Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

211–220 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#211

Post by sph »

3np wrote: post #106

> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…

The problem with firewalld is that it has the worst UX of any program I know. Completely unintuitive options, the program itself doesn’t provide any useful help or hint if you get anything wrong and the documentation is so awful you have to consult the Red Hat manuals that have thankfully been written for those companies that pay thousands per month in support.

It’s not like iptables was any better, but it was more intuitive as it spoke about IPs and ports, not high-level arbitrary constructs such as zones and services defined in some XML file. And since firewalld uses iptables/nftables underneath, I wonder why do I need a worse leaky abstraction on top of what I already know.

I truly hate firewalld.

Re: I got hacked: My Hetzner server started mining Monero

#212

Post by spoaceman7777 »

seszett wrote: post #199
danparsonson wrote: post #191

Earlier quoted context omitted.

The author mentioned they had other services exposed to the internet (Postgres, RabbitMQ) which increases their attack surface area. There may be vulnerabilities or misconfigurations in those services for example. Good security is layered.

But if they have to be exposed then a firewall won't help, and if they don't have to be exposed to the internet then a firewall isn't needed either, just configure them not to listen on non-local interfaces.

This sounds like an extremely effective foot gun.

Just use a firewall.

Re: I got hacked: My Hetzner server started mining Monero

#214

Post by flowerthoughts »

3eb7988a1663 wrote: post #185
tracker1 wrote: post #100

Earlier quoted context omitted.

Another is running containers in read-only mode, assuming they support this configuration... will minimize a lot of potential attack surface.

Never looked into this. I would expect the majority of images would fail in this configuration. Or am I unduly pessimistic?

Readonly and rootless are my two requirements for Docker containers. Most images can't run readonly because they try to create a user in some startup script. Since I want my UIDs unique to isolate mounted directories, this is meaningless. I end up having to wrap or copy Dockerfiles to make them behave reasonably.

Having such a nice layered buildsystem with mountpoints, I'm amazed Docker made readonly an afterthought.

Re: I got hacked: My Hetzner server started mining Monero

#215

Post by elric »

seymon wrote: post #102

What's considered nowadays the best practice (in terms of security) for running selfhosted workloads with containers? Daemon less, unprivileged podman containers? And maybe updating container images with a mechanism similar to renovate with "minimumReleaseTime=7days" or something similar!?

As always: never run containers as root. Never expose ports to the internet unless needed. Never give containers outbound internet access. Run containers that you trust and understand, and not random garbage you find on the internet that ships with ancient vulnerabilities and a full suite of tools. Audit your containers, scan them for vulnerabilities, and nuke them from orbit on the regular.

Easier said than done, I know.

Podman makes it easier to be more secure by default than Docker. OpenShift does too, but that's probably taking things too far for a simple self hosted app.

Re: I got hacked: My Hetzner server started mining Monero

#216

Post by dizhn »

3np wrote: post #106

> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…

If you can, do not expose ports like this 8080:8080, but do this "192.168.0.1:8080:8080" so its bound to a private IP. Then use any old method expose only what you want to the world.

In my own use I have 10.0.10.11 on the vm that I host docker stuff. It doesn't even have its own public IP meaning I could actually expose to 0.0.0.0 if I wanted to but things might change in the future so it's a precaution. That IP is only accessible via wireguard and by the other machines that share the same subnet so reverse proxying with caddy on a public IP is super easy.

Re: I got hacked: My Hetzner server started mining Monero

#217

Post by seszett »

spoaceman7777 wrote: post #212
seszett wrote: post #199

Earlier quoted context omitted.

But if they have to be exposed then a firewall won't help, and if they don't have to be exposed to the internet then a firewall isn't needed either, just configure them not to listen on non-local interfaces.

This sounds like an extremely effective foot gun. Just use a firewall.

I'm not sure what you mean, what sounds dangerous to me is not caring about what services are listening to on a server.

The firewall is there as a safeguard in case a service is temporarily misconfigured, it should certainly not be the only thing standing between your services and the internet.

Re: I got hacked: My Hetzner server started mining Monero

#218

Post by dizhn »

danparsonson wrote: post #92

No firewall! Wow that's brave. Hetzner will let you configure one that runs outside of the box so you might want to add that too, as part of your defense in depth - that will cover you if you make a mistake with ufw. Personally I keep SSH firewalled only to my home address in this way; if I'm out and about and need access, I can just log into Hetzner's website and change it temporarily.

I have SSH blocked altogether and use wireguard to access the server. If something goes wrong I can always go to the dashboard and reenable SSH for my IP. But ultimately your setup is just as secure. Perhaps a tiny bit less convenient.

Re: I got hacked: My Hetzner server started mining Monero

#219

Post by croemer »

loloquwowndueo wrote: post #150
croemer wrote: post #146

Not proof read by a human. It claims more than once the vulnerability was related to Puppeteer. Hallucination! "CVE-2025-66478 - Next.js/Puppeteer RCE)"

TFA mentions it’s mostly a transcript of a Claude session literally in the first paragraph.

That doesn't excuse publishing errors.

Re: I got hacked: My Hetzner server started mining Monero

#220

Post by dizhn »

3abiton wrote: post #182
danparsonson wrote: post #92

No firewall! Wow that's brave. Hetzner will let you configure one that runs outside of the box so you might want to add that too, as part of your defense in depth - that will cover you if you make a mistake with ufw. Personally I keep SSH firewalled only to my home address in this way; if I'm out and about and need access, I can just log into Hetzner's website and change it temporarily.

Honestly fail2ban is amazing. I might doa write up on the countless of attempts on my servers.

The only way I've envisioned fail2ban to be of any use at all is if you gather IPs from one server and use them on your whole fleet and I got it running like this for a while. Ultimately I decided that all it does is give you a cleaner log file since by definition its working on logs for attacks/attempts that did not succeed. We need to stop worrying about attempts we see in the logs and let software do its job.
Post reply on HN