I recently started using a remote Ubuntu server for development and testing machine. However the hosting provider reported a crypto mining process was running and he had to shut down the server.
There were no logs or any data that could identify that process or anything that could help figure out what happened. Then it happened again, but this time they captured this:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
246369 redis 20 0 13928 11444 908 S 746.7 0.2 62801:13 /tmp/kmv --pool pool.hashvault.pro:80 --username TRTLv2TW8sjC5LmSpiDdRZ2ndnEwPRpJ9Lgz3vgGY2CTSLkLeKAUFMefEeT6idQBxzSLsXfAvAqfhH5zkxMM3sHu2RL8xh1n5Pg --password x --algorithm chukwa_v2
The only ports that are open are Redis port, 6379.
admin@nicotine2:~$ sudo ufw status
Status: active
To Action From
-- ------ ----
22 ALLOW Anywhere
9200 DENY Anywhere
6379/tcp ALLOW Anywhere
22 (v6) ALLOW Anywhere (v6)
9200 (v6) DENY Anywhere (v6)
6379/tcp (v6) ALLOW Anywhere (v6)
When I checked, there was no /tmp/kmv
folder anywhere to be found. This has happened for the 2nd time.
Any clues, recommendations or suggestions to avoid this?