Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
VDS.net
InterServer VPS
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
CloudLinux
MeduzaVPN
Servury - Anonymous & Privacy-focused VPS Hosting
Animated Silicon Kiwi cloud ad featuring VPS from $4.90/month, 100 GB S3 storage from $1.49/month, Kiwi Apps from $12/month and cloud backup from $3/month

Categories

In this Discussion

Home › General
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Dartnode Unauthorized SSH Access

2»

Comments

  • barbarosbarbaros Member

    @JohnnySac said:
    I see a similar thing. On DartNode VPS's that I installed from ISO myself are fine, but the ones I did not get around to setting up yet (still using their Ubuntu 24.04 template) have had their .ssh/authorized_keys files cleared so I couldn't log in with my SSH key. And .bash_history is symlinked to /dev/null. Like OP I see the last person logged in is:

    Last login: Sun Sep 27 13:17:32 2026 from 104.28.237.19

    I don't see any crypto miners running but someone was def was messing around with it.

    Edit: After restarting it I see the miner running named as /usr/local/lib/.system-update/systemd-journald

    Don't forget to cat /usr/local/lib/.system-update/config.json to see wallet address. Probably same dude.

  • keoirkeoir Member, Host Rep

    If you believe your VM has been accessed and you have any other information related to the unauthorized access open a support ticket so we can take a look :smile:

    Right now we don't have any indication of a security breach, but always happy to look and try to correlate anything we're getting reports on.

    Of course, always reset the default password and use ssh keys instead. The default password should just be used for initial access to the system. :smile:

    And yes we're working on a install with ssh public keys :smile:

  • Crunchy7761Crunchy7761 Member
    edited October 19

    @barbaros said:

    @JohnnySac said:
    I see a similar thing. On DartNode VPS's that I installed from ISO myself are fine, but the ones I did not get around to setting up yet (still using their Ubuntu 24.04 template) have had their .ssh/authorized_keys files cleared so I couldn't log in with my SSH key. And .bash_history is symlinked to /dev/null. Like OP I see the last person logged in is:

    Last login: Sun Sep 27 13:17:32 2026 from 104.28.237.19

    I don't see any crypto miners running but someone was def was messing around with it.

    Edit: After restarting it I see the miner running named as /usr/local/lib/.system-update/systemd-journald

    Don't forget to cat /usr/local/lib/.system-update/config.json to see wallet address. Probably same dude.

    {
    "autosave": false,
    "donate-level": 1,
    "cpu": {
        "enabled": true,
        "huge-pages": true,
        "huge-pages-jit": true,
        "hw-aes": null,
        "priority": 2,
        "memory-pool": true,
        "max-threads-hint": 70,
        "asm": true,
        "yield": false
    },
    "randomx": {
        "init": -1,
        "init-avx2": -1,
        "mode": "fast",
        "1gb-pages": false,
        "rdmsr": true,
        "wrmsr": true,
        "cache_qos": false,
        "numa": true,
        "scratchpad_prefetch_mode": 1
    },
    "pools": [
        {
            "url": "pool.supportxmr.com:443",
            "user": "466U7FGEbSh89VHcQu7UiLPBSDkHiJpMkDt3rc3PavHdUzBXs8uwhZFXhNfY6bAU9n4W6YNFegU1ubA6hZqpSnZL1df5yCW",
            "pass": "node-[REDACTED]",
            "keepalive": true,
            "tls": true,
            "algo": "rx/0"
        },
        {
            "url": "de.supportxmr.com:443",
            "user": "466U7FGEbSh89VHcQu7UiLPBSDkHiJpMkDt3rc3PavHdUzBXs8uwhZFXhNfY6bAU9n4W6YNFegU1ubA6hZqpSnZL1df5yCW",
            "pass": "node-[REDACTED]",
            "keepalive": true,
            "tls": true,
            "algo": "rx/0"
        }
    ],
    "log-file": null,
    "print-time": 0,
    "health-print-time": 0,
    "retries": 5,
    "retry-pause": 3,
    "syslog": false,
    "verbose": 0
}

  • barbarosbarbaros Member
    edited October 19

    @keoir said:
    If you believe your VM has been accessed and you have any other information related to the unauthorized access open a support ticket so we can take a look :smile:

    Right now we don't have any indication of a security breach, but always happy to look and try to correlate anything we're getting reports on.

    Of course, always reset the default password and use ssh keys instead. The default password should just be used for initial access to the system. :smile:

    And yes we're working on a install with ssh public keys :smile:

    Please consider adding Debian 13 image, and auto run apt update after installation. Default installation comes with too many outdated packages.

    Also the wallet shows the ips miners running on, perhaps get in contact with those server owners or just suspend their servers as the miner is abusing your resources.

    @Crunchy7761 said:

    yeah it's the same wallet.

  • Crunchy7761Crunchy7761 Member
    edited 12:09AM

    @Neoon said:

    @Crunchy7761 said:

    @Neoon said:

    @OpaqueRegistrant said:
    Direct node access won't show this signature of someone who logged in with the correct password. They probably wouldn't even do it with SSH.

    I doubt that dartnode got breached.
    If they got breached, we shall see, the next 24h will tell.

    every single one of my vpses has access from unknown ips, and barbaros also had it so not sure what other explanation there could be

    brother in christ, every single vps, gets fucked by bots, every single day, bruh.

    the password is 16 characters with 62 variants per letter, its quite impossible for the same person to have guessed all my vps passwords, and 2 other peoples as well. And since the login method says ssh with password, we can rule out any other exploit as well, since the root password hasn't been changed and its not possible to get the root password once its been set.

    @keoir said:
    If you believe your VM has been accessed and you have any other information related to the unauthorized access open a support ticket so we can take a look :smile:

    Right now we don't have any indication of a security breach, but always happy to look and try to correlate anything we're getting reports on.

    Of course, always reset the default password and use ssh keys instead. The default password should just be used for initial access to the system. :smile:

    And yes we're working on a install with ssh public keys :smile:

    As said above, currently there are 3 people which have reported the same issue... The only remaining way that I can see they could have obtained the password is if the panel was hacked or a rogue support agent.

  • nghialelenghialele Member

    @barbaros said: The issue is Dartnode's default Debian 12 (no newer version) shows 300+ apt update, so that install image is quite old.

    They told me in ticket that Debian 13 is too early in development for them to deploy in their fleet. Crazy work.

    Thanked by 1barbaros
  • JohnFilch123JohnFilch123 Member

    had the same miner recently, on around 50 servers, so not just dartnode

  • bugabugabugabuga Member

    Honestly, if you guys are on windows doesn't hurt to just do a quick scan with Malwarebytes! had this happened years back, even AVG AV didn't catch it but MWB did.. Was Zeus keylogger.. I dunno if MWB is still good nowday's but was great back in the day

Sign In or Register to comment.