Discourse setup halted by apparent website hijack

Hi, I am in the process of setting up Discourse on a Digital Ocean droplet

I completed the one-click install steps successfully, (no errors at least), but on completion of that script, typing the url of my new installation (www.nzarchitecture.net.nz) in order to proceed with setup, instead of anything discourse related, at that url all I saw was this

D:\Jobs\Screen Captures\Screenpresso\2020-01-04_06h49_44.jpg

However on refreshing browser, I can no longer even connect to this url, getting ‘err timed out’ responses from browser.

Does this suggest something has been hijacked during the setup process? Could the Discourse setup files themselves be compromised in some way? or is something else injecting malicious code somehow?
Is this a known issue? … and what should I do about it? Destroy the Droplet and start again? - but if I do, what is to prevent same issue recurring?

1 Like

Unfortunately we can’t help you with Digital Ocean’s one-click install. We support only the official installation instructions: https://github.com/discourse/discourse/blob/master/docs/INSTALL-cloud.md

5 Likes

Hi Gerhard

I was essentially following that guide

The ‘one click’ part I assume just created the cloud server, with Ubuntu and discourse setup files already in place? (essentially step one in the guide, and with ./discourse-setup being launched
automatically thereafter, as soon as I connected to server via PuTTy)

Every step thereafter was per the guide, and all prerequisites were per the guide

Should I destroy the droplet, make a new one with just ubuntu present and repeat from scratch using guide?

1 Like

Yep. That’s exactly what you want to do. Even if you get a working instance it is not supported because who knows how updated the digital ocean install script is.

Could it be that the domain was resolving to a different IP address?

7 Likes

Hi thanks Tobias

I went ahead as suggested – however on (apparently successful) completion of the recommended procedure, I still just get a browser timeout (any browser) when pointed to my Discourse site
www.nzarchitecture.net.nz

I confirmed my Domain registrar is pointing this domain to the Digital Ocean nameservers, which thus presumably must be resolving that url to correct address?

I did find an incorrect A record in my Digital Ocean DNS settings, that was still pointing to the IP address of the previous droplet (that I destroyed, before starting fresh) – but even correcting
this and confirming that the url is associated now with correct IP address using
https://ipinfo.info/html/ip_checker.php I still just get the timeout.

What else might be going on?

That was an invalid domain when I’ve checked a couple of times but it has now appeared correctly. Although the site doesn’t come up.

Searching for it finds records for what I presume is the old forum.

Yeah the domain is currently pointing to 165.22.107.139 which is not responding to ping so doesn’t look like there’s an active server there.

The other IP address that’s associated to it at some nodes is 167.172.115.196 which does have an active server but is not serving pages.

1 Like

Hi thanks Robert

I can confirm ping not working for me either.
I just tried a Tracert for my domain from a Windows CMD window and get a problem between me here in New Zealand, and my Digital Ocean server in Singapore (selected as the closest server geographically). Could this be the cause of the problem? And if so how do I deal with it?

I cant paste the Tracert results into this post, due to max 2 links restriction on new users (tracert results full of links)

Well, looks like you’ve moved your DNS A record to 165.22.107.139.

However, there is no active machine here. So first you need to check your droplet is associated with this IP address and it is active.

Hi Robert - yes I did make that change. The previous IP address I believe was associated with the first droplet I created, then destroyed, in order to start fresh.

As far as I can tell there is an active machine there (or at least dashboard shows it as switched on, and some evidence of CPU & network activity at least during setup process), though as a complete noob am probably missing something critical… Could something in the setup process have switched off the server?

D:\Jobs\Screen Captures\Screenpresso\2020-01-04_14h44_00.jpg

That could be misleading. I would contact DO support, something is definitely not right.

What happens when you hit ‘console’?

When I hit console, console window opens prompting me to log in
I can successfully log in as root, and some basic statistics are displayed
I see one address for ‘eth0:’ and another for ‘docker0:’ - presume I should be using the first one in my A record?


I have posted a support ticket with DO (actually a few hours ago), but no response so far. Not sure how much support they offer small-time users like me? (especially if I did not ultimately use their 1-click installation tool)?

OK so its definitely a networking issue. That IP address might not be ‘public’. Check with DO support.

Will do - thanks for your help

OK, still no response to ticket, but for the benefit of anyone else striking this issue, in the meantime I tried making an image backup, destroying the droplet, waiting a bit then restoring the droplet - thus being allocated a new ip address.

I then updated the DO DNS A record to match

I could ping this new IP address, but still got the same timeout when going to my url www.nzarchitecture.net.nz

However if I just typed nzarchitecture.net.nz (without the www) I did get a web page, for some reason prompting me to connect via SSH to set up ‘Lamp’ .
In theory both urls should go to same place, as one is set as an alias of the other using a CNAME record, so that seems odd all by itself.

I went ahead and connected to the new IP address via PuTTY, typed ‘cd /var/discourse’, then and typed ./discourse-setup - and it was clear all the files and settings were still there in image.

However I proceeded with setup again, hoping to refresh something… and this seems to have worked! - I now get the Discourse webpage prompting me to register a new account.

1 Like

Uh oh!

If it is promoting to setup LAMP then there is something very wrong with the OS you selected upon deploying that droplet.

Please reinstall the above droplet with Ubuntu 18.04 don’t go the application route, don’t do any one click application things. Just select Ubuntu 18.04 and let it do it’s thing. Once that’s done, proceed with discourse installation as per instructions.

7 Likes

Thanks Bhanu - that is more or less what I did, and it seems to have worked

6 Likes