I need help with mounting drives (OMV hacked ransomware new install)

1st Official Post

    My OMV got hacked ransomware all files encrypted.

    I'm trying to do a new install OMV. The hard drives show up as raid 10 (this is what I want). But I cant wipe them, the quick wipe does not work, and the long one goes to 99 percent then fails. I cant create a file they do not show up. Maybe i need to do this command line not sure I'm no expert need help.

    tnx

    I have no help for your problem, but I am curious to know what services you had exposed to the internet that allowed you to be attacked.

    --
    Google is your friend and Bob's your uncle!


    A backup strategy is worthless unless you have a verified to work by testing restore strategy.


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    • Official Post
    Quote from perkunas

    The hard drives show up as raid 10 (this is what I want). But I cant wipe them, the quick wipe does not work, and the long one goes to 99 percent then fails. I cant create a file they do not show up. Maybe i need to do this command line not sure I'm no expert need help.

    I would delete the array and then quick wipe each disk in the array. Then recreate the array.

    omv 7.7.0-2 sandworm | 64 bit | 6.11 proxmox kernel

    plugins :: omvextrasorg 7.0.1 | kvm 7.0.17 | compose 7.3.4 | cputemp 7.0.2 | mergerfs 7.0.5 | scripts 7.0.9


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

    Like 1
    • Official Post

    Why are you using snapraid with mdadm raid? What is the output of: cat /proc/mdstat

    omv 7.7.0-2 sandworm | 64 bit | 6.11 proxmox kernel

    plugins :: omvextrasorg 7.0.1 | kvm 7.0.17 | compose 7.3.4 | cputemp 7.0.2 | mergerfs 7.0.5 | scripts 7.0.9


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

    It still in raid, yet snapraid shows nothing no drives no array nothing.

    Under disks the quick format wont work and the secure one fails at 99 percent.

    This cant be that hard.



    root@NAS:~# NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS

    sda 8:0 0 238.5G 0 disk

    ├─sda1 8:1 0 237.5G 0 part /

    ├─sda2 8:2 0 1K 0 part

    └─sda5 8:5 0 976M 0 part [SWAP]

    sdb 8:16 0 5.5T 0 disk

    └─md127 9:127 0 10.9T 0 raid10

    sdc 8:32 0 5.5T 0 disk

    └─md127 9:127 0 10.9T 0 raid10

    sdd 8:48 0 5.5T 0 disk

    └─md127 9:127 0 10.9T 0 raid10

    sde 8:64 0 5.5T 0 disk

    └─md127 9:127 0 10.9T 0 raid10

    root@NAS:~#

    root@NAS:~# cat /proc/mdstat

    Personalities : [raid10] [linear] [multipath] [raid0] [raid1] [raid6] [raid5] [raid4]

    md127 : active (auto-read-only) raid10 sdc[3] sdd[0] sde[2] sdb[1]

    11720780800 blocks super 1.2 512K chunks 2 near-copies [4/4] [UUUU]

    bitmap: 0/88 pages [0KB], 65536KB chunk


    unused devices: <none>

    root@NAS:~#



    Not sure what this means...

    • Official Post
    Quote from perkunas

    Not sure what this means...

    Post the output of:

    sudo mdadm --readwrite /dev/md127

    sudo wipefs /dev/md127


    And you still didn't say why you are using snapraid.

    omv 7.7.0-2 sandworm | 64 bit | 6.11 proxmox kernel

    plugins :: omvextrasorg 7.0.1 | kvm 7.0.17 | compose 7.3.4 | cputemp 7.0.2 | mergerfs 7.0.5 | scripts 7.0.9


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

    I will post the output in a second. The original raid was made in snapraid, and the mdadm raid i don't understand where is it or how to use it.

    root@NAS:~# sudo mdadm --readwrite /dev/md127

    root@NAS:~# sudo wipefs /dev/md127

    DEVICE OFFSET TYPE UUID LABEL

    md127 0x438 ext4 8f16d950-088e-4e9c-a258-15b6abb919d6

    root@NAS:~#

    • Official Post
    Quote from perkunas

    The original raid was made in snapraid, and the mdadm raid i don't understand where is it or how to use it.

    snapraid and md raid are VERY different. you have md raid. Which do you want?

    omv 7.7.0-2 sandworm | 64 bit | 6.11 proxmox kernel

    plugins :: omvextrasorg 7.0.1 | kvm 7.0.17 | compose 7.3.4 | cputemp 7.0.2 | mergerfs 7.0.5 | scripts 7.0.9


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

    • Official Post
    Quote from perkunas

    have no Idea what this is, it could be the raid.

    Yes, there is a raid 10 array with an ext4 filesystem on it. You aren't answering my other questions so I don't know what you are trying to do. You should be able to mount the filesystem and do what you want.

    omv 7.7.0-2 sandworm | 64 bit | 6.11 proxmox kernel

    plugins :: omvextrasorg 7.0.1 | kvm 7.0.17 | compose 7.3.4 | cputemp 7.0.2 | mergerfs 7.0.5 | scripts 7.0.9


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

    I don't care what raid to use, I just need it working with your help of course. I owe you a beer.

    I wanted to format the raid it is old and was hacked (ransomware)

    Ok I feel dumb now the Multiple Device was not there, after a refresh its now there and it says raid 10. I still owe you the beer though.

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login