Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

261–270 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#261

Post by szszrk »

zwnow wrote: post #231
dizhn wrote: post #216

Earlier quoted context omitted.

If you can, do not expose ports like this 8080:8080, but do this "192.168.0.1:8080:8080" so its bound to a private IP. Then use any old method expose only what you want to the world. In my own use I have 10.0.10.11 on the vm that I host docker stuff. It doesn't even have its own public IP meaning I could actually expose to 0.0.0.0 if I wanted to but things might change in the future so it's a precaution. That IP is o…

Yup the regular "8080:8080" bind resulted in a ransom note in my database on day 1. Bound it to localhost only now.

one thing I always forget about, is that you have a whole network of 127.0.0.0/8 , not just one IP.

So you can create multiple addresses with multiple separate "domains" mapped statically in /etc/hosts, and allow multiple apps to listen on "the same" port without conflicts.

Re: I got hacked: My Hetzner server started mining Monero

#262

Post by palata »

j45 wrote: post #166
doublerabbit wrote: post #144

Earlier quoted context omitted.

That server is still exposed to the internet on a public IP. Just only known and courted through a 3rd party's castle.

The tunnel doesn't have to use the Public IP inbound, the cloudflare tunnel calls outbound that can be entirely locked up. If you are using Cloudflare's DNS they can hide your IP on the dns record but it would still have to be locked down but some folks find ways to tighten that up too. If you're using a bare metal server it can be broken up. It's fair that it's a 3rd party's castle. At the same time until you know h…

What does the tunnel bring except DoS protection and hiding your IP? And what is the security concern with divulging your IP? Say when I connect to a website, the website knows my IP and I don't consider this a security risk.

If I run vulnerable software, it will still be vulnerable through a Cloudflare tunnel, right?

Genuinely interested, I'm always scared to expose things to the internet :-).

Re: I got hacked: My Hetzner server started mining Monero

#263

Post by mos87 »

spiderfarmer wrote: post #72
qingcharles wrote: post #62

As an aside, if you're using a Hetzner VPS for Umami you might be over-specced. I just cut my Hetzner bill by $4/mo by moving my Umami box to one of the free Oracle Cloud VPS after someone on here pointed out the option to me. Depends whether this is a hobby thing or something more serious, but that option is there.

I pay for Hetzner because it’s an EU based, sane company without a power hungry CEO.

Orange Man Bad?!?

Re: I got hacked: My Hetzner server started mining Monero

#264

Post by xetera »

danparsonson wrote: post #92

No firewall! Wow that's brave. Hetzner will let you configure one that runs outside of the box so you might want to add that too, as part of your defense in depth - that will cover you if you make a mistake with ufw. Personally I keep SSH firewalled only to my home address in this way; if I'm out and about and need access, I can just log into Hetzner's website and change it temporarily.

For the record this is only available for their VPS offering and not dedis. If you rent a dedi through their server auction you still need to configure your own firewall.

Re: I got hacked: My Hetzner server started mining Monero

#265

Post by denismenace »

BLKNSLVR wrote: post #110
wnevets wrote: post #35

Sure does seem like the primary outcome of cryptocurrencies being released onto the world has been criminals making money.

Criminals and the porn industry are almost invariably early adopters of new technologies. For better or worse their use-cases are proof-of-concepts that get expanded and built on, if successful, by more legitimate industries. Re: the Internet. Re: Peer-to-peer. Re: Video streaming. Re: AI.

How were criminals the early adopters of Internet, Video streaming and AI?

Re: I got hacked: My Hetzner server started mining Monero

#266

Post by wasmitnetzen »

3np wrote: post #141
jsheard wrote: post #140

Earlier quoted context omitted.

Not if you run it in rootless mode, which is more of a first class citizen in Podman compared to Docker.

> Not if you run it in rootless mode. Same as for docker, yes? https://docs.docker.com/engine/security/rootless/

Rootless exists in Docker, yes, but as OP said, it's not first-class. The setup process is clunky, things break more often. In podman it just works, and podman is leading with features like quadlets, which make docker services just services like any other.

Re: I got hacked: My Hetzner server started mining Monero

#267

Post by bardsore »

reddalo wrote: post #252
PeterStuer wrote: post #229

Earlier quoted context omitted.

Hetzner has a free firewall service outside of your machine. You can use that as the first line of defence.

That's what I use. Is it enough? Or should I also install a firewall on my machine?

Security in layers, I'd do both.

Re: I got hacked: My Hetzner server started mining Monero

#268

Post by dns_snek »

exceptione wrote: post #122
3np wrote: post #106

> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…

> Specifically for docker it is a very common gotcha that the container runtime can and will bypass firewall rules and open ports anyway. Like I said in another comment, drop Docker, install podman.

podman is not a drop-in replacement for Docker. You can replace it with podman but expect to encounter minor inconsistencies and some major differences, especially if you use Docker Compose or you want to use podman in rootless mode. It's far from just being a matter of `alias docker=podman`.

The only non-deprecated way of having your Compose services restart automatically is with Quadlet files which are systemd unit files with extra options specific to containers. You need to manually translate your docker-compose.yml into one or more Quadlet files. Documentation for those leaves a lot to be desired too, it's just one huge itemized man page.

Re: I got hacked: My Hetzner server started mining Monero

#269

Post by kh_hk »

exceptione wrote: post #122
3np wrote: post #106

> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…

> Specifically for docker it is a very common gotcha that the container runtime can and will bypass firewall rules and open ports anyway. Like I said in another comment, drop Docker, install podman.

I keep reading comments by podman fans asking to drop Docker and yet every time I have tried to use podman it failed on me miserably. IMHO it would be better if podman was not designed and sold as a docker drop in replacement but its own thing.

Re: I got hacked: My Hetzner server started mining Monero

#270

Post by ps »

reddalo wrote: post #252
PeterStuer wrote: post #229

Earlier quoted context omitted.

Hetzner has a free firewall service outside of your machine. You can use that as the first line of defence.

That's what I use. Is it enough? Or should I also install a firewall on my machine?

Do both. Using provider's firewall service adds another level of defence. But hiccups may occur and firewall rules may briefly disappear (sync issues, upgrades, vm mobility issues) and you services then may become exposed. Happened to me in the past, were "lucky" enough so no damage was taken.
Post reply on HN