Question

Cant connect to my NGINX + Certboot starter, command journalctl -xe give me messages - UFW BLOCK and sshd: Invalid user "name" + ip + port

Hello I try to create https web server for my client for practic

Everything was working, but one day everything shut down and I saw server errors: 1 When I tried to access the page - 502 # Bad Gateway nginx/1.18.0 (Ubuntu)

2 When I entered the command “nginx” - 2.1 nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use) 2.2 nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use) I tried entering the server address directly, specifying different ports, as well as killing existing processes and then running nginx, but it didn’t help…

3 The command “journalctl -xe” gives the following errors: 3.1 [UFW BLOCK] IN OUT MAC SRC DST LEN TOS PREC TTL ID PROTO SPT DPT WINDOW RES SYN URGP - I only listed the property names (keys) without their values. 3.2 machine sshd[19370]: Invalid user NAME from IP port PORT machine sshd[19370]: Received disconnect from IP port PORT:VAL: Bye Bye [preauth] machine sshd[19370]: Disconnected from invalid user NAME IP port PORT [preauth] It seems like someone is trying to connect to me ??? I haven’t given my IP address or any other means of connecting to me to anyone, so I use it only for development purposes.

I tried to create a completely new machine (server). I set everything up from scratch, it worked for 5 minutes, and then stopped.

What could be the problem? Thanks for any help

If you are interested and you need any other information, let me know what I can provide you!

Show comments
Submit an answer
Answer a question...

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

KFSys
Site Moderator
Site Moderator badge
• March 10, 2023

Hey @cyberial,

Let’s start with the first problem - Nginx. The error you’ve given is :

  1.  2.1 nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use) 2.2 nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)

This is a 100% because there is another process runing on port 80. It’s possible you have another WebSerivce like Apache running and both to be fighting for port 80. If one service is already listening to the port then you can’t have another also using it.

When this happens, what you can do is :

  1. nestat -tulpen | grep 80

See what it returns, you can post it here. That is what you need to kill or better just disable.

As for the second question and the message you are receiving:

  1. sshd[19370]: Invalid user NAME from IP port PORT machine sshd[19370]: Received disconnect from IP port PORT:VAL: Bye Bye [preauth]

This is because someone tried to access your machine. Now, while it’s a brute force attempt, I wouldn’t worry that much about it, It’s common to have such attempts on your Droplet, usually done by bots. As long as you are using ssh key authentication and updating your system regularly, they shouldn’t be able to do anything.