Asklemmy

I have a small PC I use for exposing a private PC to the wider web via nginx proxy. It had two accounts on it: mine, and one I called "remote" with some basic password I set up to forward the proxy connection.

One day, this machine started making 100% CPU noises, for several hours. Wtf? I check the processes and a Tor node had been setup and was transmitting gigabytes to some Russian IP.

My brain goes into panic mode, I kill the process, wipe the remote user, and eventually pull the Ethernet plug.

I wish I hadn't wiped the user directory as I wanted to know what was being sent and where. Nonetheless the logs showed that several Russian IPs had been attempting an SSH brute force for literally months and one finally guessed "remote" and weak password I set for it.

I have decades of experience on Unix system, and I cringe having made such a rookie mistake.

Lesson learned: change the default SSH port to a transient port, have one dedicated SSH user with a non-standard username, and use auth-key entry only.

I still wonder what was being sent over that Tor node, and why it required all the CPU cores. My best guess is crypto mining, or it was used for a DDOS attack net somewhere.