Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Shells Virtual Desktop
BMail.ag - Secure Email Service
Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
InterServer VPS
BMail.ag - Secure Email Service
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
Residential IPs in the US & 4G Mobile Proxies in EU & US with Unlimited Bandwidth
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
Shells Virtual Desktop

Categories

In this Discussion

Home › General
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Do you trust QEMU-ga (and other things) installed on your linux VPS ?

xemapsxemaps Member
in General

The QEMU Guest Agent is a daemon intended to be run within virtual machines. It allows the hypervisor host to perform various operations in the guest, such as:

  • get information from the guest
  • set the guest’s system time
  • read/write a file
  • sync and freeze the filesystems
  • suspend the guest
  • reconfigure guest local processors
  • set user’s password
    …
Thanked by 1JohnnySac
Do You TRUST preinstalled linux version on your VPS ?
  1. Do you use your VPS as is ?84 votes
    1. I use linux VPS unmodified
      34.52%
    2. I check and delete some services/packets
      10.71%
    3. I prefer install from original source
      16.67%
    4. I install custom ISO
      38.10%
«1

Comments

  • AdvinAdvin Member, Host Rep

    A lot of hosting providers also use Cloudinit, which can do similar things.

    The best way is to install with a custom ISO and use LUKS full disk encryption. However, even then, I believe it is still possible for a malicious hosting provider to dump memory and get the encryption keys.

    Thanked by 13xemaps khalequzzaman tentor r3k nghialele let_rocks oloke taizi Decicus mustafamw3 0xC7 kurogaki laey
  • JohnnySacJohnnySac Member
    edited July 2025

    You can see what qemu-ga RPC commands the host provider is running by looking at:

    journalctl -u qemu-guest-agent.service

    I usually install from ISO which doesn't include guest agent. I have recently ran into providers that require you to run qemu-ga in the guest O/S. I haven't decided what to do in that situation. I may test my luck without it, or I may severely limit what the guest agent can do with:

    vim /etc/qemu/qemu-ga.conf

    [general]
# The allow-rpcs option was added in QEMU Guest Agent v8.1:
allow-rpcs=guest-ping,guest-shutdown

    The allow-rpcs= option blocks all RPC's except the ones you allow.

    There is also the block-rpcs= option which allows all RPC's except the ones you block like block-rpcs=guest-exec,guest-exec-status.

    I'd be interested to know if providers care or not if users don't install guest agents.

    Thanked by 12nghialele xemaps tentor tenji atomi ehab BasToTheMax yoursunny hakurin 0xC7 maverickp laey
  • e2bs2k1e2bs2k1 Member

    Without QEMU Guest Agent, the host can still probe the virtual disk when offline if the disk is not encrypted.

  • skopjeskopje Member

    i am quite new to vps services. i wasnt aware of things like qemu-ga. maybe it is time to check my servers. as far as trust goes, i dont think having qemu-ga matters. the provider virtualising your server has full control over it in the end.

  • MikeAMikeA Member, Patron Provider

    This just makes your life easier as a customer.. If you don't want it just uninstall it. Most people like the convenience. IP address change? Customer doesn't have to touch a thing qemu agent handles it.

    Even without qemu agent and encrypted you're still running memory and storage on a system that you don't physically own which is a bigger concern if the question is strict privacy.

    Thanked by 12xemaps tentor oloke khalequzzaman robachicken BasToTheMax Decicus skorous mustafamw3 quicksilver03 kurogaki laey
  • DrNutellaDrNutella Member

    Wait, it has stuff installed besides the stuff I think I installed?

  • DrNutellaDrNutella Member

    It being the VPS

  • xemapsxemaps Member 
     // write "hello world!\n" to /tmp/testqga
 {"execute":"guest-file-open", "arguments":{"path":"/tmp/testqga","mode":"w+"}}
 {"return": 0}
 {"execute":"guest-file-write", "arguments":{"handle":0,"buf-b64":"aGVsbG8gd29ybGQhCg=="}}
 {"return": {"count": 13, "eof": false}}
 {"execute":"guest-file-close", "arguments":{"handle":0}}
 {"return": {}}

 // read back the "hello world!\n" from /tmp/testqga
 {"execute":"guest-file-open", "arguments":{"path":"/tmp/testqga","mode":"r"}}
 {"return": 1}
 {"execute":"guest-file-read", "arguments":{"handle":1,"count":1024}}
 {"return": {"buf-b64": "aGVsbG8gd29ybGQhCg==", "count": 13, "eof": true}}
 {"execute":"guest-file-close","arguments":{"handle":1}}
 {"return": {}}
  • xemapsxemaps Member

    Image1
    Posted as image because i got blocked :p

  • Motion3549Motion3549 Member

    anyone have single command line to uninstall completely the qemu agent? Thank you.

  • xemapsxemaps Member

    apt-get remove qemu-ga

  • Motion3549Motion3549 Member

    @xemaps said:

    apt-get remove qemu-ga

    not working but asking 4.1 give me this apt remove qemu-guest-agent

  • cmeerwcmeerw Member

    @JohnnySac said: I have recently ran into providers that require you to run qemu-ga in the guest O/S.

    Really? That sounds a bit like providers who don't allow customers to change the root password. Name and shame them.

    Thanked by 1MannDude
  • xemapsxemaps Member

    Same story with windows VPS, and notice that ballooning cause unstability and slowing down to the host (and all its vps)...

  • MannDudeMannDude Patron Provider, Veteran

    Better than some cloud providers whose guest OS includes an ssh key from the hypervisor... Not sure OnApp still does that or not.

  • braunibrauni Member

    @MannDude said:
    Better than some cloud providers whose guest OS includes an ssh key from the hypervisor... Not sure OnApp still does that or not.

    I've seen that one before, that's one of the reasons I reinstall all my vps myself.

    Thanked by 2MannDude xemaps
  • pauljamespauljames Member

    @brauni said:

    @MannDude said:
    Better than some cloud providers whose guest OS includes an ssh key from the hypervisor... Not sure OnApp still does that or not.

    I've seen that one before, that's one of the reasons I reinstall all my vps myself.

    How do you do that if provider does not allow for custom iso?

  • Motion3549Motion3549 Member

    @pauljames said:

    @brauni said:

    @MannDude said:
    Better than some cloud providers whose guest OS includes an ssh key from the hypervisor... Not sure OnApp still does that or not.

    I've seen that one before, that's one of the reasons I reinstall all my vps myself.

    How do you do that if provider does not allow for custom iso?

    Netboot

  • braunibrauni Member

    @pauljames said:

    @brauni said:

    @MannDude said:
    Better than some cloud providers whose guest OS includes an ssh key from the hypervisor... Not sure OnApp still does that or not.

    I've seen that one before, that's one of the reasons I reinstall all my vps myself.

    How do you do that if provider does not allow for custom iso?

    There is some reinstall scripts you can use.
    https://github.com/bin456789/reinstall
    Installnet.sh

    And many others

    Might need to fork them to customize things like partitions etc.

    Thanked by 3xemaps BasToTheMax laey
  • xemapsxemaps Member

    @pauljames said:

    @brauni said:

    @MannDude said:
    Better than some cloud providers whose guest OS includes an ssh key from the hypervisor... Not sure OnApp still does that or not.

    I've seen that one before, that's one of the reasons I reinstall all my vps myself.

    How do you do that if provider does not allow for custom iso?

    Change provider ! :D

    Thanked by 3nghialele yoursunny jsg
  • BasToTheMaxBasToTheMax Member

    @brauni said:

    @pauljames said:

    @brauni said:

    @MannDude said:
    Better than some cloud providers whose guest OS includes an ssh key from the hypervisor... Not sure OnApp still does that or not.

    I've seen that one before, that's one of the reasons I reinstall all my vps myself.

    How do you do that if provider does not allow for custom iso?

    There is some reinstall scripts you can use.
    https://github.com/bin456789/reinstall
    Installnet.sh

    And many others

    Might need to fork them to customize things like partitions etc.

    I always use that to install Alpine Linux lol

    Thanked by 2xemaps brauni
  • ralfralf Member

    Every provider I've used that had it pre-installed on a template only seemed to be using it so they could include disk usage stats in their control panel. As I rarely even go to the control panel, I just disable it and don't think any more about it.

  • xemapsxemaps Member

    @ralf said:
    Every provider I've used that had it pre-installed on a template only seemed to be using it so they could include disk usage stats in their control panel. As I rarely even go to the control panel, I just disable it and don't think any more about it.

    On linux, they don't need that for VPS disk or ram usage.

  • rm_rm_ IPv6 Advocate, Veteran
    edited July 2025

    Always remove the qemu-ga backdoor, but didn't remove cloud-init. Was too lazy to switch to a static network config without it. But now that you say it is a similar backdoor, will get onto removing it as well.

    @xemaps said: Posted as image because i got blocked :p

    I got banned on Reddit for posting some copy-pasted code to answer a question, and good luck getting unbanned, still hadn't, just signed up for a new account.

    Thanked by 1xemaps
  • TimboJonesTimboJones Member

    @DrNutella said:
    Wait, it has stuff installed besides the stuff I think I installed?

    If you installed the OS, no.
    If you accepted the preinstalled template, then also no, you didn't install it.

  • DrNutellaDrNutella Member

    @TimboJones said:

    @DrNutella said:
    Wait, it has stuff installed besides the stuff I think I installed?

    If you installed the OS, no.
    If you accepted the preinstalled template, then also no, you didn't install it.

    I click button

    Thanked by 1skopje
  • RubbenRubben Member

    @Advin said:
    The best way is to install with a custom ISO and use LUKS full disk encryption. However, even then, I believe it is still possible for a malicious hosting provider to dump memory and get the encryption keys.

    But, from what I know, the provider could still make a snapshot of your running vm in its LUKS unlocked state, then mount it and use it as if it didn't have LUKS to begin with right? They don't even need to mess with memory dumps right? So then what's the point of using LUKS?

    Thanked by 1xemaps
  • AdvinAdvin Member, Host Rep

    @Rubben said:

    @Advin said:
    The best way is to install with a custom ISO and use LUKS full disk encryption. However, even then, I believe it is still possible for a malicious hosting provider to dump memory and get the encryption keys.

    But, from what I know, the provider could still make a snapshot of your running vm in its LUKS unlocked state, then mount it and use it as if it didn't have LUKS to begin with right? They don't even need to mess with memory dumps right? So then what's the point of using LUKS?

    Yes, I believe that could be another way.

    The point is that it’s just another barrier of entry from automated tools. I believe some panels (e.g., Virtualizor) use libguestfs to modify files if I remember correctly.

  • Motion3549Motion3549 Member

    @Rubben said:

    @Advin said:
    The best way is to install with a custom ISO and use LUKS full disk encryption. However, even then, I believe it is still possible for a malicious hosting provider to dump memory and get the encryption keys.

    But, from what I know, the provider could still make a snapshot of your running vm in its LUKS unlocked state, then mount it and use it as if it didn't have LUKS to begin with right? They don't even need to mess with memory dumps right? So then what's the point of using LUKS?

    To slow down the admin's curiosity.

  • RubbenRubben Member

    @Motion3549 said:

    @Rubben said:

    @Advin said:
    The best way is to install with a custom ISO and use LUKS full disk encryption. However, even then, I believe it is still possible for a malicious hosting provider to dump memory and get the encryption keys.

    But, from what I know, the provider could still make a snapshot of your running vm in its LUKS unlocked state, then mount it and use it as if it didn't have LUKS to begin with right? They don't even need to mess with memory dumps right? So then what's the point of using LUKS?

    To slow down the admin's curiosity.

    Ok, I like your signature, we love ExtraVM.

    Anyway, but that's the point, it doesn't slow down the admin's curiosity because if he creates a snapshot of your running vm in its LUKS unlocked state (and let's be real, you won't have your server turned off much) then it's as if LUKS was never used. They could inspect it without any hassle or workaround needed.

    It's all a fake sense of security, having your vm luks encrypted does not prevent or make it ANY harder for your host to snoop in your gay porn files.

Sign In or Register to comment.