Background: 15 years of experience in software and apparently spoiled because it was already set up correctly.

Been practicing doing my own servers, published a test site and 24 hours later, root was compromised.

Rolled back to the backup before I made it public and now I have a security checklist.

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 0 points 2 years ago* (13 children)

I published it to the internet and the next day, I couldn't ssh into the server anymore with my user account and something was off.

Tried root + password, also failed.

Immediately facepalmed because the password was the generic 8 characters and there was no fail2ban to stop guessing.

  • source
  • parent
  • hideshow 13 child comments
  • [+] 0 points 2 years ago* (last edited 1 year ago) (2 children)
  • [–] 0 points 2 years ago* (1 child)

    More importantly, don't open up SSH to public access. Use a VPN connection to the server. This is really easy to do with Netbird, Tailscale, etc. You should only ever be able to connect to SSH privately, never over the public net.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 2 years ago (9 children)

    wow crazy that this was the default setup. It should really force you to either disable root or set a proper password (or warn you)

  • source
  • parent
  • hideshow 9 child comments
  • [+] 1 point 2 years ago* (last edited 1 year ago) (8 children)
  • [–] -1 points 2 years ago (7 children)

    Which ones? I'm asking because that isn't true for cent, rocky, arch.

  • source
  • parent
  • hideshow 7 child comments
  • [+] 1 point 2 years ago* (last edited 1 year ago) (4 children)
  • [–] 0 points 2 years ago (1 child)

    Many cloud providers (the cheap ones in particular) will put patches on top of the base distro, so sometimes root always gets a password. Even for Ubuntu.

    There are ways around this, like proper cloud-init support, but not exactly beginner friendly.

  • source
  • parent
  • hideshow 1 child comment
  • [–] -1 points 2 years ago* (last edited 2 years ago) (1 child)

    Yeah I was confused about the comment chain. I was thinking terminal login vs ssh. You're right in my experience...root ssh requires user intervention for RHEL and friends and arch and debian.

    Side note: did you mean to say "shot themselves in the root"? I love it either way.

  • source
  • parent
  • hideshow 1 child comment