I think my nas is infected with a cryptocurrency virus

Zitat von aguti76

What do you recommend me to do?

Do a new installation.

You could try to clean it, possibly on Google you will find ways to do it. But... I wouldn't trust a system that has been hacked at all.

In fact, you should review the services you share on the Internet and your security measures so that it doesn't happen to you again. Additionally, it may be advisable to scan your data in some way to ensure that there is nothing harmful.

Zitat von aguti76

I changed config.ini file name and the script doesnt work anymore.

If you're comfortable with that, go ahead. Luck. I still think you should do a fresh install.

Any idea how you got infected? Container or manually installed packages from suspicious sources?

Zitat von chente

In fact, you should review the services you share on the Internet and your security measures so that it doesn't happen to you again. Additionally, it may be advisable to scan your data in some way to ensure that there is nothing harmful.

Absolutely this

Zitat von aguti76

You gave us a list of containers, are those accessible from the Internet (ie, outside your Network?) If so, how did you setup access to them?

Zitat von BernH

Correct me if I'm wrong, but if the /opt/systemessentials/ directory is the one on the os drive, a docker container that is set up correctly should not be able to access the /opt directory, since the idea of docker is to keep the services isolated from the OS as much as possible.

That said, you should also look at the compose files you used to deploy those docker containers and ensure none of them have the /opt directory mapped to them. If you find one that does the mining script may have been injected through that container/service.

You should also consider a change of your root password as well as user passwords, since root or sudo access would likely be required to let that infection get installed and configured to auto-run.

I'm wondering if this is a result of users (unprivileged) being put in the docker group. It's been demonstrated on this forum why this is a bad idea, but I know many of the tutorials say to create a docker user and put said user in the docker group... Read posts 94-101 below. Zoki demonstrated to me how he could delete my root partition with an unprivileged user who was in the docker group. Note to anyone who wants to try this: It absolutely works. Do not do this on a running system or you will wreck your OS drive. I done this on a VM.

Thema

I have a domain name, do I need to do anything special at setup?

I own a domain from cloudflare, and I'm going to point it to my server through NGINX and some sort or SSL so I can have https. (off topic, but please point me to a tutorial, guide, or thread about this, maybe SWAG? :))

When I first install and I have to type in the name for the server, and the hostname or whatever (usually .local), do I need to put my domain in at some point? Or will all of that be done with NGINX and cloudflare?

Chipwingg

11. Mai 2022

I would assume by the same token, you could execute malicious code in the same way.

Zitat von aguti76

I only have those

Why are you sure it was containers in portainer (Your response to votdev made it seem like that's what you suspected)... so you were asked which one, and you provided a list of containers. That's what he meant about providing a list not being helpful, as he was under the impression (as was I) that you suspected a docker container caused this, but didn't bother telling us which one.

I think there's a language barrier/misunderstanding here.