Beiträge von furkan

Hello all,

I have recently received a mail regarding I had received a DDOS attack, and netcup raised shields for me to protect me from the attack. While I appreciate the protection, the DDOS behavior was coming from my Home NAS. Actually, I mounted my home nas with sshfs, so I guess the communication got intense for a prolonged time (like downloading something I guess). My home bandwidth is 1 Gbit, so it can get as intense as this.

Anyways, is there a way to whitelist my ip for that protection?

Zitat von Loxley

• Use SSH keys.
• Segment your docker network. Containers that don't need to communicate should be unable to communicate.
• Does your ufw filter outgoing connections? A rogue service should not be able to communicate with the internet.
• Who builds your docker containers? Why do you trust them?
• How will you recognize the next situation? What if you are on holiday?
• Drop the character classes in your password policy (debunked years ago) and make them longer and random.

• I know I should SSH keys, but wouldn't 2FA would provide sufficient security?
• Yeah, I do segment my docker networks.
• I was not aware of that outgoing filtering thing. Will certainly look into them.
• I tend to use from 'Trusted Content' filter from docker hub.
• Can you suggest an anomaly detection tool for servers?
• It's my go-to policy

Thanks for the great hints!

Hello. I was the OP (and the victim by some malicious activity) at the topic here.

So, I wanted to harden my security so I won't have to suffer from something like that issue again. So, here. what I did so far:

• Changed the ssh port. I know this one does not have an effect that much, but I see a dramatic reduction of attacks at logs.
• I still have password login with my ssh password, but now I am using 2FA with Google Authenticator.
• Enabled ufw and left only SSH port open. Rest of the applications are being reached behind a reverse proxy.
• There is absolutely zero port binding with the docker containers, as port bindings break port rules defined by ufw. All tunneling is working within a separate docker network.
• All apps are behind an authentication process. Each apps have their own 'hard' type password which has symbols lower and upper cases numericals with at least 12 char long.
• Only app that has a reach to docker management is Portainer.

What else I can do? Are those bullets enough for preventing the history to re-occur?

The reason just appeared. Apparently an exploit scanning took place within my server. Here is my explanation I sent to netcup:

I personally have no information about the incident. However, it is true that I observed something strange within my server, while I was working on it. On the way setting up the necessary parts for my data collection pipeline from cryptocurrency exchanges and other stuff, I've found that an odd container was eating lots of CPU, which I didn't deploy. After I terminate it, and after a few hours, I found a new container doing the same. After that, I found another one. I tried to explore the containers' includings but the container's output was NULL, so I left the investigation. So I decided to take the measures and re-install my VPS from scratch, thinking that malicious software was affected my server. 

As a measure to prevent future incidents like this one, I will have an effective use of UFW, change the ssh port and renew all of my passwords of applications I used within the server. 

Can netcup still charge me for the incident?

It would be an international call. Is there a WhatsApp line?

netcup deactivates my account 2nd time today, without any reason. Apparently they left me a 'abuse ticket' which includes a message of 'nicht abgeschlossen'. Translate gives me 'not completed' for translation of 'nicht abgeschlossen', which obviously makes no sense at all. Does anyone else experience this? What's the place of this incident in ToS?