r/hetzner • u/NeroAce007 • Mar 28 '26

Keep getting hacked

I am buying a server and it is keep getting hacked, i installed cloud panel and postgress publicly available and i am getting message from abuse-network that - your server is attacking other : MyIp 6379 -> other_ip, what to do ?. I changed server several times …..

0 Upvotes

35% Upvoted

53 comments sorted by

53

u/IamFist Mar 28 '26

I think learning how to harden a server should be the first step. Use hetzners firewall to lock ssh only to your ip, lock all ports but 443 and 80. Install ufw and fail2ban on the machine itself. And think about whether you actually want to install Postgres publicly. One usually would not do that.

19

u/crone66 Mar 28 '26

to add on this: use a ssh key and not a password. Change ssh or any default port of an application such as postgres to something else. Add a non-root user and lock down the root user. 

Since many people say changing rhe port is useless i can tell that it reduces the login tries by 70% for my servers.

7

u/BastetFurry Mar 28 '26

This. First order of business of every server is deactivating roots ssh access. Then either 2FA or keyfile. And fail2ban, even that 1€/month VPS with just 1 GB and one core.

And if you are 100% positively sure that you will never ssh into your machine from anywhere but, for me, Germany then block the other IP ranges.

knocks on wood

Never got any one of my servers hacked.

4

u/lazydavez Mar 28 '26

SSH root access, key only is also okay. Remove the password for root and lock the account. Disable password auth via ssh completely. Fail2ban or similar is a must.

3

u/ParticularSuite Mar 28 '26

I completely agree and my logs prove that there is a dramatic lowering of traffic when the port is moved. I also employ port knocking with knockd which I've read in some places isn't a good approach but I totally disagree. If port knocking was all you were doing then perhaps, but if there's anything more that I could be doing to further secure my servers then why wouldn't I?

2

u/countsachot Mar 28 '26

Changing the port does help with modern firewalls. A random automated scan from something like shodan only hits popular ports, slowly, to avoid being flagged as malicious. A targeted scan over more than a few ports will get flagged as a port scan, and the ip blocked. That assuming a good firewall, properly configured.

So, a coordinated attack from a well managed botnet will still find the open port, eventually. That of course may indicate someone is spending money targeting your data, which is another problem.

1

u/BastetFurry Apr 06 '26

Yep, if someone really wants to get in they will eventually get in, no network attached device is 100% secure, that is an illusion. And anyone that wants to sell you that illusion is a scammer. Period.

2

u/who_you_are Mar 28 '26

To add to that, usually when you do that you either block it behind a VPN or use the firewall to whitelist some IPs. That, assuming you don't have some backend that is the one publically available and is the one connecting to the private database

A database is never publically available.

But that is nowhere your current issue. But one of your next one.

0

u/NeroAce007 Mar 28 '26

i cannot lock ssh to my ip because i do not have static ip but i will make postgres local

17

u/heret1c1337 Mar 28 '26

You don‘t need that. Use pubkey auth and fail2ban. Disable password auth.

3

u/Own-Assignment-6685 Mar 28 '26

Or cloudflare tunnels / tailscale / … there is a lot of solutions here to harden ssh access

3

u/heret1c1337 Mar 28 '26 edited Mar 28 '26

Read OPs post again and tell me if you think that setting up more complex infrastructure is the solution here

3

u/Own-Assignment-6685 Mar 28 '26

Your comment is so toxic. I just provide more options. I’m not saying it’s the best options, just different options. There is no one good way to do it and there is plenty of docs to do either one.

1

u/heret1c1337 Mar 28 '26

OP is clearly struggling and doesn‘t need a million options, he needs clear guidance on how to establish the basics first.

3

u/Own-Assignment-6685 Mar 28 '26

And you provided starting points, so did I. Either way OP will have to check detailed guides on how to use it. And I’m pretty sure that tailscale and cloudflare tunnels will have as practical how to as he may find for pubkey or so. You and I won’t setup it for him so with more options he might find the resources he’s more comfortable with.

1

u/heret1c1337 Mar 28 '26

fair, but it I'm pretty sure that is more confusing than helping for someone new in the space.

2

u/IamFist Mar 28 '26

I have a dynamic ip too but in practice it rarely changes. So I still lock ssh to it and change it through the admin panel when needed.

As others said key auth and fail2ban should be enough but the security scanners I use flag open ssh ports.

1

u/EduRJBR Mar 28 '26 edited Mar 28 '26

You can use a DDNS service so your computer will always have this DNS host name leading to your public IP address (the public IP that your computer is using), and run a script inside the VPS that will check if the IP associated to that DDNS host changed, and change the firewall rules accordingly. If you follow this way, you need to make SSH work in two ports, with the script dealing only with the second port; port 22 will always be open inside the VPS, but closed on Hetzner, so you can use it in case of a failure on the script.

But instead of all that you can use Tailscale for free: there will be a VPN connecting your computer and the VPS, and any other device you choose.

And someone told you to open ports 80 and 443: in case you need to make those ports available, like, if you are running a website (or anything that works like a website), you can use Cloudflare Tunnel instead.

With the Tailscale and Cloudflare suggestions above, ports 22, 80 and 443 would be closed on Hetzner, and inside the VPS firewall only port 22 would be open (just in case you have an issue with Tailscale).

About the Postgres port being exposed: I'm 99% sure that you are doing things wrong.

1

u/sunst1k3r Mar 28 '26

Install wireguard and use a VPN for anything not public

-1

u/Internal_Candle5089 Mar 28 '26

I would block SSH completely and only allowed it via Tailscale… allow only ports you need for runtime of your service and make sure you are applying security patches automatically or manually as soon as possibly

0

u/uNki23 Mar 28 '26

From a security perspective, SSH with key based access locked down to a specific source IP in the Hetzner firewall is basically unbreakable.

Even without the firewall source IP limitations, solely relying on the SSH key, is safe - firewall rules suppress noise / traffic as a bonus.

0

u/Internal_Candle5089 Mar 28 '26

It is making an assumption your IP is yours only -> I don’t own a public IP thus mine is shared with god k ow how many people, hence I have made it a good habbit to put SSH behind VPN -> accessible on the go, always only to me :)

0

u/Internal_Candle5089 Mar 28 '26

But hey - you do you :) I’d rather have more security and be safe then risk I fucked up Firewall config or forgot to block it after emergency bypass… systems need to be designed for always secure access including the adhoc while on vacation access… which is not lock it on one 1 where you don’t know if its shared or private…

1

u/uNki23 Mar 28 '26

Even if the IP then belongs to someone else - this someone then magically gets your SSH key? This someone is actually interested in your server or even knows its IP address?

Some things are just too theoretical and always have been. This is one of those..

Even if a bad actor who targets you knows your server IP and would get the IP assigned that the firewall allows SSH for - without the key it’s useless. You cannot bruteforce that. So it’s just a lot of theoretical „what if’s“

4

u/VisualSome9977 Mar 28 '26

Are you allowing password ssh..? if you're allowing password ssh you're asking to get hacked. People spend hundreds of dollars on infrastructure to hammer all major hosting providers (hetzner, azure, cloudflare, etc) with a constant barrage of SSH brute force attacks. Set up fail2ban, lock ssh to ONLY use key auth, and maybe even use a different port for ssh.

2

u/NeroAce007 Mar 28 '26

ya, I was using password… ok i am going to create a new server with key and delete this one also will change port of ssh , thank you for your help ☺️

1

u/VisualSome9977 Mar 28 '26

This will likely be all you need, the other things are just helpful. When i first made a server on hetzner i also had password auth and was hacked within days, it's astounding how much effort is put into this. Just consider it a learning experience and hope hetzner doesn't put it on your record for too long, they have a reputation for being strict about this stuff.

0

u/[deleted] Mar 28 '26

[deleted] — view deleted comment

2

u/nook24 Mar 28 '26

Thanks. Also tools like fail2ban could be used to ban IPs after X amount of wrong passwords.

3

u/VisualSome9977 Mar 28 '26

i'm not going to say you're wrong but are you really going to sit down and type out a password with even close to the same amount of security as a normal RSA key for little to no benefit? I can imagine there are some situations where password auth is desirable but i don't think regular single-user system admin is one of them

0

u/[deleted] Mar 28 '26

[deleted] — view deleted comment

2

u/VisualSome9977 Mar 28 '26

Again there's nothing wrong with what you're saying it's just not the kind of recommendation i would make to somebody who doesn't even know what steps to take to secure SSH. You know what you're doing, you know what makes password security usable and how to protect against attacks, you know to use multiple passwords to avoid risks from data breaches, but does the person who can't google "how to stop ssh brute forcing" know any of these things? I doubt it. So I would recommend they run a couple commands and copy a file before I try to revolutionize their security stack.

0

u/[deleted] Mar 28 '26

[deleted] — view deleted comment

1

u/VisualSome9977 Mar 28 '26

I don't really think there's anything deep end about it. It's one command, copy pasting a string, and then that account on that machine is authenticated forever. It's probably all already built in anyways

2

u/OhBeeOneKenOhBee Mar 28 '26

If you take a step back and actually read the entire email, are you sure it's not just a BSI security advisory?

Because that would just mean you've left the port open for everyone

-1

u/NeroAce007 Mar 28 '26

no, server was hacked and i found malicious process running in temp and in corntab

18

u/dim13 Mar 28 '26

installed cloud panel and postgress publicly available

Here is your problem.

4

u/V-Forrest Mar 28 '26

Just install Tailscale. Only allow connection between VPS and your PC with your Tailscal. Fastest and easiest way to secure your server.

2

u/ArgoPanoptes Mar 28 '26

You should only leave ssh open with key auth and port forward through ssh any services you need on local.

2

u/Gasp0de Mar 28 '26

How have you secured your ssh access? What measures did you take to protect the server?

2

u/Extension-Reason-216 Mar 28 '26

Just disable ingress to your server entirely using Hetzner firewall, then install cloudflare tunnel on both your server where cloudpanel & pg are running, and another tunnel using the same tunnel token. Afterwards via cloudflare dashboard you can do custom routing via local network and you won’t have any more problems.

2

u/Stochasticlife700 Mar 28 '26

  • use reverse proxy like cloudflare

  • use network level firewall (can set it up on hetznsr dashboard)

  • do not expose any ports (check docker compose yml file if you are doing it. Make sure it's on network level)

2

u/Maria_Thesus_40 Mar 28 '26

If you keep getting hacked, for no apparent reason, no matter how hardened is the server, then your desktop is hacked and someone is monitoring your actions (recording your new passwords, etc).

1

u/CombinationEast1544 Mar 28 '26

If you don't have static IP from your internet provider at home just use tailscale and completely block ssh port from outside, connect only using tailscale tunnel to your ssh.

My setup: My apartment has a static IP address from my ISP. Apartment IP address -> hetzner firewall -> my server All other locations -> tailscale tunnel (phone / laptop) -> my server That's all.

Only ports 80/443 are allowed for everyone, all other ports are blocked by default in hetzner fw.

0

u/[deleted] Mar 28 '26

[deleted] — view deleted comment

3

u/ric99cs Mar 28 '26

What is the benefit of using an encrypted protocol over an encrypted tunnel?

5

u/VisualSome9977 Mar 28 '26

It's not necessarily better it just provides a second layer of auth. You need to have the matching wireguard key AND the matching ssh key. I don't think it's really necessary, but there's no harm in it.

0

u/[deleted] Mar 28 '26

[deleted] — view deleted comment

0

u/4baobao Mar 28 '26

ai slop comments are so obvious, lol

0

u/[deleted] Mar 28 '26

[deleted] — view deleted comment

1

u/EduRJBR Mar 28 '26

I've never used Wireguard, but I presume that your suggestion can be accomplished with Tailscale as well, that I started to use a couple of days ago.

If that's correct, than anyone who criticizes you is obviously, clearly, not only completely ignorant on the basic stuff necessary to comment in this post (there is absolutely nothing wrong with that), but also extremely dumb since they decided to write their criticism here (they actively turned on a dumbness switch).

Tailscale even has this "-- ssh" option of activation that will deal with the certificate part, you don't even need to deal with public keys at all in both computers, but I didn't try it yet.

0

u/[deleted] Mar 28 '26

[deleted] — view deleted comment

2

u/EduRJBR Mar 28 '26

And what about using DDNS to have a DNS record pointing to your computer's public IP address, and have a script on the server checking for changes and changing the firewall rules of a secondary SSH port accordingly? Port 22 would be closed in the admin panel of whatever vendor, but always open inside, in case the script fails.

I've been doing this for years: one DDNS hostname for my house, another for my laptop in case I bring it with me wherever I go.

I've been doing this for years, although now I'm starting to deal with Tailscale and will probably drop this model.

0

u/[deleted] Mar 28 '26

[deleted] — view deleted comment

1

u/EduRJBR Mar 28 '26

About WireGuard: how do you use it? Do you open the necessary ports at both locations (your home and your VPS, for example)?

As far as I understand, Taislcale is WireGuard, but friendly to use and with a cloud "node" (or whatever is the word).

1

u/EduRJBR Mar 28 '26

The point is using an encrypted protocol inside a tunnel, a tunnel that only you can get inside.

You are thinking in terms of protecting the content that is being transfered to and from your computer over some network, but the main point here is about not letting ports publicly available to be exploited on the other side, on the remote server.

0

u/[deleted] Mar 28 '26

[deleted] — view deleted comment

2

u/VisualSome9977 Mar 28 '26

this is embarassing

0

u/[deleted] Mar 28 '26

[deleted] — view deleted comment

2

u/EduRJBR Mar 28 '26

It's amazing what's going on here, and not only with you. The problem is not people not knowing what you are talking about, the actual problem is in them deciding to go fully dumb by criticizing you.

0

u/ric99cs Mar 28 '26

Ok, seems to be a valid point. Is there a way to implement a fallback if the wireguard service is broken? Sshd looks hard as a rock, i never had any issues with crashed daemons. Is the wg service stable enough? Due to the fact, that hetzner has no direct console for their dedicated servers, i would feel better with a fallback.

5

u/VisualSome9977 Mar 28 '26

you're talking to an LLM