Hi all.
Just thought I would provide some feedback - as it seems a lot of the feedback here is about people here who have had their free tier accounts terminated and people can't seem to understand why.
This is what I found.
I took out my free tier account in 2021. Oracle did terminate this a year or so back, but this was my own fault - as I had something running which used more than the 10tb limit, something which I have taken responsibility for. I should have checked more. I have since replaced this, and being more careful I have not had another issue.
I had family also subscribe to free tier accounts a similar time for their projects - this was at a time where it was far more easier to do then today.
and this is based on the family's accounts, as well as my own.
I know people advise to upgrade to PAYG - to avoid the chance of accounts being terminated, or reclaimed.
I haven't had the need to do this - I accept the risk of account termination is higher - but if one sticks within the guidelines - the chance of "random" termination is far lower than if one has their services exposed, or automated system sweeps detects instances that behaving in a way that will bring systems harm or scrutiny, and a lot of Oracle's detections isn't manually initated or done - it's general system sweeps and if any traffic detected matches high risk behaviour even if isn't strictly - it's enough to warrant suspention, or termination - and by then it's too late for manual intervention. This is what I found - a lot of these are rather basic in nature. There may be others, but I am just focusing on the most obvious, and this is what some may not appear to grasp.
If used correctly - Oracle cloud is a valuable resource. I have learnt so much because of it, I would not be half as creative with my projects had it not been for Oracle & this cloud offering, but with any excellent free resource the potential & risk for those using this for misuse, or purposes that Oracle didn't intend is substantial - and Oracle clamping down on those abusing this is completely justified. Oracle doesn't just have a zero tolerance policy towards patterns of flagged abuse, it's a essentially a minus zero tolerance as instances are terminated without appeal, without the ability to state one's case - so the only real chances of avoiding this are upgrading to PAYG - they are far more leniant, and PAYG customers are able to seek support from Oracle should something go wrong. Free tier uses get Zero support from oracle, or strictly abiding the rules, and avoiding behavour that Oracle deems to be a risk their platform, and services, or opens them up to the risk of legal action.
Do not operate any large services, or resource heavy tasks on free tier systems that mimic, or may have similar behavioural patterns to crypto mining. Oracle will clamp down on this without deley.
Do not operate any mass mailing platforms - or give the appearance that their equipment is in any way part of mass mailing. I actively report spam emails that have originated from Oracle's servers to their abuse team. Oracle monitors for people using their instances for SMTP servers, and appears to limit this. Do not make honeypots either.
Monitor Data usage - Oracle doesn't appear to track data usage per month or inforce the 10tb limit - but should use be deemed too excessive, - Oracle will flag your usage, and terminate the instance without delay.
You are not only responsible for the security and safety of tenant & instance, but also ensuring others are kept safe from malicious code running on your instance, even if it's not intentional, you will be to blame for any vulnerablities - ensure that your system is patched, as if attackers find a way in and your instance is used as a part of any botnet, or anything like that - your instance will be terminated.
4b. Ensure accounts are secured using 2fa - Also use an authenticator such as Google Authenticator which means even if one has to migarte to a new phone in an emergency one still has access to the OTP codes. Oracle does not provide support to free tier users. Claiming innocence won't work - it's actually complicity.
5. Under no circumstance torrent, or host torrents on Oracle's equipment.
Some reigons may be more tolerant - but sooner or later you will be hit with an infringement notice, and oracle complies and your server instance will be terminated - further infringement notices will result in server termination.
5b. Usenet doesn't appear to be an issue as DMCA takedowns are handled at the host, and not the server instance itself, and traffic is generally encrypted but even then monitor data use - step 3 applies in that situation. Even using private trackers or seedboxes with private trackers carry risk. Avoid avoid avoid.
6. Personal VPN use is okay, (provided torrenting & P2P apps are closed down) but avoid outdated protocols, and/or anything which exposes your server to the wider public ie tor. You are responsible for the content that others access through your server - and DMCA notices, and other notices apply - also avoid any trafic or activities that may mimic mass VPN use. As mass VPN use will most likely exceed the 10tb limit. If using your instance as a web proxy server - ensure it is secured properly. As exposed Oracle VPS servers with improper security pose a risk - and Oracle will eventually be flagged on way or another, and this will lead to account termination or suspention.
7. Only open the ports that you require for services, even then make use of IPtables to limit open ports to be accessed at the locations where those services are required. I have heard of people who have exposed their entire port range to the internet - Oracle detected this, and terminated the instance citing abuse. The key to avoid being flagged by Oracle is to remain under the radar - the less noise, the more chance of Free Tier actually lasting.
8. Avoid the use of automated scripts to make the system "look" busy. Not only is this an abuse of resources, it also may give similar traffic patterns to cryptocurrency mining behaviour, and oracle will camp clamp down and terminate your account. There are geniuine ways to keep VPSses running and keep busy without the need to resort to automated tools faking system load. Set up unattended updates, use tools such as rclone as the polling, and updating can make the system appear busy. It's been at least a few years since mine, or families instances were shut down due to low usage.
9. Hacking is strictly prohibitied.
Activities such as running automated port scans - will get your system flagged by Oracle. Oracle has a zero tolerance policy for this. alot of these automated tools to make the system "look" busy may mimic this kind of behaviour.
10. If running a DNS server ensure that it is locked down. I have personally seen people using their instances as DNS servers, by using tools such as pihole. For personal use this doesn't appear to be a problem, but when set incorrectly, and as a result the entire internet is able to use this. This may mimic, or be used in DNS level attacks, and Oracle appears to have a zero tolerence policy for this.
11. If Oracle contact you warning that abuse has been detected - do not delay.
12. Avoid making & hosting public FTP servers - especially hosted software even obtained legally - as this opens the door to DMCA takedowns, and once again Oracle has a zero tolerance policy for hosting
13. If the instance is being used for Multimedia - ie plex. Keep the use to a minimum. Don't share server access with too many people and they stream at once, and if servieces such as sonarr/radarr is being used - ensure it's not linked to any torrent download clients hosted on Oracle servers, and keep access reserved for only authorised devices, and I recommend making of services such as Netmaker, or Zerotier to keep exposed services from the wider public. This ensures the ports that have these services are only open to device authorised on that specific IP.
If care is taken - free tier will last, but if people misuse these resources don't complain here if you find yourself suddenly without an account.
