New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
@luckypenguin @forest Can you please share basic steps about securing linux VPS.
It does imply that you are afraid of something. Resellers wants “normal” customers to shift liability if something happens.
Up to reseller to guarantee that resold services won’t be used for abuse.
P.s. there is no provider which bans encryption and qemu removal. So all of this is just hypothetical.
When it comes to trust, the reality is that trusting absolutely no one is the only way to eliminate trust-related risk completely.
Even a company as large as Leaseweb, OVH, AWS, or any other major provider still has employees with different levels of access. If someone is storing extremely sensitive information inside a VPS, such as cryptocurrency private keys, there is always some degree of human risk. One dishonest employee, compromised account, or internal security failure can potentially create a serious problem.
We have already seen many security incidents over the years where insider access, employee mistakes, stolen credentials, or abuse of privileged access contributed to a breach.
This is also one of the reasons governments and organizations care so much about data sovereignty and data residency. Many countries require certain categories of data to remain within their own jurisdiction because they want greater control over which laws, governments, companies, and personnel may potentially have access to that data. It is not simply about whether the foreign company is large or reputable.
Yes, that's why I don't have doors. I could hide a crack lab in my apartment
@JustLookingAround
1) Many providers offer custom ISO right from the panel, if not, they can mount it thru a support ticket, however this is less recommended. If they don't have this from the panel, you can still use netboot.xyz (iPXE mode) on most hypervisors.
Hit ESC during boot, choose iPXE, then follow these steps:
https://netboot.xyz/docs/quick-start/
2) Yes, whole disk encryption. Depends on the OS, modern Linux/BSD semi-automate this
process - you only need to configure it during initial OS setup, the bootloader will prompt
you for password itself - unless you want to take it one step further and unlock remotely,
without ever needing to VNC, refer to this:
https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux/
3) VNC only asks for client/server auth password, it has nothing to do with your tty and has no knowledge about what state the current terminal is in. So when you do something,
make sure to type "logout" or "exit" - you should see the login prompt, not your shell.
You can then disconnect from VNC knowing that whoever connects will meet the login prompt, not your actual logged in shell. For Windows, you simply log off the user via GUI.
A provider template is what the provider gives you to "auto-install". Outdated in most cases, and does not offer disk encryption since it's a ready to go template.
Yes, we have all the features you guys see in the panel, plus some extra features like the Security Firewall tab, which is not available through the API yet, and upgrade options.
@Levi have provided already screenshots of panel, you can see
But since we are the owner of that VPS, we can ask Leaseweb to do certain things with it. Resetting the password is already available in the panel, but we may also be able to ask for more, like restoring the last backup Leaseweb created or something similar.
I have never asked them for this before, so I can’t confirm exactly what they can or cannot do
Exactly. Buying a VPS at low-end prices and expecting defense-level security will never go together. It really depends on how much security your data actually requires.
Most hosting providers use WHMCS, and these days critical security updates seem to be coming out like tea and coffee. But that does not necessarily mean other panels are more secure. WHMCS is one of the most widely used billing panels, so naturally it gets more attention from attackers and security researchers. Other panels may also have vulnerabilities, but they may simply not be targeted as heavily.
And it’s not just WHMCS. We’ve also seen vulnerabilities reported in cPanel, Plesk, Virtualizor, KVM, and many other platforms.
Yes, a lot also depends on how you secure the VPS yourself. If you know what you’re doing, there are several measures you can apply to make it significantly harder for anyone to access your data.
This is why you follow the steps @forest and I mentioned earlier.
A compromised panel, or a dishonest employee should not be able to access your data,
even if it's a VPS. Or at least you should make it as technically hard as possible, which
will require dumping memory as root on the hypervisor, looking for the encryption key,
messing with the qcow2 image to unlock it, etc.
As we seen, most opportunistic compromises are just ransomware attacks, in which case
they go for low hanging fruits - you don't need to make it 100% proof, you just need to
make it reasonably hard enough to make the effort. Same goes with any physical lock.
No there is no risk at all,
The middleman doesn't own 5 VPs, so LSW sees his 3 VPs got multiple complaints, meaning they will suspend all vps.
The middleman has already done all the KYC requirements, and has alot of service with them which has no complain at all, so they know the reseller is legit, and they only suspend exactly that VPS for which the complaint came.
Leaseweb sends us the abuse email.
If we dont reply in time, they null-route the IP.
But we always act within time; we suspend vps or send forward abuse complain, depending on the complain type.
quoted for future referral.
And what if lw will make reseller “the source of repeated infringement”?
Which provider is this? Could you please share the provider’s name? @Levi
Well, it ultimately depends on how the provider handles abuse and illegal activity on its services.
For example, if a provider repeatedly ignores DMCA or abuse complaints, knowingly sells services specifically for illegal activities, or takes no action against repeat offenders, then yes, the provider itself can eventually get into trouble.
If a provider has 100 VPSs and more than 50 of them are repeatedly receiving abuse complaints, it becomes pretty obvious that either the service is being marketed toward abusive users or the provider is simply not taking proper action.
In that situation, Leaseweb will first warn the reseller and if still ignored then they can ask that reseller to leave leaseweb.
In our case, our relationship with Leaseweb is much broader than just VPS. VPS represents only a very small portion of our overall billing with them compared to the dedicated servers we own, colocation, and other services we use.
We also have more than 10 years of history with Leaseweb. As long as we continue handling abuse reports properly and enforcing our policies, our position with them is quite strong.
If you knowingly allow illegal activities on your services, then Leaseweb is not the only thing you should be worried about. Your own company could face investigation from law enforcement, your infrastructure could be seized, and you could personally end up in serious legal trouble.
Its leaseweb panel
pretty sure most resellers do get console/VNC access and can trigger reinstalls through the provider's control panel API, so yeah they could technically get in regardless of your root password. changing the root pw only stops someone from logging in over SSH, not someone with hypervisor access doing a console attach or snapshot.
“There is no such thing as a secure system if it has a network connection and an attacker has physical access.”
I use a clean Arch or ubuntu install from ISO if the provider allows it. I usually avoid provider templates unless I’ve checked what they actually contain. Check cloud init, users, SSH keys, repos, systemd services, cron jobs, agents and listening ports.
For SSH, use keys only, disable root login and passwords, use a separate admin account, and restrict users with AllowUsers/AllowGroups. For something more serious, keep SSH on a WireGuard/private management network and use FIDO2 keys.
Firewall both IPv4 and IPv6. Default deny and only open what you need.
ss -lntupis useful for checking what is actually listening. Dont leave things like MySQL, Redis, Docker API or random admin panels exposed to the internet.LUKS2 is good for data at rest, but on a VPS you still have to deal with unlocking it at boot. You can enter the password through the provider console or use a remote-unlock setup. Once the VPS is running, disk encryption wont help much against a compromised system. For extra hardening, AppArmor/SELinux and systemd sandboxing can be pretty useful. Things like
NoNewPrivileges,ProtectSystem,ProtectHome,PrivateTmp,RestrictAddressFamilies,CapabilityBoundingSet,SystemCallFilter, etc. can limit what a compromised service can do.QEMU Guest Agent is a bit different. It gives the hypervisor extra ways to interact with the guest. If you dont need it, disabling it removes some attack surface, but it doesnt protect you from the provider. They still control the hypervisor, virtual hardware and console.
But theres a nice guide by Forest - https://lowendtalk.com/discussion/220023/neutralizing-the-security-risk-of-qemu-guest-agent-without-removing-it
For VNC/web console, it depends on the provider. Dont think closing the browser means the Linux session is logged out. actually
exitthe shell and close the console session properly.I doubt they'd give you a memory dump if you asked though, would they? That kind of thing is typically only done during forensic investigations or when law enforcement sends a data preservation request.
You can either have the panel download and mount it if supported, or just run this script as root (with VNC open):
If you don't have VNC, you can connect over SSH but that's a bit more complicated. With example values, you'd add something like this to the
linuxline in the above GRUB config:You can also use https://netboot.xyz.
FDE doesn't always include the boot partition, and that's fine. If you use the Debian installer in expert mode (not sure about normal mode), you'll have the option to select "guided partitioning with encryption". Make sure the password is very strong because it must be able to withstand offline brute force and dictionary attacks.
Install the
cryptsetup-initramfspackage and read its documentation if you don't want to have to connect over VNC to supply the password every time you reboot.The VNC password is really weak (with noVNC you usually don't even see the password and it authenticates you automatically), but that only lets you access the virtual console, which has another password: Your user password. If that's strong (or if you have password-based login disabled), VNC can't do much.
You can hide potentially sensitive information from the reseller by adding
quiet loglevel=0to your boot options. That way, they won't see certain system messages that would otherwise get displayed and would be visible over VNC.Be aware that this only protects you from a reseller trying to compromise your VPS without user interaction. They could still, if they really cared, mount a rescue system and modify your unencrypted boot partition (or even bootloader) to capture your encryption password when you enter it next time. It also provides no protection against anyone with root access to the node, in this case Leaseweb. It only protects against a reseller who is not going to tamper with your bootloader/boot partition.
Absolutely. If provider supports custom ISO then that is already a huge bonus. Beyond that you just need to make sure anyone that's not LEA is gonna have a hard time trying to get your data. Encrypt the disk and only open stuff you need is fine.
And yeah, I saw that email about the whmcs updates from 3rd Sept being applied. Funny how it mentioned many vps users were still using the default generated password and their ssh was publically accessible. Such basic things to follow that can protect one's stuff better.
If someone's threat model is really of an extreme need then they can just opt to go with Xentt's new offering out there.
It's honestly not that extreme, considering we've had numerous providers who violated users' privacy and numerous providers who have gotten hacked. If you're talking about extreme, it'd be AMD SEV-SNP with FDE and remote attestation, not "encrypt sensitive stuff and turn off guest agent".
Oh I was not talking about OP's needs but just in general if someone wanted bulletproof hosting like running the next white rabbit network and other morally illegal stuff then someone like Xentt would be better.
On another note, you're right about SEV-SNP. I hardly see that in the offer threads but will make a mental note to look for it.
Afaik only @onidel and @Servitro @servury have SEV-SNP with remote attestation. I think Infofractal also has it on some nodes, but they don't support remote attestation yet.
I need to read up on how to use that then. Never used it before. Next weekend activity sorted.
https://kb.onidel.com/hc/kb/articles/1771943583-sev_snp-verified-boot-and-memory-encryption
A true and respectful host/reseller doesn't dig into its clients hosting account no-matter who they are without a court order, full stop, and even then they do as the court order says to the letter.
And even then, it's best to fight the court order legally (where possible).
Snooping is the only pleasure in web hosting.
That's a "trust me bro" approach, the bigger risk is not from the hoster/reseller, it's from
an attacker that manages to compromise Virtualizor, for example.
That's true, but it's also true that a respectful host doesn't snoop, even though that is of course not a guarantee of security.