Our server is hacked: foreign addresses in china, finland, france etc

[BrutalBirdie]

@ZeZaung
please provide as many details as possible to support@cloudron.io

[ZeZaung]

thanks, we'll be in toch

[girish]

Yes, please send a mail to support@cloudron.io with more information. I am not really sure what was compromised or how things were compromised from your report. There is nothing inherently wrong with a server contacting china/finland/france depending on what software you have installed. If you can tell us what additional security measure you want to put in place , we can give suggestions there as well , so that it doesn't interfere with Cloudron.

[BrutalBirdie]

@ZeZaung also I highly doubt you made a disk image of the server for forensic analytics, right?

[ZeZaung]

@BrutalBirdie Would a copy of a file generated at /var/backups suffice?

[BrutalBirdie]

@ZeZaung Please provide as many information as possible to support@cloudron.io

• VPS Provider
• OS Used (Version)
• was ssh for root enabled with a weak password
• what cloudron version was running
• what apps where running
• logs of the apps
• logs of the system

Provide as many details as possible.

[ZeZaung]

@BrutalBirdie
How do I tell which version of cloudron we're running?

[ZeZaung]

@BrutalBirdie Also, which system logs would be most appropriate?

[BrutalBirdie]

@ZeZaung like I said, a full disk image for forensic analysis would be best.

You can determine the Cloudron version from the latest backup made, since the newest backup included the box_X.Y.Z.tar.gz

If you can provide everything that you have from that system that would be best.

[andreasdueren]

Piggybacking on this thread: I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

[jdaviescoates]

@andreasdueren said in Our server is hacked: foreign addresses in china, finland, france etc:

I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

I shouldn't think so.

Personally I never have login with a password enabled and only have login via SHA public/ private keys enabled. Not sure what benefit 2FA would have in that case, but I'm presuming you've got a root password?

[BrutalBirdie]

@andreasdueren I am running all cloudron servers with root on complete lockdown.
This even blocks default support access for the staff, if you enabled it.

I also use normal ssh keys for the designated sudo user and also ed25519-sk and ecdsa-sk ssh keys for 2FA via Yubikey.
This works with no issues.

[LoudLemur]

@BrutalBirdie Does Cloudron have a "click to create disk image" button?

[BrutalBirdie]

@LoudLemur a disk image is a complete bit to bit copy to a file of the whole drive.
There is no way a software running on the same drive and at the same time that can create such an image, since it would recursively write it self into infinity.

For that you need a live boot and create it yourself with dd or a tool like clonzilla.

For more details: https://wiki.archlinux.org/title/disk_cloning

[privsec]

@andreasdueren said in Our server is hacked: foreign addresses in china, finland, france etc:

Piggybacking on this thread: I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

@jdaviescoates said in Our server is hacked: foreign addresses in china, finland, france etc:

@andreasdueren said in Our server is hacked: foreign addresses in china, finland, france etc:

I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

I shouldn't think so.

Personally I never have login with a password enabled and only have login via SHA public/ private keys enabled. Not sure what benefit 2FA would have in that case, but I'm presuming you've got a root password?

I have all accounts require username, password, SSH with a key and 2FA

[LoudLemur]

Thanks. For a cloned disk image to be useful, wouldn't it also have to be very recent, too? Repeatedly cloning the entire disk and then archiving these images would be resource intensive.

Perhaps information from btrfs or ZFS might be useful, if they were the file system.

@BrutalBirdie said in Our server is hacked: foreign addresses in china, finland, france etc:

@LoudLemur a disk image is a complete bit to bit copy to a file of the whole drive.
There is no way a software running on the same drive and at the same time that can create such an image, since it would recursively write it self into infinity.

For that you need a live boot and create it yourself with dd or a tool like clonzilla.

For more details: https://wiki.archlinux.org/title/disk_cloning

[BrutalBirdie]

@LoudLemur yes full disk images are regularly as big as the disk it self.
So if you got a 1TB disk the Disk Image will be 1TB.
Yes you could cut empty space which is unused.

When a system is compromised, normally you shutdown the system, create a disk image and then format the server and setup new.
Then this disk image can be used for later analytics.

[humptydumpty]

@BrutalBirdie on a vps, is a server snapshot the equivalent to a full disk image and can it be used for analytics?

[BrutalBirdie]

@humptydumpty Should be.
If you can create a server from it or attach it to a different server, then sure.

[privsec]

@BrutalBirdie You are the bomb.com

It might be worthwhile to write up a guide or refer to a already created guide on what to do in this exact type of an instance for future cases like this.