6 ms·
FYI, all OVH servers have a backdoor preinstalled on them. You'll want to: echo "" > /root/.ssh/authorized_keys2 rm -rf /usr/local/rtm echo "" > /etc/cr
by dsl 14y ago
FYI, all OVH servers have a backdoor preinstalled on them.
You'll want to:
echo "" > /root/.ssh/authorized_keys2
rm -rf /usr/local/rtm
echo "" > /etc/crontab
killall -9 rtm
We used OVH for some testing/dev boxes and ended up adding OVH specific puppet configs to clean up the box.
Edit: Oh and on Windows you need to hit up Add/Remove programs and uninstall 'Corp SSH'
- deleted 14y ago[deleted]
- maximegarcia 14y agoThis for maintenance reporting. How do the hell they know if one of your HD has died ? It's not mandatory. And the ssh key added enforces the source IP address of requests.
- tptacek 14y agoOne way would be to publish a HTTP/JSON API for fetching a specific set of stats from a server given an authorization key, provide a reference implementation, and allow customers to build their own if they're not comfortable with that. Root SSH logins don't seem like a particularly good solution for this problem.
- hosay123 14y agoSurprised to read this from a security guy. 1) discard time-tested crypto implementation 2) write your own. 3) run it as root so it can read sensors 4) feel safer Everything aside, most of these colo machines are set to netboot in order to implement their rescue system. Never poked around, but wouldn't be surprised those DHCP requests hit other machines on the segment. OVH seem to be more sensible than most when it comes to network configuration, but I wouldn't be surprised this happens in other places (the difference between a $50 Ethernet switch and a $5000 Ethernet switch right there) Edit: since some don't seem to understand the basics of security, or perhaps out of an ill-placed sense of loyalty: running a web server + CGI combo as root on an Ethernet segment exposed to other colo customers, in place of a 20 year old service designed for exactly this scenario, when its sole user already has hardware access (and reboot + netboot access) to the machine is fucking stupid. I'm making no argument here, just calling out terrible advice for what it is.
- tptacek 14y ago?!
- hosay123 14y agoWhich bit didn't you understand?
- tptacek 14y agoEvery single one of your numbered points. 1) discard REMOTE SHELL solely for OS statistics 2) write your own TINY WEB APPLICATION SERVED BY NGINX/APACHE 3) run it as SOME USER THAT can read STATISTICS DATA 4) BE safer
- hosay123 14y ago1. > One way would be to publish a HTTP/JSON API for fetching a specific set of stats from a server > given an authorization key 2. > provide a reference implementation, and allow customers to build their own if they're not comfortable with that. Implies 3: entire point of the implementation is to read sensors, which requires root, or further messing with the security properties of the base system (e.g. sudo), and expecting users to do this correctly. So basically what you're advocating is to encourage users to run custom HTTP servers as root. Edit: and I see you edited your comment, and now advocating running nginx as root.
- catwell 14y agoNo. This is so their technicians can easily log into your servers and solve problems if you need them too. Lots of their customers are newbies so they sell technical help as a service. It is documented here: http://help.ovh.co.uk/InstallOvhKey http://help.ovh.co.uk/InstallOvhKey and http://help.ovh.co.uk/Intervention http://help.ovh.co.uk/Intervention as well as the way to disable this "backdoor". Note that there is more information available if you switch to the French language...
- shimon_e 14y agoThe main reason I'm not so concerned is if they have physical access to the server they have root access anyway. At least this way I can see them logging in.
- lifeguard 14y agoWhile you are removing "backdoors", you secure your boot loader, right? And I am sure you realize there is no way to secure windows server file system (off-line Password and Registry editors). I usually don't worry about the NOC & DC staff, but since it is the topic here I am commenting.
- derrida 14y agoAh yes, the "Systèmes d'exploitation".