Dedicatserver.ro aka Astimp IT Solution SRL silently logging into the customer server

dedicatserver_ro · July 2021

the rights of one end when it violates the rights of the other

SirFoxy · July 2021

@dedicatserver_ro said:
the rights of one end when it violates the rights of the other

see in your own garden

dahartigan · July 2021

@dedicatserver_ro said:
the rights of one end when it violates the rights of the other

see in your own garden

jsg · July 2021

@SirFoxy said:
Jsg, you know I love you but the provider himself admitted he logs in to users servers in this post:

@dedicatserver_ro said:

@SirFoxy said: why would you need to login to a server to determine they're conducting a ddos attack?

to see something like that:

and to store the evidence.

But in a clever (sinister) way that left him with back doors open.

Maounique · July 2021

@SirFoxy said: Jsg, you know I love you but the provider himself admitted he logs in to users servers in this post:

Yes, but:
1. It was not in OP's server (or maybe it was, we can't know without any evidence);
2. We do not know it was unjustified.

I have been asked by people to help solve intrusion issues. If that is taking me less than half an hour or if they agree to pay, I do that for unmanaged services.
Suspension can occur and the server owner contests his server launched the attacks and we agree to look together into it and see how it has been compromised.
Without a ticket number or a name we cannot know what happened, i.e. there is no evidence, let alone conclusive evidence.

vedran · July 2021

Free speech is greatly overrated, it allows people to express their opinion no matter how stupid it is.

starbetrayer · July 2021

@dedicatserver_ro said:
the rights of one end when it violates the rights of the other

Absolutely, your rights ended before you root logined in the VPS of your clients without a warrant or authorization from your client.

alexvolk · July 2021

Some clarifications are needed otherwise looks like I don't know how to manage my servers properly.

Even though I'm not a professional sysadmin (not my job getting paid for) and doing that as a hobby to take care of my pet projects and I like learning new things.

@TheLinuxBug said: Who in this day and age that knows how to manage a server deploys it from a providers template?

I'm not sure if you've read their offer thread but:

@dedicatserver_ro said: Can´t attach CDROM or upload and install from ISOs, this is cloud like AWS is work only with Opennebula Template.

^^

@TheLinuxBug said: they have embedded a ssh key in the template

I'm always checking that, there were no SSH keys added to the template.

@TheLinuxBug said: they probably have wording in the TOS that states something along the lines of, if you leave their access and they have a reason to access the server

Not exactly sure because as far as I remember their TOS is a Romanian translation.

@TheLinuxBug said: First @alexvolk learn how to install your own server and how to review it for security -- if you don't want the host accessing the server, then remove the keys added and make sure you lock down access to ssh keys. On a KVM provider, they can't just magically enter your container

As I said I might not be perfect at doing but...

A secure log file with password login:

Jul 23 08:14:09 server sshd[17836]: Accepted password for root from 1.1.1.1 port 57861 ssh2
Jul 23 08:14:09 server sshd[17836]: pam_unix(sshd:session): session opened for user root by (uid=0)

A secure log file with SSH key login:

Jul 23 12:14:18 server sshd[53399]: Accepted publickey for root from 1.1.1.1 port 55074 ssh2: RSA SHA256:****
Jul 23 12:14:18 server systemd[53404]: pam_unix(systemd-user:session): session opened for user root by (uid=0)
Jul 23 12:14:18 server sshd[53399]: pam_unix(sshd:session): session opened for user root by (uid=0)

But this server that was accessed:

**** systemd[***]: pam_unix(systemd-user:session): session opened for user root by (uid=0)
**** login[***]: pam_unix(login:session): session opened for user root by LOGIN(uid=0)
**** login[***]: ROOT LOGIN ON tty1

Do you see the difference now?

That basically means the provider logged in without a password or SSH key. Probably some services were running inside my server as what VirtualBox/VMWare is doing "install guest tools to get complete control of the server".

@TheLinuxBug said: 2. You need to open a ticket to the provider and ask them to confirm if they have indeed entered the server -- if they say no, you should probably start reviewing to see if your server was hacked in another way before you blanket point the finger at the provider -- if they say yes, ask them to explain why they entered your server without notifying you, should they fail to be able to do that then you should both report that here and you should move on to a new provider and call it a day.

This is the first time that I caught a provider logging into my server without my permission. I don't think creating a ticket would do something and did you see their reply when asked first in the offer thread? This provider is quite small 4 people working from public info (might be wrong info, maybe more).

The person answering tickets might be the person who entered my server that's why he vaguely replies to any questions and basically tries to avoid that here.

@serv_ee said: Not to mention its shady as hell that he doesn't want FAT to show the stuff. Not even to the provider.

Have you read what I have written previously, basically the reason is not violating providers' TOS or doing shady things just would like the provider to threaten each of the customers equally, I don't need a personal favor if you understand or just use translation next time?

@TheLinuxBug said: You would have to explain to me how that works, I have not seen a system that can just give you magic console root access (unless OpenVZ / LXC).

VirtualBox/VMWare or any other virtualization does that if the disk isn't encrypted.

@jmgcaguicla said:
1. Install OS on a local VM
2. Boot literally any™ live/rescue OS
3. dd if=disk.img | ssh root@host "dd of=/dev/sda"
4. EZPZ

Very well said but you don't have a console to access the server if it will not boot so it's like installing Windows on a Kimsufi server and just wait if it will reply to pings after 15 minutes...

@jmgcaguicla said:
Why the fuck would it take you 60 minutes to do an install/configuration?

I have a scriptable build environment for my setup, but even then running the installer manually on a local VM and then dd-ing the disk image to the server shouldn't take you that long.

This provider has a mix of SSD and NVMe disk attached to the server, God knows if your scripted install will succeed even though they can't understand how to make a snapshot with their setup from their own words:

@dedicatserver_ro said: Snapshot not working yet ( because of the two different storage ) but we working on this.

However, your scripted install might succeed, just try it yourself with their server and let me know (if you wanted to show it how future-proof your installer).

alexvolk · July 2021

Regarding you @Maounique, trying to avoid you but let me remind you something:

@Maounique said: I have nothing to hide, but I have no idea why he was suspended for if he didn't give me a ticket number making it impossible to defend anything and allowing people to claim absolutely anything and not require them to give some proof is encouraging and supporting slander, because, sooner or later, someone will see this is supported and encouraged.

Nothing to hide at all, says the person who replies to tickets with the fake name "John Doe".

The issue with you is that you're ALWAYS coming to each thread and posting your "fake" experience with prometeus:

@Maounique said: We ask for the root password to make sure we have proof of the explicit permission when the customer asks us to do something

And one of the threads I caught you as well with that kind of BS, you were the one saying that at prometeus you don't suspend for free speech but failed to show any free speech sites hosted within your network because basically, you are the kind of person that writes one thing and does complete the opposite of it so I'm bit tired of writing this again.

@Maounique said: So, if we really want to fuck up businesses here, no proof required, then need to rename, lowendslander is better than lowendtalk.

You're doing this shit on your own. @Francisco and his gang took your TOP provider's BS because they're controlling the forum and banned you as well. No proof is required.

@Francisco isn't acting against free tor2web sites because you called him what? Later silently editing your messages and then saying "SHOW ME THE PROOF"?

Well done!

@Maounique said: Don't get me wrong, this particular host does look shady especially since he joined the Francisco gang in cociu's thread

And you're the one calling me @Franciso's minion because as you say I have tried to slander your BS.

Just a reminder, next time ask if I ever used Francisco services and I do plan to use them? Giving someone names without the reason you could search Wikipedia what does that mean.

Good luck and don't forget to edit your messages multiple times.

@Maounique said: Well, he is attacking many other hosts, not only me or this one, so my two hypotheses are:
1. Is shilling indirectly (and directly too) for the "top provider" which supports privacy, blablabla and is not even a customer of the hosts he spreads rumours and FUD about;
2. Has been caught redhanded and given the boot and is trying to get revenge by spreading rumours and slandering the hosts while carefully hiding his identity so they can't know what happened and nobody else knows what he is he up to: spam, ddos, warez, whatever HF support and this forum implicitly by supporting him.
For other people there is a third: he is right, especially since he is atacking me, but I know for sure he is not, so I only have 2 hypotheses to work with.

Delete all of this BS and add:

Transparency of the business, if the host trying to hide something (who is running that ship, who is the owner, do they pay taxes?) that only means something is shady about them. If I'm going to purchase at least I expect some kind of level of quality?

@SirFoxy said: me, you, and alex have all had perm bans at one point lol.

I think @Maonique doesn't remember why I left LET at that time and were banned as well?

Accusing delimiter and their gang, almost all of this forum was against me and where they now?

I was right then or I'm always right about my accusations?

a-super-random-user · July 2021

Please, TLDR?

Maounique · July 2021

@sdglhm said: Please, TLDR?

AlexVolk got the boot from a multitude of hosts when has been caught running shady shit and is trying to get them banned/slandered/spread FUD against them. While the admins allow him to attack without proof, they refused to ban this particular provider without proof so he is PMSing here threatening to quit (big surprise, he won't, because then he wont have a platform for his revenge).

NobodyInteresting · July 2021

@Maounique said:

@sdglhm said: Please, TLDR?

AlexVolk got the boot from a multitude of hosts when has been caught running shady shit and is trying to get them banned/slandered/spread FUD against them. While the admins allow him to attack without proof, they refused to ban this particular provider without proof so he is PMSing here threatening to quit (big surprise, he won't, because then he wont have a platform for his revenge).

You seem to talk about proof a lot.
Mind sharing your proof on the above? As someone who constantly moans about slander - you seem to not have any issues doing that yourself.

Maounique · July 2021

@NobodyInteresting said: As someone who constantly moans about slander - you seem to not have any issues doing that yourself.

Well, since it is allowed and encouraged here (admins asked me for proof and I have provided it in public and even jsg had to admit it is proof enough, now their main line of attack is that it happened long ago) I am free to slander and attack too, don't you think?
I did try to point to the rules only to be mocked, so I am slowly raising the pressure until they will apply the rules (against me, obviously, not the people which are allowed and encouraged to slander me for a long time).
I will never reach the level to what I have been subjected to (called a pedophile, so many names that would take a page to put up here, banned and then made up reasons for that without any proof and when I could no longer defend myself while people attacking me have always been encouraged and supported even when the rules clearly forbid that).
Would rule breaking be allowed for me too, or it is reserved for current "top providers" and their minions only?
Just curious

dedicatserver_ro · July 2021

@FAT32
please close this post, which became a "witch hunt"

yoursunny · July 2021

@alexvolk said:

@TheLinuxBug said: Who in this day and age that knows how to manage a server deploys it from a providers template?

I'm not sure if you've read their offer thread but:

@dedicatserver_ro said: Can´t attach CDROM or upload and install from ISOs, this is cloud like AWS is work only with Opennebula Template.

^^

If it's KVM and all the devices work with mainline kernel, you can certainly install from official release, even if the control panel doesn't support CD-ROM.

This one needs VNC access:
https://yoursunny.com/t/2021/SolusIO-IPv6-ISO/

If you don't have VNC, you can download ISO following the same method, then invoke unattended installation in the grub command line.
Of course that would be substantially more complicated.

FAT32 · July 2021

@dedicatserver_ro said:
FAT32
please close this post, which became a "witch hunt"

Why are you so looking forward to close this thread? My life was great until you regained your account... so many flagged posts, dramas and stuff directly or indirectly caused by you.

Also, I have seen you bumping your own threads multiple times so please stop doing that thanks.

dedicatserver_ro · July 2021

@FAT32 said: Also, I have seen you bumping your own threads multiple times so please stop doing that thanks.

i will
and the rest ?

malignify · July 2021

@dedicatserver_ro said: and the rest

What's wrong with the rest? Everyone is giving you the attention you've been looking for on your threads. You should be happy

dedicatserver_ro · July 2021

@malignify said: You should be happy

Certainly

jsg · July 2021

@malignify said:

@dedicatserver_ro said: and the rest

What's wrong with the rest? Everyone is giving you the attention you've been looking for on your threads. You should be happy

Yes, some attention too, I guess, but mainly orders - that however didn't work out so well, quite the contrary ...

dedicatserver_ro · July 2021

on the contrary, more orders are coming now but unfortunately we cancel without refund 3 out of 4 , in 2-3 days at most due to TOS violation ( most of them for torrent,chia and ddos atacks )

NobodyInteresting · July 2021

@dedicatserver_ro said:
on the contrary, more orders are coming now but unfortunately we cancel without refund 3 out of 4 , in 2-3 days at most due to TOS violation ( most of them for torrent,chia and ddos atacks )

Hm? 4 orders means business is blooming?

dedicatserver_ro · July 2021

@NobodyInteresting said: Hm? 4 orders means business is blooming?

from a single customer Alexvolk .....yes ...you could say ...is blooming..

jsg · July 2021

@dedicatserver_ro said:
on the contrary, more orders are coming now but unfortunately we cancel without refund 3 out of 4 , in 2-3 days at most due to TOS violation ( most of them for torrent,chia and ddos atacks )

I'm sorry but I don't think it makes sense for you to make assertions - virtually nobody believes you anything anymore.

Jesus · July 2021

What a shitfest of a thread. Shame on most people involved.
Will report all of you to Dad.

Deal with the consequences.

a-super-random-user · July 2021

@Maounique said: AlexVolk got the boot from a multitude of hosts when has been caught running shady shit and is trying to get them banned/slandered/spread FUD against them. While the admins allow him to attack without proof, they refused to ban this particular provider without proof so he is PMSing here threatening to quit (big surprise, he won't, because then he wont have a platform for his revenge).

I know I need the drama, I fuel from the Drama. But a man can only read so much drama per week. Thank you my good sir for the TLDR

dedicatserver_ro · July 2021

@jsg said: nobody believes you anything anymore

I understand.... ., no one believes my offer either...and that's why they put their offer in my....

NobodyInteresting · July 2021

@dedicatserver_ro said:

@jsg said: nobody believes you anything anymore

I understand.... ., no one believes my offer either...and that's why they put their offer in my....

You asked for others to post offers in your thread, stop trying to create drama out of thin air, and stick to the drama at hand.

dedicatserver_ro · July 2021

@NobodyInteresting said: and stick to the drama at hand

which was ....???

@Andreix said: @others... Let the man follow his dreams... if you do not like him and/or his company, don't buy.There are plenty of reputable companies in Romania where you can host stuff, even older than his company.Not cheap? Maybe, but secure and professional at least.

Andreix does not understand sarcasm

pedagang · July 2021

,

Howdy, Stranger!

Categories

In this Discussion

Dedicatserver.ro aka Astimp IT Solution SRL silently logging into the customer server

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Dedicatserver.ro aka Astimp IT Solution SRL silently logging into the customer server

Comments