No access to ssh but still want to have access to data
Very Recently, My Linode got hacked. SSHed by an attacker that is using my paid money to (maybe) crypto mine as the 100% CPU.
As the owner of the server i have tried to change the password and failed. As of today Linode sent me and an email alerting of high CPU usage. I want to see any activity on this linode before I delete it.
Is there anyway to back it up? Do I need to pay for backup to backup in my pc as .img?
1 Reply
jhartman
Linode Staff
Our Linode Backup Service is an exclusively proactive means to create restorations of your Linode server. If you had not enrolled in the service and captured at least one Daily Backup prior to this system compromise and you had not taken any other steps to independently backup your data, our Support Team does not have an alternate way to rollback your server.
Based on what you described, paying for our Backups may be helpful moving forward as a strategy to make your data more resilient, but paying for that service will not provide us with any way to retroactively capture or restore your data as it had existed in the past.
Moving forward, one of the best ways to prevent your system from being hacked is to increase your system's security and to maintain constant vigilance. The following steps are great ways to secure any server, new or existing:
- Reset the Root Password on your Linode to something complex and unique. Make sure to include capital and lowercase letters, numbers, and symbols and make sure the password is at least 12-16 characters longer (maybe even longer) to make the password harder to guess.
- Harden SSH Access with Key-Pair Authentication. By disabling root login, empty password attempts, and only allowing connections by devices with authorized SSH keys, this alone can prevent most malicious server access.
- Configure an internal firewall using UFW or [create an external Cloud Firewall through Cloud Manager[(https://www.linode.com/docs/products/networking/cloud-firewall/get-started/). UFW can allow for more granular control of your firewall, while using Cloud Firewall externally can reduce CPU usage by preventing certain traffic types/requests from even reaching your Linode.
- Installing Fail2ban to Secure Your Server against malicious SSH attempts. Fail2Ban will blocklist abusive IPs preventing them from being able to Brute Force log into your servers.
We also highly recommend that you periodically scan your server for Malware with ClamAV.