Page 3 of 24
Re: All VestaCP installations being attacked
Posted: Tue Sep 25, 2018 1:45 pm
by trom
I need work servers
How change vesta port?
Re: All VestaCP installations being attacked
Posted: Tue Sep 25, 2018 2:07 pm
by realjumy
trom wrote: ↑Tue Sep 25, 2018 1:45 pm
I need work servers
How change vesta port?
My servers had the port changed. They still were compromised.
Re: All VestaCP installations being attacked
Posted: Tue Sep 25, 2018 2:15 pm
by dpeca
In what datacenter are those servers?
Re: All VestaCP installations being attacked
Posted: Tue Sep 25, 2018 2:21 pm
by realjumy
dpeca wrote: ↑Tue Sep 25, 2018 2:15 pm
In what datacenter are those servers?
Mine and my friends' are in OVH. I don't know other people.
Re: All VestaCP installations being attacked
Posted: Tue Sep 25, 2018 2:30 pm
by MrCraac
Hi, 21 servers hacked , all hosted by OVH. All of them with random ports.
We really need to have feedback about what was the issue and how it worked, until then , our servers are going back to plesk :(
Re: All VestaCP installations being attacked
Posted: Tue Sep 25, 2018 2:30 pm
by lukapaunovic
I just want to report I have two customers whose servers were recently reinstalled and everything was clean. They got hacked and their server suspended for outbound DoS
They had mod_security with Comodo WAF rules implemented on apache.... also maldetect... chkrootkit...
And also had these functions disabled. The sites weren't under admin account. Passwords were strong, clients weren't using nulled.
Code: Select all
disable_functions = "pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,show_source,system,passthru,shell_exec,proc_open,popen,phpinfo"
There seems to be a major security breach in VESTA. This cannot be coincidental. Two servers, same time. it means it was the same entry-point (similar like the one before in Roundcube). This needs to be investigated ASPAP.
Re: All VestaCP installations being attacked
Posted: Tue Sep 25, 2018 2:57 pm
by realjumy
lukapaunovic wrote: ↑Tue Sep 25, 2018 2:30 pm
I just want to report I have two customers whose servers were recently reinstalled and everything was clean. They got hacked and their server suspended for outbound DoS
They had mod_security with Comodo WAF rules implemented on apache.... also maldetect... chkrootkit...
And also had these functions disabled. The sites weren't under admin account. Passwords were strong, clients weren't using nulled.
Code: Select all
disable_functions = "pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,show_source,system,passthru,shell_exec,proc_open,popen,phpinfo"
There seems to be a major security breach in VESTA. This cannot be coincidental. Two servers, same time. it means it was the same entry-point (similar like the one before in Roundcube). This needs to be investigated ASPAP.
Which provider were they using?
Re: All VestaCP installations being attacked
Posted: Tue Sep 25, 2018 3:07 pm
by lukapaunovic
OVH....
They are always being targeted, along with Digital Ocean.
Some people who use Hetzner aren't having issues because bots aren't scanning those IP ranges.
They are just 'lucky'. That doesn't mean issue/vulnerability is not present.
Re: All VestaCP installations being attacked
Posted: Tue Sep 25, 2018 3:23 pm
by trom
I use servers on different hosters problem at all
If port change dont help i think we need hide or block login on vesta panel from web
but HOW ?
I noticed that on one server when i try to open :8083/login/
i see 502 erorr
this erorr was only in one hoster and appeared today
Re: All VestaCP installations being attacked
Posted: Tue Sep 25, 2018 3:44 pm
by realjumy
trom wrote: ↑Tue Sep 25, 2018 3:23 pm
I use servers on different hosters problem at all
If port change dont help i think we need hide or block login on vesta panel from web
but HOW ?
I noticed that on one server when i try to open :8083/login/
i see 502 erorr
this erorr was only in one hoster and appeared today
Try withouth the /login, and also check that it's the right port.
If that doesn't work, probably the provider stopped your VM.