Quote from: InternetApe on May 28, 2014, 03:25:16 AM

Quote from: reda on May 28, 2014, 02:52:17 AM

Quote from: InternetApe on May 28, 2014, 01:36:32 AM

thank you very much for the help over skype, it seems that the hacker could enter my vps, don't know how exactly but he did
he will post on darkcointalk some advice and tips to not have the same issue as me

if someone can help me in any way please send some tip on my darkcoin wallet
XhGwaKJPMdqEyMU85QBReNNMzVGKDW2EPz

So here was the issue(s).

It appears there is someone that is pulling all the masternodes from the wallet and running scripts on them to hack in.

And in this case they was able to gain access via SSH, so it had nothing to do with problems in the wallet/daemon/masternode itself.

The firewall was not running, so all ports were open
Root access via SSH was allowed
OpenSSL v1.0.1f was installed on the server
The password to unlock the wallet was still in bash history command
The root password was less than 8 characters

My recommendations:

DO NOT allow root ssh access
Only open port 9999 in your firewall to the world
Only open port 22 (SSH) to a trusted ip
Setup SSH to use certificates for logging in
Do not run any application on the server that you dont have to
Encrypt you wallet
Clear your bash history

There are more, but this would have secured this server.

If any of you can spare a few darkcoins to help this person, he lost 999DRK because of the above issues.

his wallet address is XhGwaKJPMdqEyMU85QBReNNMzVGKDW2EPz

He learned the HARDWAY how not to setup your masternode. I will be putting together a list of things to check and an ISO and AMI for people to use with MOST of the issue addressed, you will still be responsible for checking any think I missed and verify it works for your setup.

His lose WILL help everyone else by showing what you MUST setup so please help him where you can. I will pull some together myself to send.

I want add one more

Do InternetApe's recommendations plus
- use /etc/hosts.allow and /etc/hosts.deny for caution(if firewall is opened somehow, it will help)
(** if your home ip is dedicated or vary with in c class range).

Code:

# /etc/hosts.deny
# See 'man tcpd' and 'man 5 hosts_access' as well as /etc/hosts.allow
# for a detailed description.

sshd : all

Code:

# /etc/hosts.allow
# See 'man tcpd' and 'man 5 hosts_access' for a detailed description
# of /etc/hosts.allow and /etc/hosts.deny.
#
sshd : specific_ip
sshd : a.b.c. # allow a.b.c.0 ~ a.b.c.255