Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse

Cloudron Forum

Apps | Demo | Docs | Install

Our server is hacked: foreign addresses in china, finland, france etc

Scheduled Pinned Locked Moved Solved Support
security
29 Posts 9 Posters 557 Views
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • Z Offline
    Z Offline
    ZeZaung
    wrote on last edited by girish
    #1

    Hello there

    Evidently, we got hacked.

    Our instance provider has let us know that we have abuse traffic emanating from our machine. We've monitored foreign addreses and know, for sure, the instance is compromised.

    Question for the cloudron's so-called turnkey security team: What can we do to protect ourselves? This is especially important to get an answer from you since we're incapable of installing modest network or Os-level security provisions within the instance without interfering with cloudron itself.

    We understand Cloudron literature suggests the following

    Security is a core feature of Cloudron and we continue to push out updates to tighten the Cloudron firewall's security policy. Our goal is that Cloudron users should be able to rely on Cloudron being secure out of the box without having to do manual configuration.
    

    Can the turnkey security team give us some advice on software we can install (that still works with cloudron) to deal with this? A lot of our preferred security & hardening measures are not doable without interfering with cloudron itself

    Before our team goes through the onerous process of creating a new instance and backing up these apps individually or resetting them all together, we want to know what security measures can be implemented on the second time around, so we aren't wasting time after the fact.

    A simple netstat and awk monitoring program shows unique hits from foreign addresses in countries such as China, finland, and France, all on strange ports certainly not associated with our deployed applications.

    Considering the restrictive nature of 3rd party installations of software on a OS level for the master control plane instance we are hoping cloudron's turnkey security team can get back to us promptly. the current state of things suggests we can't rely on cloudron as a platform for production grade loads or traffic.

    BrutalBirdieB 1 Reply Last reply
    0
  • BrutalBirdieB Offline
    BrutalBirdieB Offline
    BrutalBirdie Staff
    replied to ZeZaung on last edited by
    #2

    @ZeZaung
    Could you please explain what got hacked?
    Because the statement:

    foreign addresses in china, finland, france etc

    can be expected for a public server.

    Our instance provider has let us know that we have abuse traffic emanating from our machine. We've monitored foreign addreses and know, for sure, the instance is compromised.

    What exactly was happening? This is all so vague.

    Can the turnkey security team give us some advice on software we can install (that still works with cloudron) to deal with this? A lot of our preferred security & hardening measures are not doable without interfering with cloudron itself

    To give advise or investigate it would be tremendously helpful to know what happened.
    Do you have:

    • logs
    • statements from the provider

    Did the server get compromised on the root level, was custom software running?
    An App level?


    Did you perhaps run an the adguard app and did not secure it properly, and it got used for a reflection attack?

    🤷
    Please share more details.

    Like my work? Consider donating a drink drink. Cheers!

    Z 1 Reply Last reply
    5
  • Z Offline
    Z Offline
    ZeZaung
    replied to BrutalBirdie on last edited by
    #3

    @BrutalBirdie

    Answers to your question.

    Could you please explain what got hacked?

    The VPS itself has been hacked and an unknown process emanating from this IP has been detected by our cloud provider

    can be expected for a public server.

    I am telling you that connections from all these different hosts is unconnected and not explainable, no/

    Our instance provider has let us know that we have abuse traffic emanating from our machine. We've monitored foreign addreses and know, for sure, the instance is compromised.

    What exactly was happening? This is all so vague.

    See below

    Do you have:

    • logs
    • statements from the provider
      See below
    Hello,
    
    Here is a sample of the traffic that was detected per your request.
    
    -- Traffic excerpt below --
    
    Reported-From: root@dascos.info
    Report-ID: 1676447666@jeeg
    Category: abuse
    Report-Type: login-attack
    Service: 404trap
    User-Agent: csf v14.17
    Date: 2023-02-15T08:54:26+0100
    Source:(OUR.IP.WAS.HERE)
    Source-Type: ipv4
    Attachment: text/plain
    Schema-URL: https://download.configserver.com/abuse_login-attack_0.2.json
    
    (OUR.IP.WAS.HERE) 172.16.0.50 nolodapria.it [15/Feb/2023:08:54:17 +0100] GET /?author=161 HTTP/2.0 404
    (OUR.IP.WAS.HERE) 172.16.0.50 nolodapria.it [15/Feb/2023:08:54:18 +0100] GET /?author=162 HTTP/2.0 404
    (OUR.IP.WAS.HERE) 172.16.0.50 nolodapria.it [15/Feb/2023:08:54:19 +0100] GET /?author=163 HTTP/2.0 404
    (OUR.IP.WAS.HERE).16.0.50 nolodapria.it [15/Feb/2023:08:54:20 +0100] GET /?author=164 HTTP/2.0 404
    
    -- Traffic excerpt above --
    
    Please review and resolve the abuse.
    
    We will be forced to power down this instance if we do not receive an update within 24 hours.
    

    This was one of their warnings. We have done some preliminary investigation via netstat and rootkit searches and can provide logs to you. Who do we email?

    Can you help us differentiate the traffic we are seeing to discern what processes are responsible for this and where the security compromise is arising from within the operating system? A lot of our diagnostic tools we can not install without interfering with cloudron.

    Did you perhaps run an the adguard app and did not secure it properly, and it got used for a reflection attack?
    Sorry no

    Please let us know who to send this info to. We will capture logs over hte past 20 mins or so in a few files.

    BrutalBirdieB 1 Reply Last reply
    0
  • BrutalBirdieB Offline
    BrutalBirdieB Offline
    BrutalBirdie Staff
    replied to ZeZaung on last edited by
    #4

    @ZeZaung
    please provide as many details as possible to support@cloudron.io

    Like my work? Consider donating a drink drink. Cheers!

    Z 1 Reply Last reply
    1
  • Z Offline
    Z Offline
    ZeZaung
    replied to BrutalBirdie on last edited by
    #5

    thanks, we'll be in toch

    BrutalBirdieB 1 Reply Last reply
    0
  • girishG Offline
    girishG Offline
    girish Staff
    wrote on last edited by girish
    #6

    Yes, please send a mail to support@cloudron.io with more information. I am not really sure what was compromised or how things were compromised from your report. There is nothing inherently wrong with a server contacting china/finland/france depending on what software you have installed. If you can tell us what additional security measure you want to put in place , we can give suggestions there as well , so that it doesn't interfere with Cloudron.

    1 Reply Last reply
    0
  • BrutalBirdieB Offline
    BrutalBirdieB Offline
    BrutalBirdie Staff
    replied to ZeZaung on last edited by
    #7

    @ZeZaung also I highly doubt you made a disk image of the server for forensic analytics, right?

    Like my work? Consider donating a drink drink. Cheers!

    Z L 2 Replies Last reply
    0
  • Z Offline
    Z Offline
    ZeZaung
    replied to BrutalBirdie on last edited by
    #8

    @BrutalBirdie Would a copy of a file generated at /var/backups suffice?

    BrutalBirdieB 1 Reply Last reply
    0
  • BrutalBirdieB Offline
    BrutalBirdieB Offline
    BrutalBirdie Staff
    replied to ZeZaung on last edited by
    #9

    @ZeZaung Please provide as many information as possible to support@cloudron.io

    • VPS Provider
    • OS Used (Version)
    • was ssh for root enabled with a weak password
    • what cloudron version was running
    • what apps where running
    • logs of the apps
    • logs of the system

    Provide as many details as possible.

    Like my work? Consider donating a drink drink. Cheers!

    Z 2 Replies Last reply
    2
  • Z Offline
    Z Offline
    ZeZaung
    replied to BrutalBirdie on last edited by
    #10

    @BrutalBirdie
    How do I tell which version of cloudron we're running?

    1 Reply Last reply
    0
  • Z Offline
    Z Offline
    ZeZaung
    replied to BrutalBirdie on last edited by
    #11

    @BrutalBirdie Also, which system logs would be most appropriate?

    BrutalBirdieB 1 Reply Last reply
    0
  • BrutalBirdieB Offline
    BrutalBirdieB Offline
    BrutalBirdie Staff
    replied to ZeZaung on last edited by
    #12

    @ZeZaung like I said, a full disk image for forensic analysis would be best.

    You can determine the Cloudron version from the latest backup made, since the newest backup included the box_X.Y.Z.tar.gz

    If you can provide everything that you have from that system that would be best.

    Like my work? Consider donating a drink drink. Cheers!

    1 Reply Last reply
    0
  • andreasduerenA Offline
    andreasduerenA Offline
    andreasdueren
    wrote on last edited by
    #13

    Piggybacking on this thread: I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

    jdaviescoatesJ BrutalBirdieB P 3 Replies Last reply
    2
  • jdaviescoatesJ Online
    jdaviescoatesJ Online
    jdaviescoates
    replied to andreasdueren on last edited by
    #14

    @andreasdueren said in Our server is hacked: foreign addresses in china, finland, france etc:

    I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

    I shouldn't think so.

    Personally I never have login with a password enabled and only have login via SHA public/ private keys enabled. Not sure what benefit 2FA would have in that case, but I'm presuming you've got a root password?

    I use Cloudron with Gandi & Hetzner

    1 Reply Last reply
    1
  • BrutalBirdieB Offline
    BrutalBirdieB Offline
    BrutalBirdie Staff
    replied to andreasdueren on last edited by BrutalBirdie
    #15

    @andreasdueren I am running all cloudron servers with root on complete lockdown.
    This even blocks default support access for the staff, if you enabled it.

    I also use normal ssh keys for the designated sudo user and also ed25519-sk and ecdsa-sk ssh keys for 2FA via Yubikey.
    This works with no issues.

    Like my work? Consider donating a drink drink. Cheers!

    andreasduerenA 1 Reply Last reply
    3
  • L Offline
    L Offline
    LoudLemur
    replied to BrutalBirdie on last edited by
    #16

    @BrutalBirdie Does Cloudron have a "click to create disk image" button?

    BrutalBirdieB 1 Reply Last reply
    0
  • BrutalBirdieB Offline
    BrutalBirdieB Offline
    BrutalBirdie Staff
    replied to LoudLemur on last edited by BrutalBirdie
    #17

    @LoudLemur a disk image is a complete bit to bit copy to a file of the whole drive.
    There is no way a software running on the same drive and at the same time that can create such an image, since it would recursively write it self into infinity.

    For that you need a live boot and create it yourself with dd or a tool like clonzilla.

    For more details: https://wiki.archlinux.org/title/disk_cloning

    Like my work? Consider donating a drink drink. Cheers!

    L 1 Reply Last reply
    0
  • P Offline
    P Offline
    privsec
    replied to andreasdueren on last edited by privsec
    #18

    @andreasdueren said in Our server is hacked: foreign addresses in china, finland, france etc:

    Piggybacking on this thread: I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

    @jdaviescoates said in Our server is hacked: foreign addresses in china, finland, france etc:

    @andreasdueren said in Our server is hacked: foreign addresses in china, finland, france etc:

    I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

    I shouldn't think so.

    Personally I never have login with a password enabled and only have login via SHA public/ private keys enabled. Not sure what benefit 2FA would have in that case, but I'm presuming you've got a root password?

    I have all accounts require username, password, SSH with a key and 2FA

    1 Reply Last reply
    1
  • L Offline
    L Offline
    LoudLemur
    replied to BrutalBirdie on last edited by
    #19

    Thanks. For a cloned disk image to be useful, wouldn't it also have to be very recent, too? Repeatedly cloning the entire disk and then archiving these images would be resource intensive.

    Perhaps information from btrfs or ZFS might be useful, if they were the file system.

    @BrutalBirdie said in Our server is hacked: foreign addresses in china, finland, france etc:

    @LoudLemur a disk image is a complete bit to bit copy to a file of the whole drive.
    There is no way a software running on the same drive and at the same time that can create such an image, since it would recursively write it self into infinity.

    For that you need a live boot and create it yourself with dd or a tool like clonzilla.

    For more details: https://wiki.archlinux.org/title/disk_cloning

    BrutalBirdieB 1 Reply Last reply
    0
  • BrutalBirdieB Offline
    BrutalBirdieB Offline
    BrutalBirdie Staff
    replied to LoudLemur on last edited by
    #20

    @LoudLemur yes full disk images are regularly as big as the disk it self.
    So if you got a 1TB disk the Disk Image will be 1TB.
    Yes you could cut empty space which is unused.

    When a system is compromised, normally you shutdown the system, create a disk image and then format the server and setup new.
    Then this disk image can be used for later analytics.

    Like my work? Consider donating a drink drink. Cheers!

    humptydumptyH 1 Reply Last reply
    3

  • Login

  • Don't have an account? Register

  • Login or register to search.
  • First post
    Last post
0
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Login

  • Don't have an account? Register

  • Login or register to search.