858
I didn't know you were supposed to disable root user... (linux.community)
submitted 2 years ago by to c/linuxmemes@lemmy.world
170 comments fedilink hide all child comments
 

Background: 15 years of experience in software and apparently spoiled because it was already set up correctly.

Been practicing doing my own servers, published a test site and 24 hours later, root was compromised.

Rolled back to the backup before I made it public and now I have a security checklist.

you are viewing a single comment's thread
view the rest of the comments
[–] 40 points 2 years ago (5 children)

How are people's servers getting compromised? I'm no security expert (I've never worked in tech at all) and have a public VPS, never been compromised. Mainly just use SSH keys not passwords, I don't do anything too crazy. Like if you have open SSH on port 22 with root login enabled and your root password is password123 then maybe but I'm surprised I've never been pwned if it's so easy to get got...

  • permalink
  • fedilink
  • source
  • hideshow 10 child comments
    •
  • [–] 28 points 2 years ago (1 child)

    By allowing password login and using weak passwords or by reusing passwords that have been involved in a data breach somewhere.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 8 points 2 years ago

    That makes sense. It feels a bit mad that the difference between getting pwned super easy vs not is something simple like that. But also reassuring to know, cause I was wondering how I heard about so many hobbyist home labs etc getting compromised when it'd be pretty hard to obtain a reasonably secured private key (ie not uploaded onto the cloud or anything, not stored on an unencrypted drive that other people can easily access, etc). But if it's just password logins that makes more sense.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 8 points 2 years ago

    The one db I saw compromised at a previous employer was an AWS RDS with public Internet access open and default admin username/password. Luckily it was just full of test data, so when we noticed its contents had been replaced with a ransom message we just deleted the instance.

  • permalink
  • fedilink
  • source
  • parent