What a coincidence. I also received a similar email and upon investigating, found the same Monero mining on my server. Tried rebuilding the image, but same thing was poping up. Then I did a npm update and that fixed everything!
I got hacked: My Hetzner server started mining Monero
401–410 of 422 posts
Re: I got hacked: My Hetzner server started mining Monero
#402Earlier quoted context omitted.
That sucks, I never had any problem running a Dockerfile in podman. I don't know what I do differently, but I would as a principle filter out any container that messes with stuff like docker in docker. Podman doesn't need these kind of shenegians. Also the Docker Compose tool is a well-know exception to the compatibility story. (There is some unofficial podman compose tool, but that is not feature complete and quadle…
There's a real dearth of blog posts explaining how to use quadlets for the local dev experience, and actually most guides I've seen seem to recommend using podman/Docker compose. Do you use quadlets for local dev and testing?
Quadlets aren't what I'd personally use for local dev. They are good for running a local headless persistent service. So I wouldn't use it for your service-under-test but they can be a good fit for supporting dev tools like a local package registry, proxy or VPN gateway.
The docs you need for quadlets are basically here: https://docs.podman.io/en/latest/markdown/podman-systemd.uni...
The one gotcha I can think of not mentioned there is that if you run it as a non-root user and want it to run without logging in as that user, you need to: `sudo loginctl enable-linger $USER`.
If you don't vibe with quadlets, it's equally fine to do a normal systemd .service file with `ExecStart=podman run ...`, which quadlets are just convenience sugar for. I'd start there and then return to quadlets if/when you find that becomes too messy. Don't add new abstraction layers just because you can if they don't help.
If you have a more complex service consisting of multiple containers you want to schedule as a single unit, it's also totally fine to combine systemd and compose by having `ExecStart=podman compose up ...`.
Do you want it to run silently in the background with control over autorestarts and log to system journal? Quadlets/systemd.
Do you want to have multiple containers scheduled together (or just prefer it)? Compose.
Do you want to manually invoke it and have the output in a terminal by default? CLI run or compose.
Re: I got hacked: My Hetzner server started mining Monero
#403Earlier quoted context omitted.
All fine and well, but oracle will threaten to turn off your instance if you don’t maintain a reasonable average CPU usage on the free hosts, and will eventually do so abruptly. This became enough of a hassle that I stopped using them.
Do you mean if it’s idle, or if it’s maxed out? I’ve had a few relatively idle free-tier VMs with Oracle and I’ve not received any threats of shutoff over the last 3 years I’ve had them online.
Idle - low usage Minecraft server was the issue for me
Re: I got hacked: My Hetzner server started mining Monero
#404Earlier quoted context omitted.
do i really need to explain on hackernews that email is not E2EE? yes which shows your comment has no actual data behind it hence FUD.
You really need to explain why whether or not email is E2EE is related to people needing to tell me they use email or not.
if you can't follow a basic discussion maybe don't have them. there are no factual statistics about monero crime unlike email because its private by design unlike email. i provided factual evidence about email being primarily used for crime, meanwhile you have "your feeling" about monero but still refuse to apply the same lens towards something you like once facts are against it. your ignorance and different treatment of the two based on emotions is apparent but has no place in a factual discussion.
Re: I got hacked: My Hetzner server started mining Monero
#405Earlier quoted context omitted.
Public facing services routed through a firewall or waf (cloudflare) always. Backend access trivial with Tailscale, etc.
Stupid question probably, but: how can it not be routed through a firewall? If you have it at home, it's behind a router that should have a firewall already, right? And just forwards the one port you expose to the server? Cloudflare can certainly do more (e.g. protect against DoS and hide your personal IP if your server is at home).
No such thing as a stupid question.
If you plug in a machine at home, it is behind the router, and behind the router's firewall.
If you want more of a firewall locally, something as simple as an EdgeRouter X can get you started easily with this excellent guide: https://github.com/mjp66/Ubiquiti
The nice thing about using cloudflare tunnel, is theres zero ports to expose, ever. The cloudflare tunnel app running on your local machine is what connects out to the internet and takes care of creating a secure connection between cloudflare and your machine.
If you want to forward more than one port to the machine, you could use something like cloudflare to forward to a machine on your home server, and then have the nginx proxy manager or something send the traffic around internally.
It's totally fine to start with cloudflare, and if you aren't already, something like Proxmox (youtube tutorials are pretty quick) gets you up and running and playing pretty quick. Feel free to ask any other questions you like.
Re: I got hacked: My Hetzner server started mining Monero
#406Earlier quoted context omitted.
Public facing services routed through a firewall or waf (cloudflare) always. Backend access trivial with Tailscale, etc. Public IP never needs to be used. You can just leave it an internal IP if you really want.
A firewall is a server, too, though.
Thanks. Not sure of your point.
The firewall could run on a piece of dedicated equipment, where it might not be a server, or it could run in a container, on a dedicated computer, which might be the server.
Again, I'm only speaking about what I have experience with in addition to my past experience and have surprisingly found to run well despite thinking I'd never self-host again.
Re: I got hacked: My Hetzner server started mining Monero
#407Earlier quoted context omitted.
The tunnel doesn't have to use the Public IP inbound, the cloudflare tunnel calls outbound that can be entirely locked up. If you are using Cloudflare's DNS they can hide your IP on the dns record but it would still have to be locked down but some folks find ways to tighten that up too. If you're using a bare metal server it can be broken up. It's fair that it's a 3rd party's castle. At the same time until you know h…
What does the tunnel bring except DoS protection and hiding your IP? And what is the security concern with divulging your IP? Say when I connect to a website, the website knows my IP and I don't consider this a security risk. If I run vulnerable software, it will still be vulnerable through a Cloudflare tunnel, right? Genuinely interested, I'm always scared to expose things to the internet :-).
Small "except". :)
With the amount of automated bots that port scan looking for anything/everything that's open, as well as scanning DNS records for server IPs that could be targeted, one of the nice patterns of cloud hosting is how application and data servers are hosted behind firewalls of some kind, to effectively be internal.
As for what's exposed to the web, let's say the payload of a website, if there was something vulnerable in the javascript, that could be a weakness hosted anywhere.
Cloudflare can also help achieve this without too much fuss for self-hosted projects, be it personal, and production grade, assuming the rest of the trimmings are tehre.
Re: I got hacked: My Hetzner server started mining Monero
#408Earlier quoted context omitted.
Many ways. Using a "bastion host" is one option, with something like wireguard or tinc. Tailscale and similar services are another option. Tor is yet another option.
The bastion host is a server, though, and would be exposed to the internet.
It can run a firewall and forward to internal traffic as well.
Re: I got hacked: My Hetzner server started mining Monero
#409Earlier quoted context omitted.
Stupid question probably, but: how can it not be routed through a firewall? If you have it at home, it's behind a router that should have a firewall already, right? And just forwards the one port you expose to the server? Cloudflare can certainly do more (e.g. protect against DoS and hide your personal IP if your server is at home).
No such thing as a stupid question. If you plug in a machine at home, it is behind the router, and behind the router's firewall. If you want more of a firewall locally, something as simple as an EdgeRouter X can get you started easily with this excellent guide: https://github.com/mjp66/Ubiquiti The nice thing about using cloudflare tunnel, is theres zero ports to expose, ever. The cloudflare tunnel app running on you…
Thanks a lot!
One thing I don't really get is why it is "more dangerous" to expose a port on my home IP, versus exposing a port on a Cloudflare tunnel. In both cases, a random user from the Internet can reach my server, and if I host a vulnerable application on that exposed port, it can be exploited. Right?
In order to host my server at home, but keep it outside my LAN, I have been considering having two routers: a "perimeter" router (not sure if that's how it's called) that connects to my ISP, and my normal "LAN" router. The LAN router does not expose anything, as usual. I connect my server to the perimeter router, so that it is in the "DMZ" between both routers. And on the perimeter router, I expose the port to my server. My idea being that if my server gets hacked, it doesn't affect my LAN. A bit like if my server was on a remote VPS.
And then I can run something like proxmox to separate my different services on my server.
But doing this, I expose my home IP instead of a Cloudflare IP, so now I'm concerned that maybe it is a risk? :-)
Re: I got hacked: My Hetzner server started mining Monero
#410Earlier quoted context omitted.
What does the tunnel bring except DoS protection and hiding your IP? And what is the security concern with divulging your IP? Say when I connect to a website, the website knows my IP and I don't consider this a security risk. If I run vulnerable software, it will still be vulnerable through a Cloudflare tunnel, right? Genuinely interested, I'm always scared to expose things to the internet :-).
Small "except". :) With the amount of automated bots that port scan looking for anything/everything that's open, as well as scanning DNS records for server IPs that could be targeted, one of the nice patterns of cloud hosting is how application and data servers are hosted behind firewalls of some kind, to effectively be internal. As for what's exposed to the web, let's say the payload of a website, if there was somet…
> one of the nice patterns of cloud hosting is how application and data servers are hosted behind firewalls of some kind
Oh I see, so that I benefit from the "professional" firewall of Cloudflare, as opposed to my own that I may have possibly misconfigured or forgot to update etc?
Or is there more, like Cloudflare will block IPs that know to come from malicious actors and things like this?