Lately, we are experiencing this problem in AWS. The 5.0.1 container hangs in AWS and our analysis shows that it was hit from random unknown IPs. Unfortunately, we can not configure allow/block IPs as our customers would like to access the system from anywhere!
Thoughts? Did anyone else had this problem?
-Visolve 899
Was this almost like a DDOS attack where the maximum number of database connections for your RDS instance was exceeded for a few hours?
Yes, I had that (^^^) problem and restarted the RDS instance and it went away. Don’t know if it was immediate because I was doing other things, so can’t say if it was deliberate. However, I was attempting to run a SSH session into the mysql RDS server and two web instances one as a provider user and another as the admin to make changes real-time. So, I believe it is possible that I exceeded the connections myself, but haven’t looked at the logs.
@Stephen - Thanks for your reply.
ViSolve analysis shows, this has nothing to do with openEMR, however, the attacker came from Beijing and managed to disable the apache service inside the docker container!
Once we restart the docker everything is fine till they attack next time. They did do port scanning from different vulnerable servers from France, Germany and USA! If interested we can post the access log snippet here!
-Visolve-899
@kevin_ytc Thank you
One of our team members suggested the same thing and next time (I am sure there will be one as this happened few times in the last two weeks) we will look at the
number of connections before we restart the server.
-Visolve-899