This category is for general issues(=something is broken) regarding YunoHost, NOT apps.
on
This form is written in English but feel free to write in French if you’re more comfortable!
on
What type of hardware are you using
Old laptop or computer
What YunoHost version are you running
12.1.40.1 stable
How are you able to access your server
The webadmin
Describe your issue
Hi. I was trying out Ghost and suddenly I noticed that my Internet connection was weird and, when I tried to get back to my Yunohost instance via my noho.st domain, it said that the connection was not private. I tried to access via SSH, but it said “Connection refused”. Then I accessed via IP address and in Tools > Firewall I saw that there was some SSH connections with other numbers turned on (I had changed from the default SSH number, but those numbers where new). Whenever I tried to close them, they were immediately open again.
I changed my root password, closed my SSH port in my router, uninstalled Ghost and rebooted, and it seems to be “controlled” right now. I can already access to my Yunohost instance through my noho.st domain, but some minutes ago, if I bypassed the security message, there was a page with the following text:
Welcome to your SWAG instance
A webserver and reverse proxy solution brought to you by [[REDACTED]] with php support and a built-in Certbot client.
We have an article on how to use swag here: [[REDACTED]]
For help and support, please visit: [[REDACTED]]
Should I take any more steps to ensure the security of my server? Can I turn on SSH again, maybe in a different port?
Thank you so much.
EDIT: I’m seeing the malicious webpage again instead of my Yunohost instance.
EDIT2: Sorry, panic caused by browser cache. No malicious webpage.
You should check ssh logs
Can you share the install log of ghost?
The app is run using a restricted system user. So it won’t be possible for a compromised app to get root access unless privilge escalation bug. You are already on the latest version of yunohost, there have been a lot of serious vulnerabilities related to Linux kernel some months ago [CVE-2026-43284 "Dirty Frag"] Upgrade your system packages
Now you can run malware scanners on your server
Do not open your ssh port outside.
Also, run yunohost tools regen-conf --dry-run --with-diff to see if any config files have been altered.
Firstly, I’m aware of those vulnerabilities; I updated the system when and rebooted to make sure the new versions where installed. I always try to keep my system and apps up to date.
Secondly, I’m doing everything you’ve told me with an external monitor attached to the PC, so I have some of the relevant outputs in photos… Sorry, I didn’t know any better way How do I send them to you? I don’t know if it’s permitted to upload pictures to the forum.
Regarding chkrootkit, nothing came out as “infected”, but there were 2 warnings:
Warning 1
WARNING: The following suspicious files and directories were found: /usr/lib/python3/dist-packages/tldextract/.tld_set_snapshot /usr/lib/python3/dist-packages/tldextract/.suffix_cache /usr/lib/python3/dist-packages/numpy/core/include/numpy/.doxyfile /usr/lib/python3/dist-packages/numpy/f2py/tests/src/f2cmap/.f2py_f2cmap /usr/lib/python3/dist-packages/numpy/f2py/tests/src/assumed_shape/.f2py_f2cmap /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/noentry/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/file/.htaccess /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_time/.htaccess /usr/lib/llvm-14/build/utils/lit/tests/Inputs/reorder/.lit_test_times.txt /usr/lib/llvm-14/build/utils/lit/tests/.coveragerc
Warning 2
WARNING: Output from ifpromisc: lo: not promisc and no packet sniffer sockets enp0s31f6: not promisc and no packet sniffer sockets
I can’t retrieve the SSH logs nor the Ghost install ones from the administration page, but if you tell me how to get them with the terminal, I will.
Hi again. I managed to access via SSH without opening ports outside. I didn’t know it was possible. I’ve run everything you told me and I think there’s nothing infected or anything like that. In the meantime I also followed this tutorial in order to be able to access my server without opening ports. Is it OK to keep up like this without doing anything more?
How do I send them to you? I don’t know if it’s permitted to upload pictures to the forum.