New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
Ad hominem.
7+ years, above statute of limitations in many countries for many crimes.
NO. You clearly don't. There was no point to your passive aggressive "top provider" competition BS. You're starting shit, not responding to shit, contrary to your belief.
tough shit for that company.. sorry but I have zero empathy here
Boy I am right there with you.
Let's be clear here, without user permission or notification.
So where is the proof?
I would discuss it with @FAT32
See above
10 pages of this and I still only have one real question after all of this. Who in this day and age that knows how to manage a server deploys it from a providers template? In my opinion if you are going to use a providers template, you should assume they have embedded a ssh key in the template -- a lot of providers do this to help facilitate management for their less savvy customers. If the server being noted isn't a OpenVZ container, you didn't take the time to install it your self from ISO and you didn't remove extraneous ssh keys from authorized_keys on your server then you as the customer also bare some of the fault here. If you don't want them having access then you shouldn't leave their key in your system. If this is a KVM or dedicated server and you install it and secure it your self, there should be no way for them to access your server. The onus to review access to your server is on you.
If you left their access there, I would assume like any provider who does this, they probably have wording in the TOS that states something along the lines of, if you leave their access and they have a reason to access the server, that you by default allow them to access it. I am not saying I have read this providers TOS but I have seen some hosts whom note it that way.
While the provider shouldn't be accessing any customers servers without notification, as doing so is in generally just bad ethics, it likely isn't against their TOS to do so if they suspect the customer of causing issues which impact the whole node or other customers.
I am not on anyone's side here in particular but I personally think both sides have handled this poorly.
First @alexvolk learn how to install your own server and how to review it for security -- if you don't want the host accessing the server, then remove the keys added and make sure you lock down access to ssh keys. On a KVM provider they can't just magically enter your container -- if this is OpenVZ this is all moot as the provider can see processes being run on the host node and doesn't require to enter your server to see your data or you processes.
The provider @dedicatserver_ro should step up and calmly explain their TOS and what allowances it makes for granting them access to the server. They should also openly disclose to the customer when they do enter the server, so if they did that they should also step up and be honest about the issue. If they didn't, then they need to explain this to the customer because maybe their server was back doored or hacked and someone has indeed gained illegitimate access to the server unknown to the customer. Without the provider confirming their actions, how will the customer be able to know for sure?
@alexvolk if this is really as important to you as you are making out in this thread, there are two things you should do:
1. Learn how to load your own server and how to review the keys placed on templates if you don't intend to do your own secure installation
2. You need to open a ticket to the provider and ask them to confirm if they have indeed entered the server -- if they say no, you should probably start reviewing to see if your server was hacked in another way before you blanket point the finger at the provider -- if they say yes, ask them to explain why they entered your server without notifying you, should they fail to be able to do that then you should both report that here and you should move on to a new provider and call it a day.
my 2 cents.
Cheers!
TLB is competing with @jsg
I already posted a slightly more succinct version of your first paragraph a while back. (Lost in the dross.)
@jbiloh @raindog308 @FAT32
There are multiple elements pointing at @dedicatserver_ro having accessed @alexvolk's system. But there seems to be no clear proof; some major elements can be, and are, interpreted differently.
As for dedicatserver_ro's demand "alexvolk must provide info to me (e.g. IP)" that's a double edged knife and not necessarily an adequate demand.
I very much dislike even the likelihood of dedicatserver_ro snooping in customer systems (without sound and lawful need) and I strongly tend to believe that he did snoop in alexvolk's system - but there seems to be no hard proof, modulo evidence which may or may not have been provided by either or both sides to the admins, ergo banning dedicatserver_ro or stripping his provider tag seems to not be properly justified.
However there is also the fact that dedicatserver_ro loves to paint himself as a grey zone player, a bit along the line of "if you don't act within our TOS and AUP we will get you. We have our ways to find out ...", plus he consistently tries to stay vague and to avoid clear cut answers. IMO dedicatserver_ro should get a public warning.
@all
While there seems to be no clear proof against dedicatserver_ro, he should be considered shady, not trustworthy, and highly likely snooping/not respecting your rights. So do not buy from dedicatserver_ro unless and until he changes for the better.
@cociu
Don't you have enough problems already? Of all people here you are the one who should know that one doesn't take a dump in another providers thread! (Certainly not only) I expect you to spend all your time and attention on getting our systems working again!
Sir, are you new here?
The whole community acts as detectives & judges. The moderators/staff are just the executioners.
The mob is always powerful!
Unfortunately, there will probably be no end to this, at least not one which will result in a tag revocation and/or ban.
There's clear proof but it's just not enough to put the icing on the cake.
This is what it looks like at the moment at least.
@TheLinuxBug -First on all , Thanks!
So have i or my staff accessed the VM ? - have no idea , we don't even know who the client is or which VM ... what IP
@dedicatserver_ro spends too much time seeing/prying/snooping in other peoples gardens.
Full disclosure: I got a PM from @dedicatserver_ro with some references to some law in regards to the collection of personal data.
He also made some comments in that PM that makes me convinced that the issue lies with the fact that he believes he is fulfilling his obligation to these laws by "breaking in" without a warrant or without explicit permission (ie in the case of a managed service).
I'm really not sure why I got that PM, but I did...
Post screenshot
Law no. 235/2015 for the amendment and completion of Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector was published in the Official Gazette, Part I, no. 767 of 14 October
Mainly, the document provides a maximum duration for keeping the traffic data of the subscribers and users of telephony and internet services - data that are currently processed and stored by the operators in order to be able to issue invoices and to ensure the respective services. In addition, some provisions are introduced according to which the access to the traffic data will be made only on the basis of a court authorization.
Specifically, the new law stipulates that traffic data of subscribers and users, which are processed and stored by telephone and internet operators, will be deleted or anonymized when they will no longer be required to transmit communications, but no longer no later than three years after the communication.
Also, the term of maximum three years from the communication will be valid for the processed traffic data in order to establish the contractual obligations of the subscribers to the communications services whose payment is made in advance......
................ this law is long ...with many responsibilities for ISPs
We are member in ANCOM https://www.ancom.ro/en/ so we must comply with this law
ANCOM = National Authority for Management and Regulation in Communications
Each big ISP ( Voxility, M247, INES, GTS.... ) are member of ANCOM
, if someone thinks they are not following the law they are wrong.
=============================================
This is the "Big Brother" law from Romania.So if one provider from Romania and Moldova ( with romanian internet conections ) tell you they don´t monitoring the trafic from your servers..VM...can be but the Ancom member ISP doo this for him.
You are trying to move the attention to another subject "THE LAW" and you didn't answer to a simple question with YES or NO - this law does not tell that you are allowed to access your customer server/VPS/data when do you want and this law is about the TRAFFIC DATA which can be collected/stored in many other ways, not by accessing customer's server.
You should rethink your module if it requires root to operate. It is insanely dangerous. Just sudo that mofo.
I suggest you to ignore this thread and continue with your daily operation, LET lawyers will always win, no matter the case. Don't waste your time and energy.
Be more like Borta, he doesn't give a fuck or two about anything. Easy life.
it is one API base module and from some operation you need a kind of autorization - for example create user with his lover access rules
sorry but I cannot believe this. can @Andreix debunk this myth.
He likes your garden.
Well, it is true, up to an extent...
Generally on a KVM server, even if you open the console, you'd be asked to input user/pass in order to login.
However, if that console type is not VNC, but SSH and they have stored the SSH key in the platform shomehow, then when accessing the console a SSH auto-login session will start and you'd be shown the command prompt of the user's terminal.
The same way proxmox access host/node's Shell from within the web gui.
One of the reasons why one should install the OS oneself from a reliable distro source.
I hope @alexvolk was smart and mistrusting enough to at least pull a dump of the whole system. Usually there are some traces which professionals can find.
That was the PM I got
But why you? Did he mix you up with OP?
The irony is that the quoted law is more about data retention.
Traffic data does not implicitly mean data content; source, destination, packet type (DNS,ping,SMTP etc.) and quantity, is an example of traffic data.
[Edited for formatting.]