Is it possible to hold a server hostage if someone is given root access? [closed]
Clash Royale CLAN TAG#URR8PPP
up vote
0
down vote
favorite
If I have a VPS (on digital ocean) running debian and I share root access to this server via SSH keys or root password with someone, can that person hold my website (the thing that is being hosted on the server) hostage? That is, they have as much access as I do.
Can't I just reset root password and remove all SSH keys to ensure it is safe again?
Otherwise, could I just spin up a new VPS and re-upload all the site code/database and start fresh?
Someone told me the only solution was to throw everything away including the code (magento php code) on the server and start from scratch, but I think this is overkill.
ssh security vps
asked Nov 28 '17 at 0:47
guy
1093
closed as too broad by jasonwryan, Stephen Rauch, mdpc, G-Man, SatÃ…Â Katsura Nov 28 '17 at 13:17
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
 |Â
show 1 more comment
up vote
0
down vote
favorite
If I have a VPS (on digital ocean) running debian and I share root access to this server via SSH keys or root password with someone, can that person hold my website (the thing that is being hosted on the server) hostage? That is, they have as much access as I do.
Can't I just reset root password and remove all SSH keys to ensure it is safe again?
Otherwise, could I just spin up a new VPS and re-upload all the site code/database and start fresh?
Someone told me the only solution was to throw everything away including the code (magento php code) on the server and start from scratch, but I think this is overkill.
ssh security vps
asked Nov 28 '17 at 0:47
guy
1093
closed as too broad by jasonwryan, Stephen Rauch, mdpc, G-Man, SatÃ…Â Katsura Nov 28 '17 at 13:17
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
He can encrypt your whole data including rootfs.
– Ipor Sircer
Nov 28 '17 at 0:48
@IporSircer So neither of my solutions would be sufficient?
– guy
Nov 28 '17 at 0:51
why you want to share root access? give the user sudo access so that he can only do what he required to do
– Sharuzzaman Ahmat Raslan
Nov 28 '17 at 1:34
1
ahhhh....yes, why would you think not?
– mdpc
Nov 28 '17 at 1:44
@mdpc Yes I need to redo everything and all is lost?
– guy
Nov 28 '17 at 1:50
 |Â
show 1 more comment
up vote
0
down vote
favorite
up vote
0
down vote
favorite
If I have a VPS (on digital ocean) running debian and I share root access to this server via SSH keys or root password with someone, can that person hold my website (the thing that is being hosted on the server) hostage? That is, they have as much access as I do.
Can't I just reset root password and remove all SSH keys to ensure it is safe again?
Otherwise, could I just spin up a new VPS and re-upload all the site code/database and start fresh?
Someone told me the only solution was to throw everything away including the code (magento php code) on the server and start from scratch, but I think this is overkill.
ssh security vps
asked Nov 28 '17 at 0:47
guy
1093
If I have a VPS (on digital ocean) running debian and I share root access to this server via SSH keys or root password with someone, can that person hold my website (the thing that is being hosted on the server) hostage? That is, they have as much access as I do.
Can't I just reset root password and remove all SSH keys to ensure it is safe again?
Otherwise, could I just spin up a new VPS and re-upload all the site code/database and start fresh?
Someone told me the only solution was to throw everything away including the code (magento php code) on the server and start from scratch, but I think this is overkill.
ssh security vps
asked Nov 28 '17 at 0:47
guy
1093
asked Nov 28 '17 at 0:47
guy
1093
asked Nov 28 '17 at 0:47
guy
1093
asked Nov 28 '17 at 0:47
guy
1093
1093
closed as too broad by jasonwryan, Stephen Rauch, mdpc, G-Man, SatÃ…Â Katsura Nov 28 '17 at 13:17
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
closed as too broad by jasonwryan, Stephen Rauch, mdpc, G-Man, SatÃ…Â Katsura Nov 28 '17 at 13:17
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
He can encrypt your whole data including rootfs.
– Ipor Sircer
Nov 28 '17 at 0:48
@IporSircer So neither of my solutions would be sufficient?
– guy
Nov 28 '17 at 0:51
why you want to share root access? give the user sudo access so that he can only do what he required to do
– Sharuzzaman Ahmat Raslan
Nov 28 '17 at 1:34
1
ahhhh....yes, why would you think not?
– mdpc
Nov 28 '17 at 1:44
@mdpc Yes I need to redo everything and all is lost?
– guy
Nov 28 '17 at 1:50
 |Â
show 1 more comment
He can encrypt your whole data including rootfs.
– Ipor Sircer
Nov 28 '17 at 0:48
@IporSircer So neither of my solutions would be sufficient?
– guy
Nov 28 '17 at 0:51
why you want to share root access? give the user sudo access so that he can only do what he required to do
– Sharuzzaman Ahmat Raslan
Nov 28 '17 at 1:34
1
ahhhh....yes, why would you think not?
– mdpc
Nov 28 '17 at 1:44
@mdpc Yes I need to redo everything and all is lost?
– guy
Nov 28 '17 at 1:50
He can encrypt your whole data including rootfs.
– Ipor Sircer
Nov 28 '17 at 0:48
He can encrypt your whole data including rootfs.
– Ipor Sircer
Nov 28 '17 at 0:48
@IporSircer So neither of my solutions would be sufficient?
– guy
Nov 28 '17 at 0:51
@IporSircer So neither of my solutions would be sufficient?
– guy
Nov 28 '17 at 0:51
why you want to share root access? give the user sudo access so that he can only do what he required to do
– Sharuzzaman Ahmat Raslan
Nov 28 '17 at 1:34
why you want to share root access? give the user sudo access so that he can only do what he required to do
– Sharuzzaman Ahmat Raslan
Nov 28 '17 at 1:34
1
1
ahhhh....yes, why would you think not?
– mdpc
Nov 28 '17 at 1:44
ahhhh....yes, why would you think not?
– mdpc
Nov 28 '17 at 1:44
@mdpc Yes I need to redo everything and all is lost?
– guy
Nov 28 '17 at 1:50
@mdpc Yes I need to redo everything and all is lost?
– guy
Nov 28 '17 at 1:50
 |Â
show 1 more comment
1 Answer
1
active
oldest
votes
up vote
3
down vote
accepted
On DigitalOcean you can login as root from the DO console (and you don't need to share the access to that). Otherwise you can also destroy the droplet and rebuild one from your non-DO-hosted backups (because you have these of course :)) or from the DO snapshots (if you paid for that), or a mix of the two (snapshots are done weekly)(*). If you have a domain you can also change the domain to point to a completely different machine.
Yes, in the general case, when you have been hacked the only way to have a complete trust in the system is to rebuild it from scratch, but then it also depends what you use it for, how critical it is and who hacked you. The hostage taker is a rather "benign" case because he does everything in plain sight. The real baddie is the one who hacks your system and uses it for his own purposes behind you back.
(*) of course all this assumes that you keep the backups of the past days/weeks, otherwise your only backup will be the encrypted version...
answered Nov 28 '17 at 1:51
xenoid
1,7151620
Related: serverfault.com/questions/218005/…
– Kusalananda
Nov 28 '17 at 7:28
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
3
down vote
accepted
On DigitalOcean you can login as root from the DO console (and you don't need to share the access to that). Otherwise you can also destroy the droplet and rebuild one from your non-DO-hosted backups (because you have these of course :)) or from the DO snapshots (if you paid for that), or a mix of the two (snapshots are done weekly)(*). If you have a domain you can also change the domain to point to a completely different machine.
Yes, in the general case, when you have been hacked the only way to have a complete trust in the system is to rebuild it from scratch, but then it also depends what you use it for, how critical it is and who hacked you. The hostage taker is a rather "benign" case because he does everything in plain sight. The real baddie is the one who hacks your system and uses it for his own purposes behind you back.
(*) of course all this assumes that you keep the backups of the past days/weeks, otherwise your only backup will be the encrypted version...
answered Nov 28 '17 at 1:51
xenoid
1,7151620
Related: serverfault.com/questions/218005/…
– Kusalananda
Nov 28 '17 at 7:28
add a comment |Â
up vote
3
down vote
accepted
On DigitalOcean you can login as root from the DO console (and you don't need to share the access to that). Otherwise you can also destroy the droplet and rebuild one from your non-DO-hosted backups (because you have these of course :)) or from the DO snapshots (if you paid for that), or a mix of the two (snapshots are done weekly)(*). If you have a domain you can also change the domain to point to a completely different machine.
Yes, in the general case, when you have been hacked the only way to have a complete trust in the system is to rebuild it from scratch, but then it also depends what you use it for, how critical it is and who hacked you. The hostage taker is a rather "benign" case because he does everything in plain sight. The real baddie is the one who hacks your system and uses it for his own purposes behind you back.
(*) of course all this assumes that you keep the backups of the past days/weeks, otherwise your only backup will be the encrypted version...
answered Nov 28 '17 at 1:51
xenoid
1,7151620
Related: serverfault.com/questions/218005/…
– Kusalananda
Nov 28 '17 at 7:28
add a comment |Â
up vote
3
down vote
accepted
up vote
3
down vote
accepted
On DigitalOcean you can login as root from the DO console (and you don't need to share the access to that). Otherwise you can also destroy the droplet and rebuild one from your non-DO-hosted backups (because you have these of course :)) or from the DO snapshots (if you paid for that), or a mix of the two (snapshots are done weekly)(*). If you have a domain you can also change the domain to point to a completely different machine.
Yes, in the general case, when you have been hacked the only way to have a complete trust in the system is to rebuild it from scratch, but then it also depends what you use it for, how critical it is and who hacked you. The hostage taker is a rather "benign" case because he does everything in plain sight. The real baddie is the one who hacks your system and uses it for his own purposes behind you back.
(*) of course all this assumes that you keep the backups of the past days/weeks, otherwise your only backup will be the encrypted version...
answered Nov 28 '17 at 1:51
xenoid
1,7151620
On DigitalOcean you can login as root from the DO console (and you don't need to share the access to that). Otherwise you can also destroy the droplet and rebuild one from your non-DO-hosted backups (because you have these of course :)) or from the DO snapshots (if you paid for that), or a mix of the two (snapshots are done weekly)(*). If you have a domain you can also change the domain to point to a completely different machine.
Yes, in the general case, when you have been hacked the only way to have a complete trust in the system is to rebuild it from scratch, but then it also depends what you use it for, how critical it is and who hacked you. The hostage taker is a rather "benign" case because he does everything in plain sight. The real baddie is the one who hacks your system and uses it for his own purposes behind you back.
(*) of course all this assumes that you keep the backups of the past days/weeks, otherwise your only backup will be the encrypted version...
answered Nov 28 '17 at 1:51
xenoid
1,7151620
edited Nov 28 '17 at 7:57
answered Nov 28 '17 at 1:51
xenoid
1,7151620
answered Nov 28 '17 at 1:51
xenoid
1,7151620
answered Nov 28 '17 at 1:51
xenoid
1,7151620
1,7151620
Related: serverfault.com/questions/218005/…
– Kusalananda
Nov 28 '17 at 7:28
add a comment |Â
Related: serverfault.com/questions/218005/…
– Kusalananda
Nov 28 '17 at 7:28
Related: serverfault.com/questions/218005/…
– Kusalananda
Nov 28 '17 at 7:28
Related: serverfault.com/questions/218005/…
– Kusalananda
Nov 28 '17 at 7:28
add a comment |Â
He can encrypt your whole data including rootfs.
– Ipor Sircer
Nov 28 '17 at 0:48
@IporSircer So neither of my solutions would be sufficient?
– guy
Nov 28 '17 at 0:51
why you want to share root access? give the user sudo access so that he can only do what he required to do
– Sharuzzaman Ahmat Raslan
Nov 28 '17 at 1:34
1
ahhhh....yes, why would you think not?
– mdpc
Nov 28 '17 at 1:44
@mdpc Yes I need to redo everything and all is lost?
– guy
Nov 28 '17 at 1:50