Background: 15 years of experience in software and apparently spoiled because it was already set up correctly.

Been practicing doing my own servers, published a test site and 24 hours later, root was compromised.

Rolled back to the backup before I made it public and now I have a security checklist.

  • Tablaste@linux.communityOPEnglish
    741·
    12 天前

    I published it to the internet and the next day, I couldn’t ssh into the server anymore with my user account and something was off.

    Tried root + password, also failed.

    Immediately facepalmed because the password was the generic 8 characters and there was no fail2ban to stop guessing.

    • lud@lemm.ee
      94·
      12 天前

      Don’t use passwords for ssh. Use keys and disable password authentication.

      • Voroxpete@sh.itjust.works
        563·
        12 天前

        More importantly, don’t open up SSH to public access. Use a VPN connection to the server. This is really easy to do with Netbird, Tailscale, etc. You should only ever be able to connect to SSH privately, never over the public net.

        • troed@fedia.io
          321·
          12 天前

          It’s perfectly safe to run SSH on port 22 towards the open Internet with public key authentication only.

              • designatedhacker@lemm.ee
                2·
                11 天前

                Are you talking a VPN running on the same box as the service? UDP VPN would help as another mentioned, but doesn’t really add isolation.

                If your vpn box is standalone, then getting root is bad but just step one. They have to own the VPN to be able to even do more recon then try SSH.

                Defense in depth. They didn’t immediately get server root and application access in one step. Now they have to connect to a patched, cert only, etc SSH server. Just looking for it could trip into some honeypot. They had to find the VPN host as well which wasn’t the same as the box they were targeting. That would shut down 99% of the automated/script kiddie shit finding the main service then scanning that IP.

                You can’t argue that one step to own the system is more secure than two separate pieces of updated software on separate boxes.

        • josefo@leminal.space
          4·
          12 天前

          Tailscale? Netbird? I have been using hamachi like a fucking neanderthal. I love this posts, I learn so much

            • Ghoelian@lemmy.dbzer0.com
              5·
              12 天前

              Fedora (immutable at least) has it disabled by default I think, but it’s just one checkbox away in one of the setup menus.

          • jatone@lemmy.dbzer0.comEnglish
            6·
            12 天前

            we’re probably talking about different things. virtually no distribution comes with root access with a password. you have to explicitly give the root user a password. without a password no amount of brute force sshing root will work. I’m not saying the root user is entirely disabled. so either the service OP is building on is basically a goldmine for compromised machines or OP literally shot themselves in the root by giving root a password manually. something you should never do.

            • satans_methpipe@lemmy.world
              2·
              10 天前

              Yeah I was confused about the comment chain. I was thinking terminal login vs ssh. You’re right in my experience…root ssh requires user intervention for RHEL and friends and arch and debian.

              Side note: did you mean to say “shot themselves in the root”? I love it either way.

              • jatone@lemmy.dbzer0.comEnglish
                1·
                10 天前

                Side note: did you mean to say “shot themselves in the root”? I love it either way.

                ssh its better with the typo. ;)

            • steventhedev@lemmy.world
              1·
              12 天前

              Many cloud providers (the cheap ones in particular) will put patches on top of the base distro, so sometimes root always gets a password. Even for Ubuntu.

              There are ways around this, like proper cloud-init support, but not exactly beginner friendly.

      • Björn Tantau@swg-empire.de
        8·
        12 天前

        Love Hetzner. You just give them your public key and they boot you into a rescue system from which you can install what you want how you want.

        • r00ty@kbin.life
          10·
          12 天前

          I think their auction servers are a hidden gem. I mean the prices used to be better. Now they have some kind of systrem that resets them when they get too low. But the prices are still pretty good I think. But a year or two ago I got a pretty good deal on two decently spec’d servers.

          People are scared off by the fact you just get their rescue prompt on auctions boxes… Except their rescue prompt has a guided imaging setup tool to install pretty much every popular distro with configurable raid options etc.

          • Björn Tantau@swg-empire.de
            7·
            12 天前

            Yeah, I basically jump from auction system to auction system every other year or so and either get a cheaper or more powerful server or both.

            • r00ty@kbin.life
              6·
              12 天前

              I monitor for good deals. Because there’s no contract it’s easy to add one, move stuff over at your leisure and kill the old one off. It’s the better way to do it for semi serious stuff.

    • cm0002@lemmy.world
      11·
      12 天前

      because the password was the generic 8 characters and there was no fail2ban to stop guessing

      Oof yea that’ll do it, your usually fine as long as you hardened enough to at least ward off the script kiddies. The people with actual real skill tend to go after…juicer targets lmao

      • Tablaste@linux.communityOPEnglish
        11·
        12 天前

        Haha I’m pretty sure my little server was just part of the “let’s test our dumb script to see if it works. Oh wow it did what a moron!”

        Lessons learned.

    • stoy@lemmy.zip
      6·
      12 天前

      I ran a standard raspian ssh server on my home network for several years, default user was removed and my own user was in it’s place, root was configured as standard on a raspbian, my account had a complex but fairly short password, no specific keys set.

      I saw constant attacks but to my knowledge, it was never breached.

      I removed it when I realized that my ISP might take a dim view of running a server on their home client net that they didn’t know about, especially since it showed up on Shodan…

      Don’t do what I did, secure your systems properly!

      But it was kinda cool to be able to SSH from Thailand back home to Sweden and browse my NAS, it was super slow, but damn cool…

      • troed@fedia.io
        4·
        12 天前

        Why would a Swedish ISP care? I’ve run servers from home since I first connected up in … 1996. I’ve had a lot of different ISPs during that time, although nowadays I always choose Bahnhof because of them fighting the good fights.

        • stoy@lemmy.zip
          3·
          12 天前

          They probably don’t, unless I got compromised and bad traffic came from their network, but I was paranoid, and wanted to avoid the possibility.

      • MonkeMischief@lemmy.today
        1·
        12 天前

        But it was kinda cool to be able to SSH from Thailand back home to Sweden and browse my NAS, it was super slow, but damn cool…

        That feels like sorcery, doesn’t it? You can still do this WAY safer by using Wireguard or something a little easier like Tailscale. I use Tailscale myself to VPN to my NAS.

        I get a kick out of showing people my NextCloud Memories albums or Jellyfin videos from my phone and saying “This is talking to the box in my house right now! Isn’t that cool!?” Hahaha.

        I’m almost glad I had to go that route. Most of our ISPs here in the U.S will block outgoing ports by default, so they can keep the network safe sell you a home business plan lol.