Dedicatserver.ro aka Astimp IT Solution SRL silently logging into the customer server

bulbasaur

@notarobo said: now we know they also help check our VM for illegal activity. we don't need to be afraid our VM is compromised by virus.
10/10 top provider
Thanked by @dedicatserver_ro

It's official, the provider doesn't understand sarcasm.

cold

NEVER trust or do business with Romanians....for them customers are not that important as money are, they don't even give a shit about bad reputation or bad feedback...

jar

Some users here would genuinely be pleased by hosts logging into customer servers and having a glance at their data to make sure the system isn't doing something that upsets them as a third party. Not to be confused with wishing that a host would admit to only existing for said activity (like how Eonix brands exist for spam).

An automated system that uses automatically deployed keys to log in and check a system for certain conditions could be justified (technically, no comment on legality) under some circumstances, if well documented and expected by customers.

This doesn't sound like that though. Did I read right that they deleted the bash history afterward or did I misinterpret that? That'd surely be a dead giveaway to intent.

amadex1337

What are Somali Pirates in the sea, that are Romanians on the internet.

FAT32

Moral of the story:

alexvolk

@jar said: Did I read right that they deleted the bash history afterward

It was cleared indeed but they've forgotten to clear up the secure log file and last login as well.

GOBBLES

@amadex1337 said: What are Somali Pirates in the sea, that are Romanians on the internet.

Only fishes are in the sea.. not humans.. unless they are diving..

Thundas

@alexvolk said:

@jar said: Did I read right that they deleted the bash history afterward

It was cleared indeed but they've forgotten to clear up the secure log file and last login as well.

Oh god, clearing bash history is sketchy as fuck.

yoursunny

How to login to a server without leaving any trace?
Asking for a friend.

deank

Ban the host (again).

No two ways about it.

DP

@Ahfaiahkid said:

@alexvolk said:

@jar said: Did I read right that they deleted the bash history afterward

It was cleared indeed but they've forgotten to clear up the secure log file and last login as well.

Oh god, clearing bash history is sketchy as fuck.

So what do you have to say about this @dedicatserver_ro?

Is this a routine housekeeping activity you perform on all your customers' nodes to save them some kbs?

dedicatserver_ro

If only you and your employees could stop logging into my server?

Even @cociu didn't do that.

What I should call this provider @FAT32 after doing this?

**** systemd[]: pam_unix(systemd-user:session): session opened for user root by (uid=0)
**** login[]: pam_unix(login:session): session opened for user root by LOGIN(uid=0)
**** login[***]: ROOT LOGIN ON tty1

• sent this to any provider in the world, without giving further details. How many do you think will believe you?
• we can´t check if is true or a lie, if is about our VM/ server or his home personal computer.

So thank you for your understanding!

amadex1337

jar

@alexvolk said:

@jar said: Did I read right that they deleted the bash history afterward

It was cleared indeed but they've forgotten to clear up the secure log file and last login as well.

That settles it for me. Malicious intent.

pike

@dedicatserver_ro said:

• sent this to any provider in the world, without giving further details. How many do you think will believe you?
• we can´t check if is true or a lie, if is about our VM/ server or his home personal computer.

in your own words:

@dedicatserver_ro said:

@SirFoxy said: why would you need to login to a server to determine they're conducting a ddos attack?

to see something like that:

and to store the evidence.

why would you believe he lies, if accessing customer VPS is something you happen to do.

Also how frequently does this happen if you don't know which could be the customer account in question?

DP

@dedicatserver_ro said: we can´t check if is true or a lie, if is about our VM/ server or his home personal computer

@alexvolk - Drop them screenies.

brueggus

Are we bashing providers based on three lines of "evidence" and a bunch of unproven allegations now?

That's even lower than lowend.

Thundas

@dedicatserver_ro said:
If only you and your employees could stop logging into my server?

Even @cociu didn't do that.

What I should call this provider @FAT32 after doing this?

**** systemd[]: pam_unix(systemd-user:session): session opened for user root by (uid=0)
**** login[]: pam_unix(login:session): session opened for user root by LOGIN(uid=0)
**** login[***]: ROOT LOGIN ON tty1

• sent this to any provider in the world, without giving further details. How many do you think will believe you?
• we can´t check if is true or a lie, if is about our VM/ server or his home personal computer.

So thank you for your understanding!

Now you are backpedaling, you admitted in your previous posts that you do log in to customers containers to check for stuff.

jackb

@brueggus said:
Are we bashing providers based on three lines of "evidence" and a bunch of unproven allegations now?

That's even lower than lowend.

Tbf the provider admitted that they log in to look at running processes without consent.

alexvolk

@dedicatserver_ro said: sent this to any provider in the world, without giving further details. How many do you think will believe you?

Do you understand the fact that you've acknowledged logging into customer's servers without permission to keep customers within your TOS because you're "clean host only."?

The screenshot you posted isn't related to my server.

@dedicatserver_ro said: we can´t check if is true or a lie, if is about our VM/ server or his home personal computer.

I don't have access to the console, how I would be able to log in like that?

I'm still not talking about you not denying and asking for servers IP JUST to confirm that you indeed did that!

@brueggus said:
Are we bashing providers based on three lines of "evidence" and a bunch of unproven allegations now?

That's even lower than lowend.

Nope.

@thedp said:

@dedicatserver_ro said: we can´t check if is true or a lie, if is about our VM/ server or his home personal computer

@alexvolk - Drop them screenies.

Sure, here we go:

This is probably reason why I caught them ^

deank

@brueggus said:
Are we bashing providers based on three lines of "evidence" and a bunch of unproven allegations now?

Mate, did you even read the thread. The host admitted it.

DP

@alexvolk said:

Sure, here we go:

This is probably reason why I caught them ^

Perfect.

Now would it be possible for you to make it more obvious for everyone else by having it all in 1 screen, including the IP details but masking the last octet? Just to shove it in the dodgy provider's face?

Boogeyman

@FAT32 said:
I am surprised by the amount of drama every week on LET...

We need a drama order thread in case people stop producing enough drama per month/week.

dedicatserver_ro

@thedp said: Now would it be possible for you to make it more obvious for everyone else by having it all in 1 screen, including the IP details but masking the last octet? Just to shove it in the dodgy provider's face?

• can you? please , I've been waiting all day
• why you still have this unsecure service ? who the provider accessing your data-VPS without to inform you ?

alexvolk

@thedp said:
Perfect.

Now would it be possible for you to make it more obvious for everyone else by having it all in 1 screen, including the IP details but masking the last octet? Just to shove it in the dodgy provider's face?

There is no reason why I should show my IP even masking the last octet?

This isn't about me, however about the provider doing shady things.

I'm not interested in some kind of favor or compensation from a provider which I'm trying to avoid that's why masking IP.

They did what they're doing normally and I've just caught them up.

That's it.

dedicatserver_ro

ok, now for the LET members and the moderator :

• @alexvolk makes acusations without support (no proof, no ticket no PM )

brueggus

@deank said:

@brueggus said:
Are we bashing providers based on three lines of "evidence" and a bunch of unproven allegations now?

Mate, did you even read the thread. The host admitted it.

I don't see any clear statement from @dedicatserver_ro in this thread confirming that they've accessed the server in question here.

Are we talking about a virtual machine (Xen/KVM/VMware) or a container?

deank

Don't need a clear statement. He isn't denying it and pretty much says it is his way of investigating things.

dedicatserver_ro

for the good intent members:

• every ISP is monitoring the traffic and looks at what happens in that traffic, if not the seller at the first hop then the provider in the next hop
• a conscious provider is not risking to blacklist his IPs and network
• last year in europe were taken to court a provider (bulletproof cyberbunker in germany) , so whoever thinks he's doing something unnoticed in Europe has no idea how providers work

alexvolk

@brueggus said:
I don't see any clear statement from @dedicatserver_ro in this thread confirming that they've accessed the server in question here.

Are we talking about a virtual machine (Xen/KVM/VMware) or a container?

Here, should be enough:

@dedicatserver_ro said: we have a multitude of customers although in our offer we explicitly state that we do not accept the TOS violation they do it believing that there are no consequences, have you tried, you have been caught and are you crying now ?

^^

@dedicatserver_ro said: To be clear, we monitoring what traffic / type of traffic is done on each IP/Port. If something suspicious appears, we take packet captures and ask the clients what they do and if they respect TOS. Depending on their answer, we act accordingly. If he respects TOS

^^

@dedicatserver_ro said:

@SirFoxy said: why would you need to login to a server to determine they're conducting a ddos attack?

to see something like that:

and to store the evidence.

^^

@dedicatserver_ro said: I said above we monitoring all IPs and all Ports
Clean hosting and you don't have to worry

^^