7

Yesterday, my VPS hosting provider blocked my network in and out of my VPS, because they received abuse notice from Sony Entertainment, claiming that the IP of my VPS was attacking their servers.

In the email, they said it was just 1 hour, but still...

My VPS provider then blocked all traffic from and to my VPS, so now I can only connect trough VNC KVM.

I am running Debian 9 with these services:

  • Virtualmin
  • Roundcube
  • Apache2
  • PHP
  • Node.js (pm2, few running node apps)
  • Standard mail server
  • OpenVPN server

Almost all of those were installed and are maintained by Virtualmin GPL.

I don't know how to find out if someone really used my VPS to DDoS (or other bot attacked) someone else.

What should I do?

1
3

Virtualmin, is a terrible, terrible way to manage a server because by definition you use mod_suexec to accomplish basic server maintenance. Yes I know it's a useful tool but believe me the issues it creates far outweigh the good.

Here's the bad news, your server is compromised, there's no safe way to recover from this. Back up your mail, your openvpn config and kiss the server good bye. You're better off starting over. The good news is now that you're starting over, you can do this right. Setup a mail server, doing it isn't hard. Setup openvpn allowing only particular ips to access it. Disable all apache modules you don't need. Disable all node apps you are not using. Disable all the php modules you don't need. i.e. use the principles of least privilege.

You may never be the best *nix admin but use the command line as much as possible. You've learnt an important lesson here, the easier you make things for yourself; the easier it is for bad guys to take control of the server. I personally only ever open ports 80 and 443 to the world, port 22 is only ever open to vpn and vpn itself is only accessible to my IP address at the office and my home.

If I need mail, then 987 is a good port to use but other than that...lock that machine down, you don't need anything else open to the world. Tools like virtualmin/webmin/etc are great if they are setup using least privilege principles but in the end they are really not your friend.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.