Dartnode Unauthorized SSH Access

Crunchy7761 · 9:31PM

Hello, so I have a few vpses idling in dartnode, and I noticed there have been logins via ssh with password from people that are not me... Since most of these are idle I didn't bother changing the default password, which seems to be how they are logging in, maybe dartnode was hacked or something? Not sure.

Here is the command to check if anyone wants to check their vps: journalctl -u sshd --no-pager | grep 'Accepted ' or journalctl -u ssh --no-pager | grep 'Accepted '

I had connections on all of my vpses from the following ips: 185.121.108.3 104.28.237.21 104.28.205.19 103.29.127.12 108.165.120.4 108.165.12.55

NotFoundException · 9:32PM

@Crunchy7761 said: I didn't bother changing the default password

nghialele · 9:34PM

@Crunchy7761 said: I didn't bother changing the default password

emperor · 9:35PM

BOSTON is LIVE yeeeeeeeey
EDIT you should harden a bit your ssh
EDIT2 if they are hacked it would not be from ssh..

wadhah · 9:37PM

The provider does not need your ssh password to login to your vps, they can do it without alerting you at all.

Not sure about this though, seems weird but @DartNode should be pinged to respond

Crunchy7761 · 9:39PM

@emperor said:
EDIT2 if they are hacked it would not be from ssh..

I mean the panel specifically, the only way these ssh logins could have been done that I can think of is either the panel was hacked, or someone from support is connecting to them?

NotFoundException · 9:42PM

@Crunchy7761 said:

@emperor said:
EDIT2 if they are hacked it would not be from ssh..

I mean the panel specifically, the only way these ssh logins could have been done that I can think of is either the panel was hacked, or someone from support is connecting to them?

or your account has been hacked

emperor · 9:44PM

@NotFoundException said:

@Crunchy7761 said:

@emperor said:
EDIT2 if they are hacked it would not be from ssh..

I mean the panel specifically, the only way these ssh logins could have been done that I can think of is either the panel was hacked, or someone from support is connecting to them?

or your account has been hacked

If he use same default password everywhere, that is more likely
EDIT : We see everyday breaches, so everything can be.. Only @DartNode can know for sure..

Crunchy7761 · 9:45PM

@emperor said:

@NotFoundException said:

@Crunchy7761 said:

@emperor said:
EDIT2 if they are hacked it would not be from ssh..

I mean the panel specifically, the only way these ssh logins could have been done that I can think of is either the panel was hacked, or someone from support is connecting to them?

or your account has been hacked

If he use same default password everywhere, that is more likely

I use password manager with randomly generated password

bugabuga · 9:46PM

Maybe you downloaded something with a keylogger? scan your PC

globalRegisters · 9:49PM

Yes, I'm sure I your provider got hacked and not you.

Crunchy7761 · 9:51PM

@bugabuga said:
Maybe you downloaded something with a keylogger? scan your PC

the fact that 2 of the ips that connected to my vpses are from dartnode themselves, and I checked all my dartnode vpses and they dont have that ip, would be quite unlikely a keylogger would be run by someone who also has a dartnode vps.
Also I'm sure if I had installed a keylogger I would have noticed by now. And none of my other vpses have this, only the ones from dartnode.

barbaros · 9:53PM

Just cleaned XMR miner from my Dartnode idler, considering default password is 16 characters, it should be kinda hard to guess it.

Edit: Also last logged in IP is the same one as @Crunchy7761 had. CF warp IP

zed · 9:56PM

@Crunchy7761 said: 2 of the ips that connected to my vpses are from dartnode themselves

@barbaros said: Just cleaned XMR miner from my Dartnode idler

gets more interesting.

tux · 9:58PM

@barbaros, maybe it is hacked someway.

emperor · 10:08PM

@barbaros said:
Just cleaned XMR miner from my Dartnode idler, considering default password is 16 characters, it should be kinda hard to guess it.

Edit: Also last logged in IP is the same one as @Crunchy7761 had. CF warp IP

Thats bad.. sharing location of the miner in the vm would be great help so ppl can clean them faster. I doubt you are the only ones..

barbaros · 10:11PM

@emperor said:

@barbaros said:
Just cleaned XMR miner from my Dartnode idler, considering default password is 16 characters, it should be kinda hard to guess it.

Edit: Also last logged in IP is the same one as @Crunchy7761 had. CF warp IP

Thats bad.. sharing location of the miner in the vm would be great help so ppl can clean them faster. I doubt you are the only ones..

TBH, I was just lazy, gave the output of

ps aux --sort=-%cpu | head

and it said

Yes, this is almost certainly a compromise: PID 3552784 is a fake systemd-journald running from /usr/local/lib/.system-update/ (a hidden directory) with a config.json, which is the classic layout of a crypto miner like XMRig. The real journald lives at /lib/systemd/systemd-journald, and this one has burned about 347 minutes of CPU since Oct 14; the kswapd0 at 407 minutes is also worth checking, though it may just be genuine memory pressure.

To confirm, cat /usr/local/lib/.system-update/config.json will show a mining pool address and wallet, and ss -tupn | grep 3552784 will show its connection. Before anything else, copy that directory somewhere safe for evidence and run ls -l /proc/3552784/exe.

And config.json had the miner details, so I just reinstalled server.

The issue is Dartnode's default Debian 12 (no newer version) shows 300+ apt update, so that install image is quite old.

zed · 10:12PM

maybe they'll have time to address concerns during the next big twitch sale extravaganza

Fubuki · 10:16PM

@Crunchy7761 said: I didn't bother changing the default password

OP... that's your fault...

Neoon · 10:19PM

big oof, as a baseline, I can recommend, an extremely aggressive, fail2ban config.
If whatever hits your ssh port and fails to auth, gets send to the middle east.

Put that into /etc/fail2ban/jail.local

[recidive]
enabled = true
bantime = 604800      # 1 week
findtime = 86400      # 1 day
maxretry = 3

[sshd]
enabled = true
port    = ssh
filter  = sshd
maxretry = 1
findtime = 600
bantime  = 86400
banaction = %(banaction_allports)s
# Overrides default failregex to catch your exact log patterns
failregex = ^.*Invalid user \S+ from <HOST>.*$
            ^.*Failed publickey for \S+ from <HOST>.*$
            ^.*Connection closed by authenticating user \S+ <HOST> port \d+ \[preauth\].*$
            ^.*Disconnected from authenticating user \S+ <HOST> port \d+ \[preauth\].*$

TimboJones · 10:21PM

I find it a bit of a relief when it's just a miner and not spam or ransomware related.

ShadowLurker · 10:35PM

@emperor said:

BOSTON is LIVE yeeeeeeeey

when, where, no emails/services on my profile

emperor · 10:37PM

@ShadowLurker said:

@emperor said:

BOSTON is LIVE yeeeeeeeey

when, where, no emails/services on my profile

I just got my email 2h ago

Neoon · 10:48PM

@Neoon said:
big oof, as a baseline, I can recommend, an extremely aggressive, fail2ban config.
If whatever hits your ssh port and fails to auth, gets send to the middle east.

Put that into /etc/fail2ban/jail.local

[recidive]
enabled = true
bantime = 604800      # 1 week
findtime = 86400      # 1 day
maxretry = 3

[sshd]
enabled = true
port    = ssh
filter  = sshd
maxretry = 1
findtime = 600
bantime  = 86400
banaction = %(banaction_allports)s
# Overrides default failregex to catch your exact log patterns
failregex = ^.*Invalid user \S+ from <HOST>.*$
            ^.*Failed publickey for \S+ from <HOST>.*$
            ^.*Connection closed by authenticating user \S+ <HOST> port \d+ \[preauth\].*$
            ^.*Disconnected from authenticating user \S+ <HOST> port \d+ \[preauth\].*$

But what if the enemy attacks us from all angles?
Good that you ask, here is a nuclear option, my favorite.

Modded /etc/fail2ban/jail.local

[Definition]
dbpurgeage = 8d

[recidive]
enabled = true
bantime = 604800      # 1 week
findtime = 86400      # 1 day
maxretry = 3
banaction = iptables-allports-subnet

[sshd]
enabled = true
port    = ssh
filter  = sshd
maxretry = 1
findtime = 604800
bantime  = 86400
banaction = iptables-allports-subnet
# Overrides default failregex to catch your exact log patterns
failregex = ^.*Invalid user \S+ from <HOST>.*$
            ^.*Failed publickey for \S+ from <HOST>.*$
            ^.*Connection closed by authenticating user \S+ <HOST> port \d+ \[preauth\].*$
            ^.*Disconnected from authenticating user \S+ <HOST> port \d+ \[preauth\].*$

Also add our new nuclear option file.
My recommendation, set cidr to 8 and the other wired protocol should be set to 48 or less.

/etc/fail2ban/action.d/iptables-allports-subnet.conf

[INCLUDES]
before = iptables-allports.conf

[Definition]
actionban   = <iptables> -I f2b-<name> 1 -s <ip>/<cidr> -j <blocktype>
actionunban = <iptables> -D f2b-<name> -s <ip>/<cidr> -j <blocktype>

[Init]
cidr = 24

[Init?family=inet6]
cidr = 64

OpaqueRegistrant · 10:58PM

Direct node access won't show this signature of someone who logged in with the correct password. They probably wouldn't even do it with SSH.

@Neoon said:
big oof, as a baseline, I can recommend, an extremely aggressive, fail2ban config.
If whatever hits your ssh port and fails to auth, gets send to the middle east.

Put that into /etc/fail2ban/jail.local

You don't need fail2ban and it has a risk of biting you in the ass in the future. Just disable password login, and generate your own private key and use that to log in.

You don't want to be accidentally banning yourself because you mistyped your password in a rush or because you're logging in from a less than usual place or because the last person who had your IP address ran a port scanner.

Neoon · 11:05PM

@OpaqueRegistrant said:
Direct node access won't show this signature of someone who logged in with the correct password. They probably wouldn't even do it with SSH.

I doubt that dartnode got breached.
If they got breached, we shall see, the next 24h will tell.

JoshR · 11:07PM

@Crunchy7761 At this point. If you have confirmed that someone else besides you have logged into the system. Treat it as poisoned. Reimage the system and start fresh. Use your own passwords from the start. Simple things as changing the SSH port helps from the quick scrape bots poking your port 22. Also if able to. Enable UFW and lock down your SSH port to your "Home" IP (Unless you have a dynamic IP then you can get locked out).

You at this point are looking for needles in the haystack to see what's all in the machine. You might get most of them but who know what else is lurking around.

Crunchy7761 · 11:13PM

@Neoon said:

@OpaqueRegistrant said:
Direct node access won't show this signature of someone who logged in with the correct password. They probably wouldn't even do it with SSH.

I doubt that dartnode got breached.
If they got breached, we shall see, the next 24h will tell.

every single one of my vpses has access from unknown ips, and barbaros also had it so not sure what other explanation there could be

barbaros · 11:16PM

@sillycat found this when I shared pool details with him, some of these ips are dartnode for sure

Also config.json of miner

cat /usr/local/lib/.system-update/config.json

{
"autosave": false,
"donate-level": 1,
"cpu": {
"enabled": true,
"huge-pages": false,
"huge-pages-jit": false,
"hw-aes": true,
"priority": 1,
"memory-pool": true,
"max-threads-hint": 60,
"asm": true,
"yield": true
},
"randomx": {
"init": -1,
"init-avx2": -1,
"mode": "light",
"1gb-pages": false,
"rdmsr": false,
"wrmsr": false,
"cache_qos": false,
"numa": true,
"scratchpad_prefetch_mode": 1
},
"pools": [
{
"url": "141.95.72.61:443",
"user": "466U7FGEbSh89VHcQu7UiLPBSDkHiJpMkDt3rc3PavHdUzBXs8uwhZFXhNfY6bAU9n4W6YNFegU1ubA6hZqpSnZL1df5yCW",
"pass": "node-108-165-xxx-xxx",
"keepalive": true,
"tls": true,
"algo": "rx/0"
},
{
"url": "141.95.72.59:443",
"user": "466U7FGEbSh89VHcQu7UiLPBSDkHiJpMkDt3rc3PavHdUzBXs8uwhZFXhNfY6bAU9n4W6YNFegU1ubA6hZqpSnZL1df5yCW",
"pass": "node-108-165-xxx-xxx",
"keepalive": true,
"tls": true,
"algo": "rx/0"
},
{
"url": "pool.supportxmr.com:443",
"user": "466U7FGEbSh89VHcQu7UiLPBSDkHiJpMkDt3rc3PavHdUzBXs8uwhZFXhNfY6bAU9n4W6YNFegU1ubA6hZqpSnZL1df5yCW",
"pass": "node-108-165-xxx-xxx",
"keepalive": true,
"tls": true,
"algo": "rx/0"
}
],
"log-file": null,
"print-time": 0,
"health-print-time": 0,
"retries": 10,
"retry-pause": 3,
"syslog": false,
"verbose": 0
}

And connections

tcp SYN-SENT 0 1 108.165.xx.xx:36878 107.167.92.130:443 users:(("systemd-journal",pid=3552784,fd=16))
tcp SYN-SENT 0 1 108.165.xx.xxx:44312 141.95.72.61:443 users:(("systemd-journal",pid=3552784,fd=15))

Neoon · 11:17PM

@Crunchy7761 said:

@Neoon said:

@OpaqueRegistrant said:
Direct node access won't show this signature of someone who logged in with the correct password. They probably wouldn't even do it with SSH.

I doubt that dartnode got breached.
If they got breached, we shall see, the next 24h will tell.

every single one of my vpses has access from unknown ips, and barbaros also had it so not sure what other explanation there could be

brother in christ, every single vps, gets fucked by bots, every single day, bruh.

JohnnySac · 11:20PM

I see a similar thing. On DartNode VPS's that I installed from ISO myself are fine, but the ones I did not get around to setting up yet (still using their Ubuntu 24.04 template) have had their .ssh/authorized_keys files cleared so I couldn't log in with my SSH key. And .bash_history is symlinked to /dev/null. Like OP I see the last person logged in is:

Last login: Sun Sep 27 13:17:32 2026 from 104.28.237.19

I don't see any crypto miners running but someone was def was messing around with it.

Howdy, Stranger!

Categories

In this Discussion

Dartnode Unauthorized SSH Access

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Dartnode Unauthorized SSH Access

Comments