3 ms·
This is quite funny because the other day I was asked by a friend to look at the box serving his company site just on a whim. I've never looked at or discussed
by bananas 13y ago
This is quite funny because the other day I was asked by a friend to look at the box serving his company site just on a whim. I've never looked at or discussed the tech he was using. Turns out he paid a company for "managed service" in 2004. They were crap so he stopped paying for the managed bit in 2006 but paid the £90/month for the 1U rack space. He was running IMAP and a static site. IMAP stopped working one day so he moved it to hosted Exchange and shrugged it off. The static site was fine and has been updated via FTP since by his design agency who don't know arse from elbow.
So the first thing I did was nmap it. SSH, HTTP, SMTP, IMAP open. Fair enough.
SSH'ed in. Some interesting surprises in there. 10 year old DL360 G2 with one dead disk in the array with CentOS 3 on it. CPU spammed 100% with just about every bit of crap that could work its way through the ancient OpenSSH build (and presumably the cgi-bin and IMAP server (cyrus).
Sooooo... FTP'ed all the files of it, fired up a digital ocean box and locked it down, uploaded the static site to it, changed the A record on his DNS and shut the old box down.
I know this will only postpone the problem for another couple of years but what can you do with people like this? All I got was a "meh" and a crate of lager for my troubles ( granted it was 45 mins work but...)
- sentenza 13y agoWhat... what hosting provider will not notice this? Shouldn't their abuse mail address be glowing red?
- dredmorbius 13y agoDo you have any idea of how many abuse addresses are /dev/nulled? Sadly: black-hat takedown pages are sometimes your best sources of information. A few weeks back, a site I visit periodically was pwned via what appears to have been a Wordpress bug, based on similarities between it and other sites listed by the black-hat hacker. I fired off mail to the standard contact addresses for the site (abuse, webmaster, postmaster), all of which bounced. The listed WHOIS contact actually worked (an argument against domains by proxy), but I also reached out to the upstream hosting provider, who had several other hosts similarly taken down, though other providers were also affected. Sadly, and from my own experience, monitoring abuse for smaller shops (1-2 man admin team, far too many fires going on) is often a very, very low priority.
- bananas 13y agoShonky company. They wouldn't notice if someone nicked their servers.
- deleted 13y ago[deleted]
- listic 13y agoCould you possibly help us migrate our servers? How can I contact you? My email is in the profile.
- bananas 13y agoUnless you're in the UK, no.
- ejdyksen 13y agoWhy not host the site on S3?
- bananas 13y agoBecause I've had literally piles of trouble with AWS over the years. Edit: plus I might need to add some dynamic content...
- ejdyksen 13y agoDynamic content can be done pretty well with just JavaScript, depending on what your needs are. As for trouble you've had with AWS, I'd encourage you to take a second look at S3 specifically. It's been pretty bulletproof for a long time now.
- bananas 13y agoThat's not dynamic content. It's not. A company I worked for recently had a 2TiB S3 deployment for archiving insurance documents and the amount of hoops you gave to go through for it to be reliable is incredible (no uploads or downloads are guaranteed and sometimes randomly fail for a while).