Error loading signatures in Anti-Malware feature

Same issue here, I subscribe the thread

Try to change the /wp-content/plugins/ninjafirewall/lib/share folder’s permissions to group writable: if it is 0755 (drwxr-xr-x), make it 0775 (drwxrwxr-x).

I’ve just read this thread hoping for a resolution, and sadly, nothing
here has helped.
WP 4.6, NinjaFirewall 3.2.4
I’m also getting the message “Error: unable to load signatures (#2)” after a 10 second time-out. I’m NOT seeing wp-cron.php called anywhere in the log files. I’m not seeing anything helpful anywhere in any logs. I’ve set perms such that it simply cannot be a permissions issue.
This site is one of 4 nearly identical WP installs on the same host. The other 3 are working just fine.
In fact, this particular site is not yet in production. I’ve just moved it to this host. On it’s live host where it is in production, everything is working brilliantly. But on this host, as an exact duplicate, it is not working. I’m pretty baffled at this point.

We will release NinjaFirewall v3.2.5 this Sunday which includes a debugging log for the antimalware. Wait for that new version and, after the update, run the scan and check the log which will be located in /wp-content/nfwlog/cache/malscan.log.

Latest version 3.2.6:
1473154082: [FW] Fetching signatures from /home/test/test/www/wp-content/nfwlog/cache/malscan_tot.sigs
1473154082: [FW] ERROR: file not found

I fixed that . Added hostname to /etc/hosts, because I use internal IP addresses.

• This reply was modified 8 years, 2 months ago by oloo. Reason: fixed

!!!!!
I’ve been googling this issue for 2 days and reading myself blind, testing
absolutely everything I came across as a possible fix.

Why on earth does it not state somewhere in (heck, any documentation anywhere)
that WP cron will not function unless the site is resolvable? What a simple fix.

@oloo, whoever you are, I hope something really good happens to you today.

It must be resolvable, because plugin use Ajax – [AX] POSTing request to https://_domain_/wp-cron.php

Hello,

I’m not receiving the same error described in this thread but the scan is not working. I’m just receiving the following error:

An unknown error occurred. Please check the “/wp-content/nfwlog/malscan.log” log. (#1).

After reviewing the mentioned log, it looks that the scan started but for some reason it stoped working:

1477882513: [AX] Entering ajax callback
1477882513: [AX] POSTing request to https://revotechnostore.com/revotechnostorecore/wp-cron.php
1477882513: [CR] Starting cron
1477882513: [CR] Starting malware scan
1477882513: [CR] Cleaning cache
1477882513: [CR] Loading NinjaFirewall’s signatures
1477882513: [CR] Looking for potential user-defined signatures
1477882513: [CR] No user-defined signatures found
1477882513: [CR] Scanning files

I’m experiencing this problem on latest plugin version and I’m using plus plugin:
NinjaFirewall (WP+) – version 3.3.2

I have already tried all suggestions mentioned on this thread, performed a fresh install and tried with free plugin version but the problem is still happening.

Please assist.

Best regards,
Gabriel

Hi,

Could you check your PHP and HTTP server error logs?
Maybe there is a time-out (either PHP or your HTTP server) that stops the scanning process.

Hello,

Thanks so much for your response, that was the problem indeed. I had mod-security enabled on my apache server. As soon as I deactivated it, the scan started to work as expected.

I will have to twick the mod-security a little bit or just disable it when I want to perform the scan.

Best regards,
Gabriel

Was it blocked by a built-in ModSecurity rule? If it was, can you give me its ID so that I could look at it and see why does it block the scan?

Hello,

Well, I don’t recall modifying any of the default mod-security settings so I guess it should be a built-in mod-security rule.

Where can I get that ID that you mentioned or the rule is blocking the scan?

Best regards,
Gabriel

It depends on which Linux distro you are using and if you have a panel such as Plesk or cPanel.
The best way to find its path is to look inside your Modsecurity configuration file (search for “SecAuditLog”).

• This reply was modified 8 years ago by nintechnet.

hey,

have the same problem, tried everything from this thread, but nothin works. The logs says:

1488380339: [AX] Entering ajax callback
1488380339: [AX] POSTing request to https://xxx.xx/wp-cron.php
1488380339: [FW] Fetching signatures from /home/xxx/public_html/wp-content/nfwlog/cache/malscan_tot.sigs
1488380339: [FW] ERROR: file not found

Any ideas?

Your log shows that NinjaFirewall sent an AJAX POST request ([AX]) to the “wp-cron.php” script in order to load the signatures and start the scan, and then nothing happened; the firewall ([FW]) returned an error because it cannot find the results.
Do you have any issue with the “wp-cron.php” script, which is the WP pseudo-cron script? It could be disabled, or blocked?