Hostsailor experience - wants my root password

x0x0x · January 1

@ralf said:

@bugabuga said:
that udeek fellow reinstalled my vps, deleted everything without even asking if i wanted to lnstall Debian 13..
Was only requesting for them to add a Debian 13 iso since the newest version they had was Debian 10 which also does not work. really frustrating.

In their defence, what's the point in asking about a Debian 13 iso if you didn't intend to install it?

In the customer's defense, they'd like it to be available for installation at their convenience, whenever they're ready to do so

zed · January 1

@xvps said:
So HostSailor reset the password and logged in to OP’s server without permission …

They apologized for the password reset …

And then finished off with this:

HostSailor has been operating for over a decade, and situations like this can happen sometimes.

And everyone is happy.

I think it's more that we're aware of the realities of moving in this space. Surely we've all dealt with this flavor of support, it happens man.

I'd be fucking livid if it happened to me but what do we expect HostSailor to do beyond apologizing and taking steps and offering the customer a token?

Astro · January 1

@anubhavhirani said:
Update:

As per support I will be upgraded to the following specs as compensation:

4 cores (AMD EPYC 9534 64-Core Processor)
4GB RAM
100GB NVMe
$16.18 per year.

Original specs:

2 cores (AMD EPYC 9534 64-Core Processor)
2GB RAM
50GB NVMe
$16.18 per year.

It will take few hours to upgrade (not sure why) as per support.

Maybe I should have waited too lol

bugabuga · January 1

@ralf said:

@bugabuga said:
that udeek fellow reinstalled my vps, deleted everything without even asking if i wanted to lnstall Debian 13..
Was only requesting for them to add a Debian 13 iso since the newest version they had was Debian 10 which also does not work. really frustrating.

In their defence, what's the point in asking about a Debian 13 iso if you didn't intend to install it?

Be nice to have a working iso, So I don't need to go into rescue mode setup swap install qemu then use vnc to install debian where randomly the install would get killed and require multiple attempts with mundanely inputting the same info over and over and hope this time it will finish! And when u did complete some dude udeek deleted ur vps so u have to do it over again!

anubhavhirani · January 1

@Astro said:

@anubhavhirani said:
Update:

As per support I will be upgraded to the following specs as compensation:

4 cores (AMD EPYC 9534 64-Core Processor)
4GB RAM
100GB NVMe
$16.18 per year.

Original specs:

2 cores (AMD EPYC 9534 64-Core Processor)
2GB RAM
50GB NVMe
$16.18 per year.

It will take few hours to upgrade (not sure why) as per support.

Maybe I should have waited too lol

Basic System Information:
---------------------------------
Uptime     : 0 days, 0 hours, 2 minutes
Processor  : AMD EPYC 9534 64-Core Processor
CPU cores  : 4 @ 2446.326 MHz
AES-NI     : ✔ Enabled
VM-x/AMD-V : ✔ Enabled
RAM        : 3.8 GiB
Swap       : 4.0 GiB
Disk       : 94.4 GiB
Distro     : Ubuntu 24.04.3 LTS
Kernel     : 6.8.0-90-generic
VM Type    : KVM
IPv4/IPv6  : ✔ Online / :x: Offline

IPv4 Network Information:
---------------------------------
ISP        : HostSailor
ASN        : AS60117 Host Sailor Ltd
Host       : NForce Entertainment B.V
Location   : Amsterdam, North Holland (NH)
Country    : The Netherlands

fio Disk Speed Tests (Mixed R/W 50/50) (Partition /dev/vda2):
---------------------------------
Block Size | 4k            (IOPS) | 64k           (IOPS)
  ------   | ---            ----  | ----           ----
Read       | 264.10 MB/s  (66.0k) | 461.73 MB/s   (7.2k)
Write      | 264.80 MB/s  (66.2k) | 464.16 MB/s   (7.2k)
Total      | 528.91 MB/s (132.2k) | 925.89 MB/s  (14.4k)
           |                      |
Block Size | 512k          (IOPS) | 1m            (IOPS)
  ------   | ---            ----  | ----           ----
Read       | 593.17 MB/s   (1.1k) | 810.53 MB/s    (791)
Write      | 624.68 MB/s   (1.2k) | 864.51 MB/s    (844)
Total      | 1.21 GB/s     (2.3k) | 1.67 GB/s     (1.6k)

Geekbench 6 Benchmark Test:
---------------------------------
Test            | Value
                |
Single Core     | 1794
Multi Core      | 5402
Full Test       | https://browser.geekbench.com/v6/cpu/15877131

YABS completed in 6 min 37 sec

Can't complain anymore.

Astro · January 1

@anubhavhirani said:

@Astro said:

@anubhavhirani said:
Update:

As per support I will be upgraded to the following specs as compensation:

4 cores (AMD EPYC 9534 64-Core Processor)
4GB RAM
100GB NVMe
$16.18 per year.

Original specs:

2 cores (AMD EPYC 9534 64-Core Processor)
2GB RAM
50GB NVMe
$16.18 per year.

It will take few hours to upgrade (not sure why) as per support.

Maybe I should have waited too lol

Basic System Information:
---------------------------------
Uptime     : 0 days, 0 hours, 2 minutes
Processor  : AMD EPYC 9534 64-Core Processor
CPU cores  : 4 @ 2446.326 MHz
AES-NI     : ✔ Enabled
VM-x/AMD-V : ✔ Enabled
RAM        : 3.8 GiB
Swap       : 4.0 GiB
Disk       : 94.4 GiB
Distro     : Ubuntu 24.04.3 LTS
Kernel     : 6.8.0-90-generic
VM Type    : KVM
IPv4/IPv6  : ✔ Online / :x: Offline

IPv4 Network Information:
---------------------------------
ISP        : HostSailor
ASN        : AS60117 Host Sailor Ltd
Host       : NForce Entertainment B.V
Location   : Amsterdam, North Holland (NH)
Country    : The Netherlands

fio Disk Speed Tests (Mixed R/W 50/50) (Partition /dev/vda2):
---------------------------------
Block Size | 4k            (IOPS) | 64k           (IOPS)
  ------   | ---            ----  | ----           ----
Read       | 264.10 MB/s  (66.0k) | 461.73 MB/s   (7.2k)
Write      | 264.80 MB/s  (66.2k) | 464.16 MB/s   (7.2k)
Total      | 528.91 MB/s (132.2k) | 925.89 MB/s  (14.4k)
           |                      |
Block Size | 512k          (IOPS) | 1m            (IOPS)
  ------   | ---            ----  | ----           ----
Read       | 593.17 MB/s   (1.1k) | 810.53 MB/s    (791)
Write      | 624.68 MB/s   (1.2k) | 864.51 MB/s    (844)
Total      | 1.21 GB/s     (2.3k) | 1.67 GB/s     (1.6k)

Geekbench 6 Benchmark Test:
---------------------------------
Test            | Value
                |
Single Core     | 1794
Multi Core      | 5402
Full Test       | https://browser.geekbench.com/v6/cpu/15877131

YABS completed in 6 min 37 sec

Can't complain anymore.

Enjoy!

emperor · January 1

@anubhavhirani said: Can't complain anymore

Yea who would.. nice trap

anubhavhirani · January 1

@emperor said:

@anubhavhirani said: Can't complain anymore

Yea who would.. nice trap

trap

matey0 · January 1

@xvps said:

@dbadude said:

@anubhavhirani said:

@dbadude said:
anyway nice gesture to say that they reset the root password.
Often this is even not mentioned by yolo support, resulting in another incident for a lost root pasword reset.

First thing I did after getting informed is reset the machine to random OS in order to erase data.

to think that your cloud provider has no access over your data is wrong. even when the drives are encrypted. yes even when you encrypt the partitions.

Claiming that the provider has access to an encrypted VPS is incorrect. While it could theoretically be hacked (though this is close to impossible in real life), that is not the same as the provider having direct access.

What you could check instead is whether the provider has installed qemu-guest-agent with guest-exec enabled without your permission.

Very elite impossible h4x0ring:

virsh dump <guest_name> memory_dump.bin --memory-only
aeskeyfind memory_dump.bin

xvps · January 1

@matey0 said:

@xvps said:

@dbadude said:

@anubhavhirani said:

@dbadude said:
anyway nice gesture to say that they reset the root password.
Often this is even not mentioned by yolo support, resulting in another incident for a lost root pasword reset.

First thing I did after getting informed is reset the machine to random OS in order to erase data.

to think that your cloud provider has no access over your data is wrong. even when the drives are encrypted. yes even when you encrypt the partitions.

Claiming that the provider has access to an encrypted VPS is incorrect. While it could theoretically be hacked (though this is close to impossible in real life), that is not the same as the provider having direct access.

What you could check instead is whether the provider has installed qemu-guest-agent with guest-exec enabled without your permission.

Very elite impossible h4x0ring:
virsh dump <guest_name> memory_dump.bin --memory-only
aeskeyfind memory_dump.bin

Good luck with that on newer systems using AMD SEV or Intel TDX, where memory encryption blocks this entirely.

And if dm-crypt is enabled, along with the kernel keyring (keyctl), fscrypt, file-based encryption (eCryptfs), and probably several other defensive measures, your very elite h4x0ring won’t work.

matey0 · January 1

@xvps said:
@matey0 said:

@xvps said:

@dbadude said:

@anubhavhirani said:

@dbadude said:
anyway nice gesture to say that they reset the root password.
Often this is even not mentioned by yolo support, resulting in another incident for a lost root pasword reset.

First thing I did after getting informed is reset the machine to random OS in order to erase data.

to think that your cloud provider has no access over your data is wrong. even when the drives are encrypted. yes even when you encrypt the partitions.

Claiming that the provider has access to an encrypted VPS is incorrect. While it could theoretically be hacked (though this is close to impossible in real life), that is not the same as the provider having direct access.

What you could check instead is whether the provider has installed qemu-guest-agent with guest-exec enabled without your permission.

Very elite impossible h4x0ring:
virsh dump <guest_name> memory_dump.bin --memory-only
aeskeyfind memory_dump.bin
Good luck with that on newer systems using AMD SEV or Intel TDX, where memory encryption blocks this entirely.

And if dm-crypt is enabled, along with the kernel keyring (keyctl), fscrypt, file-based encryption (eCryptfs), and probably several other defensive measures, your very elite h4x0ring won’t work.

No regular VPS uses SEV or TDX.
Your second paragraph is nonsensical. None of the technologies mentioned help a single bit against host system memory access.

Even if you had fancy hardware features like SEV or TDX, on a hostile host system you would additionally require remote attestation on boot.

All in all it's clear you have no idea what you're talking about, considering you consider it "impossible in real life", when 99.99% of VPS in the wild have no chance against an attack from the host system.

KeqingWangy · January 1

Swathi Krishna be like:

ralf · January 1

@bugabuga said:

@ralf said:

@bugabuga said:
that udeek fellow reinstalled my vps, deleted everything without even asking if i wanted to lnstall Debian 13..
Was only requesting for them to add a Debian 13 iso since the newest version they had was Debian 10 which also does not work. really frustrating.

In their defence, what's the point in asking about a Debian 13 iso if you didn't intend to install it?

Be nice to have a working iso, So I don't need to go into rescue mode setup swap install qemu then use vnc to install debian where randomly the install would get killed and require multiple attempts with mundanely inputting the same info over and over and hope this time it will finish! And when u did complete some dude udeek deleted ur vps so u have to do it over again!

Sounds easier just to apt-get dist-upgrade

bugabuga · January 1

@anubhavhirani said

Can't complain anymore.

@ralf said:

@bugabuga said:

@ralf said:

@bugabuga said:
that udeek fellow reinstalled my vps, deleted everything without even asking if i wanted to lnstall Debian 13..
Was only requesting for them to add a Debian 13 iso since the newest version they had was Debian 10 which also does not work. really frustrating.

In their defence, what's the point in asking about a Debian 13 iso if you didn't intend to install it?

Be nice to have a working iso, So I don't need to go into rescue mode setup swap install qemu then use vnc to install debian where randomly the install would get killed and require multiple attempts with mundanely inputting the same info over and over and hope this time it will finish! And when u did complete some dude udeek deleted ur vps so u have to do it over again!

Sounds easier just to apt-get dist-upgrade

Think the default image is ext4 or xfs I wanted btrfs.. none of the debian iso's work, The VPS I have in LA at least the Debian 10 does work.

Either way.. it's a real DEEK move to delete someone's VPS without the courtesy of asking 1st if they wanted to proceed with a reinstall.
It's bizarre really, never in all the years have a host just reinstalled my VPS. lol

sanchogodinho · January 1

@ralf said:

@dbadude said:

@anubhavhirani said:

@dbadude said:
anyway nice gesture to say that they reset the root password.
Often this is even not mentioned by yolo support, resulting in another incident for a lost root pasword reset.

First thing I did after getting informed is reset the machine to random OS in order to erase data.

to think that your cloud provider has no access over your data is wrong. even when the drives are encrypted. yes even when you encrypt the partitions.

THIS

They don't actually need your root password for anything.

Chances are you have qemu-ga installed anyway, so they can just shell into your VPS whatever.

If you have disabled that, they can just access files directly in the disk image if they really wanted to.

If you encrypted your disk, they can still access the memory of your VPS from the host. If you have any keys or secrets sitting in plaintext in memory, then they could access it all if they really cared to.

Of course, the truth is that none of this ever happens. Nobody cares about you and your data. Unless they are charity host and they want to see what porn you have.

Considering they're GDPR compliant, legally, they shouldn't be able to do it. If someone catches them doing such things, it can lead to huge legal trouble. They are supposed to notify the VPS owner about any such access.

Please correct me if I'm wrong.

stxsh · January 1

@sanchogodinho said:

@ralf said:

@dbadude said:

@anubhavhirani said:

@dbadude said:
anyway nice gesture to say that they reset the root password.
Often this is even not mentioned by yolo support, resulting in another incident for a lost root pasword reset.

First thing I did after getting informed is reset the machine to random OS in order to erase data.

to think that your cloud provider has no access over your data is wrong. even when the drives are encrypted. yes even when you encrypt the partitions.

THIS

They don't actually need your root password for anything.

Chances are you have qemu-ga installed anyway, so they can just shell into your VPS whatever.

If you have disabled that, they can just access files directly in the disk image if they really wanted to.

If you encrypted your disk, they can still access the memory of your VPS from the host. If you have any keys or secrets sitting in plaintext in memory, then they could access it all if they really cared to.

Of course, the truth is that none of this ever happens. Nobody cares about you and your data. Unless they are charity host and they want to see what porn you have.

Considering they're GDPR compliant, legally, they shouldn't be able to do it. If someone catches them doing such things, it can lead to huge legal trouble. They are supposed to notify the VPS owner about any such access.

Please correct me if I'm wrong.

Correct, invasion of privacy is generally not the best course of action to take for anyone doing business, let alone an ethical one, add to that, it's illegal in most countries.

That being said, this seems like an honest mistake/act of impulse (as far as the reinstall, I can see the misunderstanding there). Being swamped with tickets myself, not necessarily support -- I've "assumed" things to move my tasks along, and regretted it afterwards. It happens.

stxsh · January 1

Side rant: Considering there were only a handful of providers that continued past Black Friday and participated in the Christmas / NYE thread -- even throwing in some limited flash sales as well, it's unfortunate to see so many folks try to insist they get more out of it/them. This is the kind of thing that deters providers from participating in the first place.

HostSailor was already getting harassed by folks that wanted the 90% deal from last year. They came pretty damn close to providing the same. Just saying, good on everyone that got what they wanted but this is second thread in 24 hours where I see a member try to get the upper hand with them on deals in "behalf of the community". It's esp off putting to see someone with a day old account start making these demands. Let's try to keep things sustainable so we keep seeing these deals and everyone wins.

Thanks @HostSailor for the deals. Appreciate the support / accommodating to requests too. Loving the service so far. Prem! Commodore deal is a mini-dedi (and a beast of one at the price).

ralf · January 1

@sanchogodinho said:

@ralf said:

@dbadude said:

@anubhavhirani said:

@dbadude said:
anyway nice gesture to say that they reset the root password.
Often this is even not mentioned by yolo support, resulting in another incident for a lost root pasword reset.

First thing I did after getting informed is reset the machine to random OS in order to erase data.

to think that your cloud provider has no access over your data is wrong. even when the drives are encrypted. yes even when you encrypt the partitions.

THIS

They don't actually need your root password for anything.

Chances are you have qemu-ga installed anyway, so they can just shell into your VPS whatever.

If you have disabled that, they can just access files directly in the disk image if they really wanted to.

If you encrypted your disk, they can still access the memory of your VPS from the host. If you have any keys or secrets sitting in plaintext in memory, then they could access it all if they really cared to.

Of course, the truth is that none of this ever happens. Nobody cares about you and your data. Unless they are charity host and they want to see what porn you have.

Considering they're GDPR compliant, legally, they shouldn't be able to do it. If someone catches them doing such things, it can lead to huge legal trouble. They are supposed to notify the VPS owner about any such access.

Please correct me if I'm wrong.

Sure, legally they shouldn't access your data. And pretty much every provider wouldn't want to access your data without your permission. That's exactly why they asked for the root password to begin with - although in this case the problem wasn't the asking, it was that they didn't actually need access at all.

My point was that complaining about it being a security risk is daft. If you're worried about your data being accessed and you don't trust your provider, then you're already screwed. If they wanted to, they could access it. Of course, that's illegal, but that's kind of irrelevant. Withholding your root password doesn't make your data any safer. The thing that's keeping your data safe is that your provider is a good guy.

dbadude · January 1

@ralf said:

@sanchogodinho said:

@ralf said:

@dbadude said:

@anubhavhirani said:

@dbadude said:
anyway nice gesture to say that they reset the root password.
Often this is even not mentioned by yolo support, resulting in another incident for a lost root pasword reset.

First thing I did after getting informed is reset the machine to random OS in order to erase data.

to think that your cloud provider has no access over your data is wrong. even when the drives are encrypted. yes even when you encrypt the partitions.

THIS

They don't actually need your root password for anything.

Chances are you have qemu-ga installed anyway, so they can just shell into your VPS whatever.

If you have disabled that, they can just access files directly in the disk image if they really wanted to.

If you encrypted your disk, they can still access the memory of your VPS from the host. If you have any keys or secrets sitting in plaintext in memory, then they could access it all if they really cared to.

Of course, the truth is that none of this ever happens. Nobody cares about you and your data. Unless they are charity host and they want to see what porn you have.

Considering they're GDPR compliant, legally, they shouldn't be able to do it. If someone catches them doing such things, it can lead to huge legal trouble. They are supposed to notify the VPS owner about any such access.

Please correct me if I'm wrong.

Sure, legally they shouldn't access your data. And pretty much every provider wouldn't want to access your data without your permission. That's exactly why they asked for the root password to begin with - although in this case the problem wasn't the asking, it was that they didn't actually need access at all.

My point was that complaining about it being a security risk is daft. If you're worried about your data being accessed and you don't trust your provider, then you're already screwed. If they wanted to, they could access it. Of course, that's illegal, but that's kind of irrelevant. Withholding your root password doesn't make your data any safer. The thing that's keeping your data safe is that your provider is a good guy.

Somewhere in time the good guy can turn to the dark side. Use the force luke.

anubhavhirani · January 1

Please close this thread @angstrom

Howdy, Stranger!

Categories

In this Discussion

Hostsailor experience - wants my root password

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Hostsailor experience - wants my root password

Comments