By embedonix
I created a droplet (OpenVPN 2.8.5 from the marketplace) and after just 2 days I received a message from DigitalOcean that my droplet has been under Bruteforce attack. Surely enough the root password was changed and I had to reset it from the control panel to be able to log in again. After logging in again I see there are suspicious network activity going on to some IP addresses from Japan and other countries. I could not trace down the process ID of these network activities… they all show up as ? in the NetHogs output.
What can/should I do? and if I delete this droplet and create a new one hot to prevent the same scenario from happening again?
NetHogs version 0.8.5-2
PID USER PROGRAM DEV SENT RECEIVED 2100 root sshd: root@pts/1 eth0 0.627 0.087 KB/sec ? root 206.189.60.55:1433-165.3.89.71:50204 0.011 0.022 KB/sec ? root 206.189.60.55:3389-203.137.122.16:54203 0.011 0.022 KB/sec ? root 206.189.60.55:9201-165.227.10.12:42091 0.011 0.011 KB/sec ? root 206.189.60.55:445-144.22.108.247:62540 0.000 0.000 KB/sec ? root 206.189.60.55:13197-202.152.1.89:42052 0.000 0.000 KB/sec ? root 206.189.60.55:23-201.94.227.212:44234 0.000 0.000 KB/sec ? root 206.189.60.55:15448-195.54.161.151:44988 0.000 0.000 KB/sec
? root unknown TCP 0.000 0.000 KB/sec
TOTAL 0.659 0.143 KB/sec
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Hi there @embedonix,
Yes indeed, if your root account was compromised I believe that it is best to either restore to a backup or spin up a new Droplet because there might be some backdoors inserted by the attackers which could be hard to find.
Once you have a clean Droplet I could suggest a few things:
- Make sure that you have a firewall like CSF for example which would block IP addresses in case of a brute-force attack
- Do not use SSH passwords but use SSH key authentication instead.
- Follow the steps from here on how to harden your OpenSSH service:
https://www.digitalocean.com/community/tutorials/how-to-harden-openssh-on-ubuntu-18-04
Hope that this helps! Regards, Bobby
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.