"There is no cloud, it's just someone else's computer."

rdxx · November 19

Today, as I was performing my usual server maintenance, I ran ls and found two script files I didn't recognize. My first reaction was a server intrusion, but after checking the script contents, I thought it might be a joke from the hosting provider.

Neither of the two scripts had any malicious function. Script 'a' was responsible for installing qemu-guest-agent, and script 'b' was responsible for running script 'a' and then deleting both scripts 'a' and 'b'. However, they did not execute successfully.

My VPS's system in the control panel is listed as Debian, but it is actually running Arch Linux. I suspect that the hosting provider distributes installation scripts based on the system shown in the control panel. Since I didn't have apt installed on Arch, the script encountered an execution error and exited directly, which is why the two scripts were preserved.

#!/bin/bash
echo `date`: Recipe ID: -524;
sh /root/recipe_-524.sh > /root/recipe_-524.log 2>&1;
echo `date`: RET: $?;
rm -f /root/recipe_-524.sh;
rm -f /root/exec_recipe.sh

if [ -f /etc/debian_version ]; then
        OS=Ubuntu
elif [ -f /etc/redhat-release ]; then
        OS=redhat
elif [-f /etc/oracle-release ]; then
        OS=redhat
fi

if [ "$OS" = redhat  ] ; then
        systemctl status qemu-guest-agent
        if [ $? != 0 ] ; then
                yum  --skip-broken -y install qemu-guest-agent
        fi


elif [ "$OS" = Ubuntu  ] ; then
        systemctl status qemu-guest-agent
        if [ $? != 0 ] ; then
                apt-get clean -y 2>&1
                apt-get update -y 2>&1
                apt-get install -y qemu-guest-agent 2>&1
        fi

fi
systemctl enable qemu-guest-agent

        if [ "$OS" = redhat  ] ; then

                # Get the version of qemu-ga
                REL=$(qemu-ga -V | grep -oP "\d+\.\d+\.\d+")

                #path
                config=/etc/sysconfig/qemu-ga

                # Check if the version is 8.0.0 or higher
                if [[ "$REL" =~ ^(8|\d{2,})\.[0-9]+\.[0-9]+$ ]]; then

                        #taking backup of old file for safer side
                        cp /etc/sysconfig/qemu-ga /etc/sysconfig/qemu-ga.bk

                        #injecting the guest-exec and guest-exec-status command for enabling
                        sed -i '/^FILTER_RPC_ARGS="--allow-rpcs=/ s/"$/,guest-exec,guest-file-open,guest-file-read,guest-file-close,guest-exec-status"/' $config
                else
                        sed -c -i "s/\(BLACKLIST_RPC *= *\).*/\1guest\-file\-seek/" $config
                fi
        fi

REL=$(cat /etc/redhat-release)
rhel9="$(echo $REL | egrep -i '(release 9)')"
echo $rhel9
if [ "$?" -eq "0" ]; then
        config=/etc/sysconfig/qemu-ga
        sed -c -i "s/\(BLOCK_RPCS *= *\).*/\1guest\-file\-seek/" $config
fi

systemctl unmask qemu-guest-agent

systemctl restart qemu-guest-agent

angstrom · November 19

Okay

(Was there a question?)

root · November 19

@angstrom said:
Okay

(Was there a question?)

The title is not a question, it is a statement, because it ends with a dot.

tetech · November 19

@root said:

@angstrom said:
Okay

(Was there a question?)

The title is not a question, it is a statement, because it ends with a dot.

This is true. But the relevance of the statement to the body of the post is not entirely clear, nor is the purpose of the thread.

root · November 19

@tetech said:

@root said:

@angstrom said:
Okay

(Was there a question?)

The title is not a question, it is a statement, because it ends with a dot.

This is true. But the relevance of the statement to the body of the post is not entirely clear, nor is the purpose of the thread.

We might need an AI translation, because MJJ language is quite difficult to understand due to so many variations in interpretation.

Perplexity seems to offer a simple point of view. Hopefully I did not break some Cloudflare bot with my request.

The phrase "There is no cloud, it's just someone else's computer" highlights that cloud services rely on physical servers owned by others. In your case, while maintaining your VPS, you discovered two unfamiliar scripts which initially seemed like a security breach. After inspection, the scripts weren't harmful; one intended to install qemu-guest-agent and the other to run this installation then remove both scripts. However, they failed to run because your VPS actually operates on Arch Linux, despite being labeled as Debian in the control panel. The hosting provider likely pushes installation scripts based on the control panel's OS info, causing the apt-based script to fail on Arch, leaving the scripts intact without execution. This illustrates how cloud systems can sometimes have discrepancies due to provider configurations and assumptions about the environment.

tetech · November 19

You are pushing the frontier of AI capability.

AuroraZero · November 19

WTF? I am leaving for the big boys. This is above my pay grade.

teamacc · November 20

somik · November 20

While looking through my drawers, I found some loose coins.

Not sure why you need to know that, but I felt that I should share with you, just as you have with us.

terrorgen · November 20

@somik said:
While looking through my drawers, I found some loose coins.

Not sure why you need to know that, but I felt that I should share with you, just as you have with us.

Preserve it. It will be a relic pretty soon. /s

DrNutella · November 20

AI doesn’t always have a question

WSS · November 20

#dicks

AuroraZero · November 23

@WSS said:

#dicks

Penile enrichment?

cmeerw · November 23

@rdxx said:
Today, as I was performing my usual server maintenance, I ran ls and found two script files I didn't recognize. My first reaction was a server intrusion, but after checking the script contents, I thought it might be a joke from the hosting provider.

Neither of the two scripts had any malicious function. Script 'a' was responsible for installing qemu-guest-agent, and script 'b' was responsible for running script 'a' and then deleting both scripts 'a' and 'b'. However, they did not execute successfully.

My VPS's system in the control panel is listed as Debian, but it is actually running Arch Linux. I suspect that the hosting provider distributes installation scripts based on the system shown in the control panel. Since I didn't have apt installed on Arch, the script encountered an execution error and exited directly, which is why the two scripts were preserved.

I noticed the same thing recently. This is really disgusting practice and needs to stop - it's none of the hoster's business what software I want installed on my VPS and how I want it configured!

In my case, the hosting provider at least did disable some of that nonsense after I bitterly complained.

imok · November 23

Isn't the qemu-guest-agent service what enables graceful shutdowns and backup-friendly freezes?

Can it be used for something else?

cmeerw · November 23

@imok said:
Isn't the qemu-guest-agent service what enables graceful shutdowns and backup-friendly freezes?

normal ACPI should be sufficient to handle shutdowns

Can it be used for something else?

disk and RAM usage reporting (that's what Virtualizer seems to use it for)

but I guess it can be used to run anything on your VPS (as root)

xvps · November 23

guest-exec allows the hypervisor, or an attacker with control of the hypervisor’s management plane, to execute arbitrary commands directly on the VM as root.

guest-exec-status allows checking the status of those executed commands.

C2-style cleanup script like this is often used by hackers.

For a hacker, this is a way to ensure a robust, high-privilege, and network-firewall-bypassing backdoor, but it requires having control of the hypervisor’s management plane.

Any provider doing this behind your back should be sentenced to debugging PHP 5.6 sites for eternity.

Not_Oles · November 23

Does anyone know of a provider who shows information about their install images, where the images came from, how they were made, etc?

As most of us know, many providers let customers upload and install from the customers' own known images.

For example, a known-safe NetBSD image which I am using came from @cmeerw.

Alternatively, here is the link to the Debian Official Cloud Images: https://cdimage.debian.org/images/cloud/

Next time, please consider avoiding a one-click unknown image and using a known-safe image instead.

Part of the idea behind MetalVPS is to allow customized control of VPS setup, including image selection freedom, and even including qemu hypervisor setup and configuration.

imok · November 23

@xvps said: Any provider doing this behind your back should be sentenced to debugging PHP 5.6 sites for eternity.

That's savage.

rolanantonnee409 · November 24

Humans always like to give ordinary things new concepts, with the sole purpose of making others pay for them

Bidyut123 · November 24

@rolanantonnee409 said:
Humans always like to give ordinary things new concepts, with the sole purpose of making others pay for them

Damn

eliphas · November 24

@xvps said:
guest-exec allows the hypervisor, or an attacker with control of the hypervisor’s management plane, to execute arbitrary commands directly on the VM as root.

WTF just confirmed that qemu-ga in debian/ubuntu does allow anything by default. Adding it to my blacklist of packages.
On one place I really need it to run a pre-freeze command I am now adding the qemu-ga.conf as needed:

root@debian# cat /etc/qemu/qemu-ga.conf

[general]
#block-rpcs = guest-file-open,guest-file-close,guest-file-read,guest-file-write,guest-file-seek,guest-file-flush,guest-exec,guest-exec-status
allow-rpcs = guest-info,guest-shutdown,guest-ping

root@debian# qemu-ga -D
[general]
daemon=false
method=virtio-serial
path=/dev/virtio-ports/org.qemu.guest_agent.0
pidfile=/var/run/qemu-ga.pid
statedir=/var/run
verbose=false
retry-path=false
block-rpcs=
allow-rpcs=guest-ping,guest-shutdown,guest-info

WSS · November 24

@xvps said:
Any provider doing this behind your back should be sentenced to debugging PHP 5.6 sites for eternity.

Make them convert PHP3 scripts to not use global variables.

Better yet, PHP 4 scripts encoded with a third party encryption tool.

AuroraZero · 1:52PM

@WSS said:

@xvps said:
Any provider doing this behind your back should be sentenced to debugging PHP 5.6 sites for eternity.

Make them convert PHP3 scripts to not use global variables.

Better yet, PHP 4 scripts encoded with a third party encryption tool.

Better yet binary decoders for the Government.

"There is no cloud, it's just someone else's computer."

Comments

#dicks

#dicks