Wordfence firewall rules not updating

Sorry if this is the wrong location for this post as I am new here.

I have a Debian 10 server running ISPConfig 3.2.7p1. It's hosting several Wordpress sites. For about a month I have been receiving the following errors when trying to update the Wordfence firewall rules: “No rules were updated. Please verify you have permissions to write to the /wp-content/wflogs directory." & "Rule Update Failed: No rules were updated. Please verify your website can reach the Wordfence servers." Checked the diagnostics report for the sites and they are all showing connectivity is fine. Checked file permissions for wflogs and rules.php. Wflogs being 755 and rules.php being 644. After speaking with wordpress support all they could recommend was moving to MySQLi storage engine. From what I can tell there are no issues with the server configuration.

Any help would be appreciated. Thanks.

 

If permissions are OK, what are owner and group owner of the directories and files?
Website user and client should be owner and group for the web/ directory and all files in the subtree. Have you checked suexec in website settings?

 

We are using suexec so each site has it's own user assigned. I've checked the settings and there are no issues there either.
Thanks for the response.

 

No errors in regards to the wordfence. It's mostly some theme conflicts such as the following PHP Notice: Undefined variable: img_src "File-Path".

As for the disable_functions, nothing is defined. It only shows the following:

Code:

; This directive allows you to disable certain functions for security reasons.
; It receives a comma-delimited list of function names.
; http://php.net/disable-functions
disable_functions =

 

It started with all sites and each of them got the same error.

The php version is 7.3.31 and it is using php-fpm. I believe it is outside chroot as we are using suexec. If I'm understanding you correctly.

The diagnostics test used was the built in diagnostic tool in wordfence. It showed proper connectivity to all wordpress services.

I haven't implemented their fix as I was hoping for an alternative. Since as far as I can tell there isn't anything incorrectly setup on the server or in wordpress. I was reluctant to change the MySQLi Storage Engine since they weren't able to give me a definitive answer. I'll move forward with the fix if that appears to be the best course of action though.

Thanks for the assistance. I'll give an update if switching resolves the issue.

 

have you checked .user.ini in your docroot, and wordfence-waf.php in your wordpress root?

a change in the php chroot settings may have affected the paths in these files.
a recent update to wordfence may have also changed them to relative paths when a full path is still required.

 

I went through and a few of the sites to the MySQLi Storage Engine and have not seen any changes. Here are the changes I made just in case I made a mistake.

In the sites root web directory I edited the wordfence-waf.php file with the following line:

Code:

define('WFWAF_STORGAE_ENGINE', 'mysqli');

The file now reads as follows:

Code:

<?php
// Before removing this file, please verify the PHP ini setting <code>auto_prepend_file</code> does not point to this.
define('WFWAF_STORGAE_ENGINE', 'mysqli');
// This file was the current value of auto_prepend_file during the Wordfence WAF installation (Tue, 13 Apr 2021 22:0$
if (file_exists('/var/www/clients/client4/web12/web/wordfence-waf.php')) {
        include_once '/var/www/clients/client4/web12/web/wordfence-waf.php';
}
if (file_exists('/var/www/clients/client4/web12/web/wp-content/plugins/wordfence/waf/bootstrap.php')) {
        define("WFWAF_LOG_PATH", '/var/www/clients/client4/web12/web/wp-content/wflogs/');
        include_once '/var/www/clients/client4/web12/web/wp-content/plugins/wordfence/waf/bootstrap.php';
}
?>

After saving the changes, I tried updating the rules. However it is still giving me the same error. I followed the steps provided here https://www.wordfence.com/help/firewall/mysqli-storage-engine/ but am I missing something?

The file paths appear to be unaffected and are showing full paths such as below:

Code:

auto_prepend_file = '/var/www/clients/client4/web12/web/wordfence-waf.php'

Thanks in advance for the help.

 

Update: Created a fresh wordpress install and we are still receiving the same error. Has only default wp theme and wordfence installed.

 

Update: Fresh VM with a Debian 10 install running ISPConfig is having the issue as well.

 

Whitelisted the wordfence / wordpress services in our router so the network shouldn't be causing any problems.

 

The second server we built for testing was on an entirely separate internet connection so firewall misconfiguration or ISP blocking seems unlikely. Furthermore WordFence's own diagnostic tool always says there aren't issues connecting to wordfence servers: https://postimg.cc/sMZ3zxY5

Test server was a vanilla build, following the Debian 10 Perfect Server guide to a T with no changes to any settings. Brand new WordPress 5.8.2 install with the latest version of WordFence from the plugin store.

It's interesting because upon plugin install you get a fully populated rules.php file, but all subsequent attempts to update it will fail. Wordfence had a big red banner on our admin dashboard for all the sites saying it hadn't been able to update the rules in a month: https://postimg.cc/D8rWTC72

It either throws a generic error Saying the update failed and to check our connectivity (which we have done) or it claims it can't write to the wflogs folder. We are using the default ispconfig permission structure, all site resources are owned be web# and are owner r/w so there shouldn't be any permission problems. We even tried the MySQLi storage engine and that fails as well.

If you move/delete it, it does seem to eventually recreate the file as you suggested. But then why is it failing to update the file again after creation? This all started because a bunch of the sites claimed they hadn't been able to update in a month.

We are using the free version of wordfence and it is up to date. It's worked for years with no issues and then about two months ago every site just stopped getting rule updates.

 

We don't use WordFence central. We manage each hosted site individually currently.

My reading on strace makes it sound resource intensive because its recording each system call and it shouldn't be run on production servers. Is this correct or will it not be a problem?

I've never used them before but willing to give it a shot if I can get some assistance interpreting the results.

Do I attach it to the web users FPM process or do I attach to the main PHP process?

 

Ok great, since I've got a test server on my LAN at home I'll use that as there should be no traffic except for mine. That way I can just attach to the main PHP process and not worry about rushing to find the child (the update fails in less than 10 seconds generally, so not a lot of time). I'll post another update tonight with traces.

 

I ended up attaching to the child process after all. The main file is to big for pastebin and it spawned two sub processes so I just tossed them all in a zip. I started it right before trying a manual update and ended it right after but it still logged a lot.

I'm looking over it now but if more experienced eyes want to take a crack I'd appreciate it.

I'm not finding anything when searching for "no rules updated"...

EDIT: Jesse, at line 11590 you can see the beginning of the connection to one of wordfence's noc servers: 44.238.191.15 (they're all listed here https://www.wordfence.com/help/advanced/)

I'm trying to dig around near that line to see if i can find the problem.

EDIT2: Ok I've pastebin'd the section of the main trace where the connection attempts seem to start: https://controlc.com/4601ee86

EDIT3: I really don't know how to read this trace properly but i do see a lot of resource unavailable and timeouts around the time the update appears to start in the trace log.


EDIT4: so right after the IP line it looks to be reading a bunch of certdata from /var/www/clients/client1/web1/web/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/cacert.pem

then on line 11699 it makes a write call and mentions something about noc4.wordfence.com, then several read commands that all seem to fail with resource temporarily unavailable?

I'm starting to understand bits and pieces of this but I'm not there yet.