Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

411–420 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#411

Post by wnevets »

akimbostrawman wrote: post #404
wnevets wrote: post #397

Earlier quoted context omitted.

You really need to explain why whether or not email is E2EE is related to people needing to tell me they use email or not.

if you can't follow a basic discussion maybe don't have them. there are no factual statistics about monero crime unlike email because its private by design unlike email. i provided factual evidence about email being primarily used for crime, meanwhile you have "your feeling" about monero but still refuse to apply the same lens towards something you like once facts are against it. your ignorance and different treatmen…

You are still trying to argue that email's primary use is crime?

Re: I got hacked: My Hetzner server started mining Monero

#412

Post by j45 »

palata wrote: post #409
j45 wrote: post #405

Earlier quoted context omitted.

No such thing as a stupid question. If you plug in a machine at home, it is behind the router, and behind the router's firewall. If you want more of a firewall locally, something as simple as an EdgeRouter X can get you started easily with this excellent guide: https://github.com/mjp66/Ubiquiti The nice thing about using cloudflare tunnel, is theres zero ports to expose, ever. The cloudflare tunnel app running on you…

Thanks a lot! One thing I don't really get is why it is "more dangerous" to expose a port on my home IP, versus exposing a port on a Cloudflare tunnel. In both cases, a random user from the Internet can reach my server, and if I host a vulnerable application on that exposed port, it can be exploited. Right? In order to host my server at home, but keep it outside my LAN, I have been considering having two routers: a "…

Exposing ports on home ip:

- exposes the port to be available for inbound connections from anyone on the public internet. When we use a web browser, it's outbound first which initiates responses.

- with an exposed port, you are that much more at the mercy of your firewalls ability to protect and defend the open port, which becomes more of a consideration.

- some people take additional security steps to only allow certain IPs to connect to the exposed port if it works for their scenario.

Compared with the Cloudflare Tunnel:

- if it's a website, for example, nothing is open to the public at all. The CF Tunnel (or a similar tool) conencts first outbound to Cloudflare to setup a secure link between your home server.

- having this amount of security can make it harder to connect back to your own server for admin - this is where a tool like Tailscale (also free) can be handy, where you can continue to have full secured access to the server, and the public side only has whatever you want to expose to the public internet.

- if there's a port or service in specific you're looking to sort out feel free to ask.

Network design:

- keeping a server at home outside of your LAN is a good idea, it could be a perimeter router. DMZ can mean exposed to the internet without a firewall.

- if you read the guide I posted above, it's sounds like an exact match for what your'e trying to figure out - it achieves it with multiple VLANS to separate traffic rules. The PDF has some nice graphics to break it out - I wish I had somethign like this when starting out. The concepts described in the PDF should be possible on most equipment that exposes the settings, and while I don't endorse a particular product, the Ubiquiti EdgeRouter X for the $50 or so is very capable as a starting point for what you are after to be the main router. In thet case of adding a dedicated router like this, you would have to switch your modem into "bridging" mode to let this be the main router for everything. Wireless access points can then be individually added to it. Alternatively if something like pfSense interests you, their parent company makes Netgate equipment that a lot of people seem to love. Both are well represented and supported on Youtube to learn from as well.

Re: I got hacked: My Hetzner server started mining Monero

#413

Post by j45 »

palata wrote: post #410
j45 wrote: post #407

Earlier quoted context omitted.

Small "except". :) With the amount of automated bots that port scan looking for anything/everything that's open, as well as scanning DNS records for server IPs that could be targeted, one of the nice patterns of cloud hosting is how application and data servers are hosted behind firewalls of some kind, to effectively be internal. As for what's exposed to the web, let's say the payload of a website, if there was somet…

> one of the nice patterns of cloud hosting is how application and data servers are hosted behind firewalls of some kind Oh I see, so that I benefit from the "professional" firewall of Cloudflare, as opposed to my own that I may have possibly misconfigured or forgot to update etc? Or is there more, like Cloudflare will block IPs that know to come from malicious actors and things like this?

Both are a yes.

Re: I got hacked: My Hetzner server started mining Monero

#414

Post by j45 »

sergsoares wrote: post #79
j45 wrote: post #11

Never expose your server IP directly to the internet, vps or baremetal.

Not expose the server IP is one practice (obfuscation) in a list of several options. But that alone would not solve the problem being a RCE from HTTP, that is why edge proxy provider like Cloudflare[0] and Fastfy[1] proactivily added protections in his WAF products. Even cloudflare had an outage trying to protect his customers[3]. - [0] https://blog.cloudflare.com/waf-rules-react-vulnerability/ - [1] https://www.fast…

No provider is perfect - It's totally possible to run your own FW behind it, or run CF Tunnel on a separate container that routes traffic to individual application containers using something like traefik, nginx proxy manager, etc.

Re: I got hacked: My Hetzner server started mining Monero

#415

Post by palata »

j45 wrote: post #412
palata wrote: post #409

Earlier quoted context omitted.

Thanks a lot! One thing I don't really get is why it is "more dangerous" to expose a port on my home IP, versus exposing a port on a Cloudflare tunnel. In both cases, a random user from the Internet can reach my server, and if I host a vulnerable application on that exposed port, it can be exploited. Right? In order to host my server at home, but keep it outside my LAN, I have been considering having two routers: a "…

Exposing ports on home ip: - exposes the port to be available for inbound connections from anyone on the public internet. When we use a web browser, it's outbound first which initiates responses. - with an exposed port, you are that much more at the mercy of your firewalls ability to protect and defend the open port, which becomes more of a consideration. - some people take additional security steps to only allow cer…

Thank you so much! Very insightful!

Re: I got hacked: My Hetzner server started mining Monero

#416

Post by arminiusreturns »

arminiusreturns wrote: post #308
3np wrote: post #106

> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…

UFW and Firewall-CMD both just use iptables in that context though. The real upgrade is in switching to nftables. I know I'm going to need to learn eBpf as the next step too, but for now nftables is readable and easy to grok especially after you rip out the iptables stuff, but technically nftables is still using netfilter. And ufw supports nftables btw. I think the real lesson is write your own firewalls and make the…

edit* Apparently because I haven't used firewall-cmd in a long time, I was wrong on this: firewall-cmd does indeed use nftables by default.

Re: I got hacked: My Hetzner server started mining Monero

#417

Post by akimbostrawman »

wnevets wrote: post #411
akimbostrawman wrote: post #404

Earlier quoted context omitted.

if you can't follow a basic discussion maybe don't have them. there are no factual statistics about monero crime unlike email because its private by design unlike email. i provided factual evidence about email being primarily used for crime, meanwhile you have "your feeling" about monero but still refuse to apply the same lens towards something you like once facts are against it. your ignorance and different treatmen…

You are still trying to argue that email's primary use is crime?

yes with hard data unlike you about monero. have a nice day

Re: I got hacked: My Hetzner server started mining Monero

#418

Post by wnevets »

akimbostrawman wrote: post #417
wnevets wrote: post #411

Earlier quoted context omitted.

You are still trying to argue that email's primary use is crime?

yes with hard data unlike you about monero. have a nice day

> yes with hard data unlike you about monero. have a nice day

If I accepted your version of the events then you need to accept you posted a link stating that spam makes up 45% of email traffic, 45% is neither half nor the majority. I suggest you actually read your "hard data" before posting it.

Re: I got hacked: My Hetzner server started mining Monero

#419

Post by akimbostrawman »

wnevets wrote: post #418
akimbostrawman wrote: post #417

Earlier quoted context omitted.

yes with hard data unlike you about monero. have a nice day

> yes with hard data unlike you about monero. have a nice day If I accepted your version of the events then you need to accept you posted a link stating that spam makes up 45% of email traffic, 45% is neither half nor the majority. I suggest you actually read your "hard data" before posting it.

"In 2023, nearly 45.6 percent of all e-mails worldwide were identified as spam, down from almost 49 percent in 2022. While remaining a big part of the e-mail traffic, since 2011, the share of spam e-mails has decreased significantly. In 2023, the highest volume of spam e-mails was registered in May, approximately 50 percent of e-mail traffic worldwide."

you have to be a fool to think there is less spam 2 years later but thank you for proving once again your clear bias and inability to read.

Re: I got hacked: My Hetzner server started mining Monero

#420

Post by subscribed »

flowerthoughts wrote: post #291
subscribed wrote: post #234

Earlier quoted context omitted.

I like steering docker runs with docker-compose, especially with .env files - easy to store in repositories, easy to customise and have sane defaults.

Yeah agreed. I use docker-compose. But it doesn't help if the Docker images try to update /etc/passwd, or force a hardcoded UID, or run some install.sh at runtime instead of buildtime.

Oh, absolutely. Some things some images try to do are just silly.
Post reply on HN