Got 10 VestaCP servers exploited

[headlong]

It seems that my CP autoupdated and now I can't access web UI. All services are active. What should I do?

Same bug :( Updated to latest, all services working, except WEB UI

[RevengeFNF]

Never forget to block the port with a whitelist to certain ip's you use.

I have port 8083 blocked in iptables and i was not a victim of this exploit.

[vesta_mtl]

It seems that my CP autoupdated and now I can't access web UI. All services are active. What should I do?

DigitalOcean (and perhaps Vultr and others) have recently blocked the default Vesta port (8083). Follow these steps to change the port (and optionally add IP firewall) and then see if you can access Vesta GUI at the new port: viewtopic.php?f=10&t=16556&start=280#p68935

[bruce7890]

Never forget to block the port with a whitelist to certain ip's you use.

That's easier said than done if you're selling access to your server as a web host would...

[kobo1d]

or limit access to port 8083 using firewall

no thats not working. i got infected while this port was only available to my ip !!

[snakom23]

have problem on debian 9 with update. News about?

[kobo1d]

Never forget to block the port with a whitelist to certain ip's you use.

I have port 8083 blocked in iptables and i was not a victim of this exploit.

i did the same and i got hacked anyway. the port was only available to my ip !!

ACCEPT TCP/ VESTA 8083 xxx.xxx.xxx.xxx (myip)
default policy is drop

[pipoy]

It seems that my CP autoupdated and now I can't access web UI. All services are active. What should I do?

DigitalOcean (and perhaps Vultr and others) have recently blocked the default Vesta port (8083). Follow these steps to change the port (and optionally add IP firewall) and then see if you can access Vesta GUI at the new port: viewtopic.php?f=10&t=16556&start=280#p68935

I can confirm that vultr did not block port 8083.

[bruce7890]

or limit access to port 8083 using firewall

no thats not working. i got infected while this port was only available to my ip !!

Are you sure? I thought this was all about 8083 being publicly available?

[RevengeFNF]

Never forget to block the port with a whitelist to certain ip's you use.

That's easier said than done if you're selling access to your server as a web host would...

In those cases, password protect the access to it in nginx or apache configuration, and give the pass to your customer.