GoGrid-hosted server hacked between provisioning and first login • Hacker News Board

Re: GoGrid-hosted server hacked between provisioning and first login

#21

Post by quicksilver03 » Thu, Jul 14, 2011, 12:50 PM UTC

dangrossman wrote: post #9

TheOnly92 wrote: post #5

Just wondering, can't you just format the server again? Or doesn't GoGrid provide that option at all? Since it's a brand new server, I guess there's no problem in formatting and installing it again.

That's what I was thinking. When you rent a server you're renting hardware and a connection. If you screw up the software side (like getting hacked) you can always wipe the drive and reinstall. Why would you want to cancel a year long contract because you're set back an hour to reimage?

Pure speculation because I cannot make any sense of GoGrid offering, but if they offer what's usually called a "managed server", it means that you do not have the right to reimage the server yourself, you must submit a ticket and the hosting company is supposed to perform the reimaging.

Re: GoGrid-hosted server hacked between provisioning and first login

#22

Post by sanswork » Thu, Jul 14, 2011, 4:10 PM UTC

adamtulinius wrote: post #19

mborromeo wrote: post #16

With a little effort they could use ssh keys instead of passwords... They should ask users to provide their ssh public keys, and use them to give access to a new provisioned server locking down password-based ssh logins. That's how other players (like AWS) do. This is basic basic basic security stuff.

For a start they could just use a proper random root password, instead of a default one, and maybe only allow ssh access from the same netblock the install was ordered from. However, one thing i don't get: Why is it that people don't log in immediately after it is ready? On Linode it only takes a few minutes to (re)install a VM, but GoGrid might be slower of course.

I have used GoGrid for a while. And though originally very critical of them(check my blog) haven't had too many problems lately. For both dedicated servers and cloud servers I've always had a random root password generated. Not sure how this person ended up with one that was g0gr1d.

As for your question, by the sounds of it he ordered a dedicated server not a cloud one. Those usually take them the better part of a day to setup.

Re: GoGrid-hosted server hacked between provisioning and first login

#23

Post by sanswork » Thu, Jul 14, 2011, 4:13 PM UTC

jjwiseman wrote: post #8

ianhawes wrote: post #3

Frankly, I don't buy this at all. It is very difficult in 2011 to provision a server that is really vulnerable by default. I suspect that the person who posted this was in some other way compromised, and is blaming it on GoGrid.

I don't know what happened in this case, but it doesn't seem very difficult: 1. Configure server to use password authentication and allow logins from anywhere. 2. Send password to user via unencrypted email. There's a reason that people are uncomfortable receiving passwords via email.

1. Is true of GoGrid. 2. They don't you get the initial passwords from their admin panel.