This morning I got two emails from Linode, this one:
We're currently receiving a large number of UDP packets coming from your machine:
01:33:33.136745 70.85.129.118 > 24.110.229.206: udp (frag 57902:1480@1480+)
01:33:33.136871 70.85.129.118 > 24.110.229.206: udp (frag 57902:1480@2960+)
01:33:33.136873 70.85.129.118 > 24.110.229.206: udp (frag 57902:1480@4440+)
I've blocked the offending traffic for now. Please reply within 48 hours to avoid service interruption.
and this one:
More DoS traffic:
03:30:42.548612 70.85.129.118 > 194.146.152.98 : udp (frag 56782:1480@2960+)
03:30:42.548617 70.85.129.118 > 194.146.152.98 : udp (frag 56782:1480@4440+)
03:30:42.548874 70.85.129.118 > 194.146.152.98 : udp (frag 56782:1480@7400+)
Your Linode's networking has been disabled.
So my Linodes network access was gone and the site was down. I could log in through the lish console and this showed two tasks called 'bashex' owned by the www-data user i.e. apache taking most of the cpu time. I guess someone had hacked in and were up to no good.
Well, I have been pondering what to do about the Linode, in one way I love it but in another way I am not getting the uptime I would like. Ok, this security breech is MY problem, I didn't secure the server properly but then again, I don't want to spend my valuble spare time securing servers, I have more interesting things to do. Together with silly power problems in their racks, I have had more downtime in a month with Linode that I have in 10 or so months with Site5.
I don't know how long it would take me to secure the linode now it has been breeched, I would want only feel it was clean if I reinstalled everything, and then I would have to go into adding extra security.
I decided instead that no, Linode is not for me, I'll go back to Site5. There are a number of reasons for this:
-
someone else does system admin and worries about backups and security and this is included in the price.
-
I can afford a top-of-the-line shared hosting package for less than a bottom-of-the-line linode. This gives me, for example, four times as much disk space.
-
Site5 have many tech support people ready 24 hours a day and pride themselves on 15 minute response times. Linode only appear to have 'caker' who is good at his job but presumably needs to sleep.
Disadvantages:
-
I am not root, I am not free to install what I like.
-
The python on the site5 server is version 2.2 which is too old to be useful to me.
-
I cannot run any long-lived processes such as a python-based web server.
-
It is not as cool
As my networking had been disconnected, my only access to the linode was via the lish console. I got all my data from my web sites off it as follows:
-
cd /var/www
-
mysqldump -u -p >petersblog.sql
-
tar xvvzf www.tar.gz * .htaccess
-
uuencode www.tar.gz www.tag.gz
This dumped the tar file as Ascii. By logging all console output to a log file I captured it all on my local pc. I uploaded it to site5 and
-
uudecode putty.log
-
tar xvfz www.tar.gz
-
reload sql and away
-
make sure drupal is up to latest version (once bitten...)
I had to change dns servers again and that took a few hours to propogate but this posting was done on Site5.
Now to tell Linode the bad news...