0

I'm not sure if my site was hacked or there's a server related error. My website was running fine ever since I published it, yesterday I visited it and it said connection refused. I informed my hosting provider and they told me to create a new database connection, when I open phpMyAdmin I get a strange error that says:

Warning in ./libraries/plugins/auth/AuthenticationCpanel.php#629
mysqli_connect(): (HY000/2002): Can't connect to local MySQL server 
through socket '/var/lib/mysql/mysql.sock' (2)

When I try to ssh into my server I get the following errors:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for [wesocular.com]:60504 has changed,
and the key for the corresponding IP address [46.105.40.12]:60504
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:EvplXyAHYO4nP4rmOtJ2j3wc4O04UMUWMvLi9ZpsVuU.
Please contact your system administrator.
Add correct host key in /c/Users/Game330/.ssh/known_hosts to get rid of this mes   sage.
Offending RSA key in /c/Users/Game330/.ssh/known_hosts:1
RSA host key for [wesocular.com]:60504 has changed and you have requested strict    checking.

What could be the problem ?

user456389
  • 1
  • 1
    Don't ignore that warning. If you are sure you are connecting to the correct host and didn't do anything on the server that would change the host key [treat it as compromised](https://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server) and nuke it from orbit. – Gerald Schneider Feb 13 '18 at 13:24
  • Thanks for the comments guys I have two problems here, the first one being that I can't access php myAdmin/create new database When I open phpMy Admin I get the following error: Warning in ./libraries/plugins/auth/AuthenticationCpanel.php#629 mysqli_connect(): (HY000/2002): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2) How can I resolve it ? – user456389 Feb 13 '18 at 13:59
  • Your MySQL problem is that the MySQL service isn't even running. In conjunction with the host key being changed, I'm leaning towards it being compromised and should at the very least be checked over by someone experienced with cPanel, mySQL and security issues. Most likely you'll save time by just junking it, setting up a new server and restoring the database from backup. – Jenny D Feb 14 '18 at 14:14

1 Answers1

1

If you read error message, you see reason: The RSA host key for [wesocular.com]:60504 has changed, and the key for the corresponding IP address [46.105.40.12]:60504 is unknown.

And then there is solution how to fix it: Add correct host key in /c/Users/Game330/.ssh/known_hosts to get rid of this message. Offending RSA key in /c/Users/Game330/.ssh/known_hosts:1

So, you could remove key in line 1 in file /c/Users/Game330/.ssh/known_hosts and try to login via SSH again.

Alexander Tolkachev
  • 4,513
  • 3
  • 14
  • 23
  • Ok thanks I'll do that I have two problems here, the first one being that I can't access php myAdmin/create new database When I open phpMy Admin I get the following error: Warning in ./libraries/plugins/auth/AuthenticationCpanel.php#629 mysqli_connect(): (HY000/2002): Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (2) How can I resolve it ? – user456389 Feb 13 '18 at 13:38
  • @user456389 looks like your MySQL is down. Start it. – Alexander Tolkachev Feb 13 '18 at 13:43
  • Thanks I'll ask my hosting provider to start it for me. – user456389 Feb 13 '18 at 13:52