Hacker News Reader

Comment by dcc1 | Hacker News Reader

Well OVH do install backdoors on all the servers, its a surprise how many people dont know about it, here is how to remove it

echo "" > /root/.ssh/authorized_keys2 rm -rf /usr/local/rtm echo "" > /etc/crontab killall -9 rtm

more here > https://news.ycombinator.com/item?id=4839414

View on HN

Link to official documentation: http://help.ovh.co.uk/InstallOvhKey

This won't protect against OVH being compromised.

In the manager you can select the netboot / PXE option and "boot from rescue mode". From there you get e-mailed the logins from the server booted onto a Debian rescue image. You have full access to the OS / hard drives.

Regardless of whether the backdoor-building of theirs is documented, someone obtained unauthorized access to the machines, be it an employee or not. This means OVH really is compromised, even if they documented the installation of this backdoor.

I'm not entirely sure why they bothered with the root SSH key. If they really wanted they'd just pop open a serial console on the virtual machine wouldn't they?

At the serial console, you end up with a password prompt. It's also easier to just ssh over than to go over to the server and connect a serial cable.

a virtual serial cable.

Please don't go blowing away your entire /etc/crontab! In most cases it isn't even necessary.

As for their keys, they are locked down to a single IP address, so unless the attackers gained control over that IP the attackers wouldn't be able to access your machine using those keys even if they were compromised.

Reply on news.ycombinator.com