Re: [PLUG] Malware Webshell Infection. - Advice Needed

[Rich Freeman via plug <plug@lists.phillylinux.org>]

On Mon, Sep 4, 2023 at 1:32 PM David Collins via plug
<plug@lists.phillylinux.org> wrote:
>
> Public key authentication is still a form of authentication. You’re correct that it’s using your private key to authenticate (matched with the public key on the server) in place of a password. This is, in general, a stronger form of authentication than using a password. It also has other advantages such as not storing a server-side hash of the credential being used to authenticate.
>
> The email you received says “rsync without authentication”. If that email is correct, that means without public key authentication as well.

Yeah, the public key part of it isn't the problem.  Most likely there
is a misconfiguration in rsync that lets people connect without any
authentication.

> You may want to contact the email author and see what exactly they meant. Either they are not correct or there is some other way to access your rsync daemon without any authentication.
>

Judging by the wording of the email, I'm guessing they won't be
offering free advice. Really it was nice of them to even point out the
problem.

If you don't understand how to deal with something like this, you
might consider retaining professional help.  I wouldn't necessarily
just buy that from the random company that emailed you without doing a
little research.  There are lots of companies/individuals who would
probably sell you their services.  I'm not sure if this is for a
business.

If all you need is a simple website and you're not sure how to secure
stuff like this, it might not hurt to just go with a more
consumer-oriented hosting service.  Most of those block you from being
able to shoot yourself in the foot too badly, but of course they also
won't offer as many services for as low a price, since their business
model is to protect you from yourself, and letting you do whatever you
want defeats that.

--
Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug