All VestaCP installations being attacked Topic is solved

[Spheerys]

I'm a little be disapointed by the fact we still don't have any clue to investigate about this hack.
We were several to ask how to check if ours servers are under attack, but we don't have any clear anwser to chek, and to understand the attack.

People which have hundred hacked servers : please give us more information, at least to check if we are impacted or not.

[jcerdan]

Hi,

I think the issue is in VestaCP web interface.
Is there a possibilty for Vesta Dev Team to separate Vesta in little projects?

1) Vesta-core with API script
2) Vesta Web Interface
3) Vesta -softaculous & vesta-ioncube

This way, anybody would install only what they really want and develop its own web frontend, shared on github or not.
Also, security for Vesta Team should be focused on Vesta-core and API, letting other developers enter and modify/enhance Vesta Web interface.

Regards,

[Spheerys]

We can maybe hardener VestaCP with a .htpasswd ?

[jcerdan]

You can do that, but I don't know if API calls will be affected by the .htaccess.
Also, you can create a sort of "bridge" in PHP via another server to access VestaCP web interface, by translating POST and GET calls, but that's a little bit harder.

Best thing for now is restrict access to VestaCP Panel by IP and if Dev Team can separate VestaCP in projects that will allow other devs to create new Web interfaces to Vesta-core and API.

[agus]

You can do that, but I don't know if API calls will be affected by the .htaccess.
Also, you can create a sort of "bridge" in PHP via another server to access VestaCP web interface, by translating POST and GET calls, but that's a little bit harder.

Best thing for now is restrict access to VestaCP Panel by IP and if Dev Team can separate VestaCP in projects that will allow other devs to create new Web interfaces to Vesta-core and API.

how to do this?

[jcerdan]

Hi @agus,

search in this forum and you'll find

[imperio]

We are thinking, what we can do with this

The project continues to develop. Don't worry

[joni]

Ohh thank you for info, we were in panic

[imperio]

How can we know if our server is compromised?

if this file /usr/bin/dhcprenew exists on your server it means that it is hacked

[joni]

How can we know if our server is compromised?

if this file /usr/bin/dhcprenew exists on your server it means that it is hacked

Hallo,
..and what should we do? will just deleting this file help saving us from other problems or we must reinstall the servers?