Droplet locked due to DDoS attack from my Droplet

February 7, 2018 4.2k views
DigitalOcean
dkanalie
By:
dkanalie

Today I received an email that my droplet has been locked due to a DDoS attack and outdoing traffic from my server. The email suggested I should look into the support section and respond to the ticket - however there was no ticket.

On the general DO user panel when selecting the Droplet in question it showed “We are sorry to inform you that this Droplet has been locked by DigitalOcean Staff. All of your virtual servers are still active and there have been no changes. We have opened a support ticket with you regarding the cause of this lock.” and I could not access the Droplet.

Fine, so I opened a ticket as there was none. The first reply was very generic and actually no real support except for a standard text saying I should hire someone from Cloudflare or setup up with a link to an article in order to protect myself from DDoS attacks -I assumed my server was causing an attack and not being attacked?

Support hasn’t answered since then. The email also suggested to duplicate my droplet and enable it again. However I doubt I can duplicate it with the droplet being locked?

Not sure whether I am missing something here?

Log In to Comment
3 Answers
dkanalie February 7, 2018

Thanks for the reply here as the ticket remains unanswered. I have requested access through SFTP / reboot of the droplet in order to secure a few things. Initial contact mail was more then unclear to be frank.

Reply
ryanpq MOD February 7, 2018

We’re sorry for any confusion. Since this is a public forum we are limited in what we can share here but it does appear that our team opened a ticket related to this issue on your team account.

We are also seeing the ticket you opened which is on your personal account. The reason you were not seeing the ticket is because you were not viewing the team with your droplets.

When a DDoS is detected coming from your droplet this almost always means that your droplet has been compromised (except for the users who purposely launch attacks of course). Our team’s standard operating procedure is to shut down networking on any droplet launching such an attack in order to halt the attack and prevent saturation of the network from causing issues for users whose droplets are on the same physical hypervisor.

When you reach out our team will offer to boot your droplet to a recovery environment which will allow you to log into your droplet, view and modify your files or start up an SFTP service on your droplet to transfer anything needed out to a new clean server. When creating a replacement server (we don’t recommend trying to clean a compromised server if it can be avoided) we recommend following the steps outlined here to help ensure this does not recur:

https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-16-04

The most common reason for a server to be compromised is using a less than ideal password. Instead we recommend using ssh-keys which are not vulnerable to brute force attacks in the same way a password is. If you must use a password based login we recommend installing fail2ban which can prevent brute force attacks by automatically blocking IP addresses after a set number of failed login attempts.

Initial Server Setup with Ubuntu 16.04
by Mitchell Anicas
When you start a new server, there are a few steps that you should take every time to add some basic security and give you a solid foundation. In this guide, we'll walk you through the basic steps necessary to hit the ground running with Ubuntu 16.04.
Reply
carlosmollapaza March 8, 2019

Me paso lo mismo y no puedo recuperar mi informacion, solo por eso me ire de digitalocean, en realdiad me parecia una buena opcion.

Reply
Have another answer? Share your knowledge.

Related