=$TRAVERSAL&score2=1576&zone0=BODY&id0=1000&var_name0=notice&zone1=BODY&id1=1001&var_name1=notice&zone2=BODY&id2=1003&var_name2=notice&zone3=BODY&id3=1008&var_name3=notice&zone4=BODY&id4=1009&var_name4=notice&zone5=BODY&id5=1010&var_name5=notice&zone6=BODY&id6=1011&var_name6=notice&zone7=BODY&id7=1013&var_name7=notice&zone8=BODY&id8=1015&var_name8=notice&zone9=BODY&id9=1016&var_name9=notice&zone10=BODY&id10=1205&var_name10=notice&zone11=BODY&id11=1302&var_name11=notice&zone12=BODY&id12=1303&var_name12=notice&zone13=BODY&id13=1000&var_name13=network_notice&zone14=BODY&id14=1001&var_name14=network_notice&zone15=BODY&id15=1003&var_name15=network_notice&zone16=BODY&id16=1008&var_name16=network_notice&zone17=BODY&id17=1009&var_name17=network_notice&zone18=BODY&id18=1010&var_name18=network_notice&zone19=BODY&id19=1011&var_name19=network_notice&zone20=BODY&id20=1013&var_name20=network_notice&zone21=BODY&id21=1015&var_name21=network_notice&zone22=BODY&id22=1016&var_name22=network_notice&zone23=BODY&id23=1205&var_name23=network_notice&zone24=BODY&id24=1302&var_name24=network_notice&zone25=BODY&id25=1303&var_name25=network_notice&zone26=BODY&id26=1205&var_name26=master_url&zone27=BODY&id27=1205&var_name27=master_cron_url&zone28=BODY&id28=1000&var_name28=0&zone29=BODY&id29=1000&var_name29=1, client: 192.155.230.147, server: dockdogs.com, request: "POST / HTTP/1.0", host: "dockdogs.com", referrer: "https://managewp.com"

[brianjking]

@AnoopAlias This is a pretty major issue for me so I hope you can SSH in and help me get this resolved once you get to your desk! Thanks!

[AnoopAlias]

@brianjking learning=1 in the NAXSI_FMT: log entry tells that NAXSI is just logging this up and doing no blocking etc. You should use the default proxy (not caching ) as caching proxies can cause issues without a sufficient cache_purge logic . By default nginx will not cache dynamic pages (pages with cookies etc) but some plugins etc may remove cookies etc and trick nginx into caching .

If you need high performance and the app is wordpress. use PHP backend and use the High performance wordpress template. https://support.sysally.net/projects/ndeploy/wiki/High_Performance_Wordpress_setup

This does caching in fastcgi( rather than proxy) and has the cache_purge logic because of the nginx-helper plugin loaded in wordpress

[brianjking]

@AnoopAlias I switched to httpd + wordpress firewall, however, it's still showing the same details for the proxy configuration.

I can't seem to get the reset option to appear...

[AnoopAlias]

@brianjking please pass on the servername/main ip and the domain having issue at [email protected] .

[brianjking]

@AnoopAlias Sent. I'm on Skype if you would like to chat as well.

[AnoopAlias]

ndeploy_watcher service was not running causing the config generation to fail.