I recently started using a remote Ubuntu server for development and testing machine. However the hosting provider reported a crypto mining process was running and he had to shut down the server.
There were no logs or any data that could identify that process or anything that could help figure out what happened. Then it happened again, but this time they captured this:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 246369 redis 20 0 13928 11444 908 S 746.7 0.2 62801:13 /tmp/kmv --pool pool.hashvault.pro:80 --username TRTLv2TW8sjC5LmSpiDdRZ2ndnEwPRpJ9Lgz3vgGY2CTSLkLeKAUFMefEeT6idQBxzSLsXfAvAqfhH5zkxMM3sHu2RL8xh1n5Pg --password x --algorithm chukwa_v2
The only ports that are open are Redis port, 6379.
admin@nicotine2:~$ sudo ufw status Status: active To Action From -- ------ ---- 22 ALLOW Anywhere 9200 DENY Anywhere 6379/tcp ALLOW Anywhere 22 (v6) ALLOW Anywhere (v6) 9200 (v6) DENY Anywhere (v6) 6379/tcp (v6) ALLOW Anywhere (v6)
When I checked, there was no
/tmp/kmv folder anywhere to be found. This has happened for the 2nd time.
Any clues, recommendations or suggestions to avoid this?