Help understadning SFTP logs

socalheel · 05-01-2019, 09:41 AM

I am investigating a site-outage that was supposedly caused by moving a folder into another folder.

I cannot find anything in sftp logs to support this but I am not sure about this one entry:

Quote:

in wpe_permissionmgr_determine_update_type, invalid st_mode(193974528) returned on /wp-content

if you'd like the full logs i was provided (i removed the first six columns to scrub "sensitive" data):

Quote:

opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here (Login failed): Incorrect password
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here (Login failed): Incorrect password
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
SSH2 no transfer timeout, disconnected
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
wpe_permissionmgr_determine_update_type: processing arg /wp-content
in wpe_permissionmgr_determine_update_type, invalid st_mode(193974528) returned on /wp-content
wpe_permissionmgr_determine_update_type: processing arg /vagrant/wp-content
chmod of file /vagrant/wp-content to 775 failed
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
SSH2 no transfer timeout, disconnected
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
SSH2 no transfer timeout, disconnected
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
SSH2 no transfer timeout, disconnected
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
SSH2 no transfer timeout, disconnected
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
SSH2 no transfer timeout, disconnected
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
SSH2 no transfer timeout, disconnected
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
opening file /var/cache/wpe_uploadtracker/sftp_uploads : 2
SSH2 session opened.
USER username-here: Login successful
USER username-here: Login successful.
ROOT PRIVS: unable to seteuid(): Operation not permitted
ROOT PRIVS: unable to setegid(): Operation not permitted
RELINQUISH PRIVS: unable to seteuid(PR_ROOT_UID): Operation not permitted
SSH2 session closed.
sent SSH_DISCONNECT message: disconnected by user (Application error)

smallpond · 05-01-2019, 10:18 AM

Were the files and directories owned by the same user as the login? Was either root?

socalheel · 05-01-2019, 12:00 PM

hey smallpond, thanks for the reply.

no sir. i logged in as username-01 and the wp-content folder and files are owned by owner/group www-data.

supposedly the folder wp-content was moved into a folder named vagrant, which is also owned by owner/group www-data.

i don't see anywhere in the logs where a request to move wp-content into vagrant was initiated.

smallpond · 05-01-2019, 12:19 PM

I don't know what happens to ownership and permissions when you do that, but this error:

Code:

wpe_permissionmgr_determine_update_type: processing arg /wp-content
in wpe_permissionmgr_determine_update_type, invalid st_mode(193974528) returned on /wp-content
wpe_permissionmgr_determine_update_type: processing arg /vagrant/wp-content
chmod of file /vagrant/wp-content to 775 failed

suggests that a directory named vagrant/wp-content was created and that something went wrong. You can check the file's sizes, ownership and permissions in sftp using ls -l.

socalheel · 05-01-2019, 12:24 PM

Quote:

Originally Posted by smallpond

suggests that a directory named vagrant/wp-content was created and that something went wrong.

exactly correct. i just don't see where/how/who tried to create that. the support team where this server is hosted seems to think the wp-content folder was accidentally moved into /vagrant. which is a solid theory, i mean drag/drop errors happen all the time and if someone is using an FTP client, then it's very likely that's what happened. i just don't see where that was actually requested.

scasey · 05-01-2019, 04:33 PM

Given that the content is owned by the (presumably) the web server user, is it possible that the move happened via a web-run script (i.e. CGI) rather than via SFTP?
Just thinkin' out loud...

socalheel · 05-01-2019, 07:17 PM

i am definitely not ruling anything out for sure. the site is hosted on wp engine so i do not have full visibility into how the server is built and what all is going on.