Добрый день!
Столкнулся с проблемой, созданные дроплеты на DO, спустя несколько дней блочат.
Есть подозрения, что дроплеты изначально поставляются с некой дырой/бекдором, которым активно пользуются?
Сопровождается это письмом счатья:
Networking disabled
Hi there,
We are sorry to report that we have detected what appears to be a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users.
To prevent this traffic from causing further disruption, we have disabled the networking interface on the server or servers involved. In order to correct the issue, here is the direct link to the console of the affected droplet
Please take action at your earliest convenience in order to investigate and resolve the situation. Once this is done, if you determine the program was malicious, please also determine how this software came to be installed on your droplet and prevent it from being installed again in the future. As soon as this is done let us know and we will investigate re-enabling your networking.
If you need any guidance on how to find and resolve this issue, we recommend reviewing this:
https://www.digitalocean.com/community/tutorials/h...
Please understand that this is a very serious issue as it negatively impacts our platform and your server. If you have any questions just let us know.
Thank you,
DigitalOcean Support
Буду признателен за разъяснения такой ситуации, и возможно полезную практики как себя обезопасить?
Так же, будет ли достаточно настройки fail2ban и доступа по ssh исключительно по ключам?
UPD:
На дроплетах крутится Node.js + MongoDB в репликасете
Порты использует Монга и Нода
UPD2:
Да используется Redis, конфиги дефолтные. проверяю этот грешок
