why I can't delete some users?, how to "clean VPS"?

wpeckham · 10-04-2021, 08:58 AM

Have you yet checked to see if the accounts you attempted to remove are still present?
When you have, please report which ones (if any) still exist.

Colombia · 10-04-2021, 03:11 PM

Quote:

Originally Posted by wpeckham

Have you yet checked to see if the accounts you attempted to remove are still present?
When you have, please report which ones (if any) still exist.

Thanks master.

First we run:

Code:

yum -y remove avahi-autoipd
userdel -r avahi-autoipd

yum -y remove postfix
userdel -r postfix

and finally we CHANGE COMMANDS and delete only this users

Code:

killall avahi-autoipd
killall centos
killall systemd-bus-proxy
killall tss
killall whbadmin
killall whbhelper

pkill -u avahi-autoipd
pkill -u centos
pkill -u systemd-bus-proxy
pkill -u tss
pkill -u whbadmin
pkill -u whbhelper

userdel -r centos
userdel -r whbadmin
userdel -r whbhelper

then finally we have 18 users and not 24 from ISP.

Also we delete: rm -f /root/.ssh/authorized_keys becouse ISP create with your template 3 passwords...

with this, I wait only access allowed for user ROOT.

Also we install CSF and ClamAV.

can you please giveme some other recomendation?

some software specialized in "detect when ANY USER connect by SSH" ???
CSF do that, but maybe others doit best.

Many thanks.

wpeckham · 10-04-2021, 07:03 PM

If you expect dictionary attacks, I suggest failtoban.

Colombia · 10-04-2021, 10:49 PM

[QUOTE=wpeckham;6288989]

Quote:

Originally Posted by wpeckham

If you expect dictionary attacks, I suggest failtoban.

thanks master,
in this VPS we run cPanel,
cPanel allways install fail2ban,
also we install CSF.

ondoho · 10-05-2021, 12:28 AM

Quote:

Originally Posted by shruggy

Cross-linking an f.c.o thread:
https://forums.centos.org/viewtopic.php?f=51&t=78208

Yeah, obvious cross-post.

Colombia, please don't do that. At least not without being proactively open about it. You call everyone "master", but this shows disrespect of our work.

Srsly, stop it with the "Master" already! It's creepy.

Generally and on-topic I have to say that your posts betray such deep ignorance of how a UNIX-like system works, you shouldn't be running a web server at all. It's a danger to the internet as a whole.

jmgibson1981 · 10-05-2021, 09:16 AM

Something I noticed, don't think was mentioned. Did you ever consider that these so called "spy" users are there in case you lock yourself out of the system? Then they can help you get back in? That can happen easily enough, more so when one doesn't fully understand what they are doing. If you delete their access to the system then you have totally screwed yourself I'd think. These system's are likely virtual machines (lxd containers maybe?) and it's not like they will take the time to live boot and chroot in to get you access back. They will just tell you to buy another one and start over I'd think. Think of them as a security feature rather than a spy user.

Colombia · 10-11-2021, 11:10 AM

Quote:

Originally Posted by ondoho

Yeah, obvious cross-post.

Colombia, please don't do that. At least not without being proactively open about it. You call everyone "master", but this shows disrespect of our work.

Srsly, stop it with the "Master" already! It's creepy.

Generally and on-topic I have to say that your posts betray such deep ignorance of how a UNIX-like system works, you shouldn't be running a web server at all. It's a danger to the internet as a whole.

in my country call "master" not is disrespect, I am sorry user @ondoho if is bad action from me.

>>> you shouldn't be running a web server at all
sure!, sir GURU.

Colombia · 10-11-2021, 11:11 AM

Quote:

Originally Posted by jmgibson1981

Something I noticed, don't think was mentioned. Did you ever consider that these so called "spy" users are there in case you lock yourself out of the system? Then they can help you get back in? That can happen easily enough, more so when one doesn't fully understand what they are doing. If you delete their access to the system then you have totally screwed yourself I'd think. These system's are likely virtual machines (lxd containers maybe?) and it's not like they will take the time to live boot and chroot in to get you access back. They will just tell you to buy another one and start over I'd think. Think of them as a security feature rather than a spy user.

Just that is the answer from ISP.

many thanks