Yesterday I installed Hestia 1.3.3 on a dedicated server running a fresh install of Ubuntu 20.0.4 and within a few hours of install of Hestia the IP was nullrouted by the DC 3 times. At the time I was completing the setup and then about to secure the server.
The DC suspects it is a NTP Reflection Attack.
Attack 1- 161 IP’s
UDP ports 0, 22
Attack 2 - 175 IP’s
UDP 63207, 11655, ICMP Port 3
Attack 3 - 211 Ip’s
UDP 63207, 11655
I reinstalled the server and no more attacks. Hestia is not installed again yet, those ports had not been opened up.
Check if your server is vulnerable
Log onto your server via SSH as the root user and enter the following command replacing yourserverip with the IP of your server.
ntpdc -n -c monlist yourserverip
For those who have not secured ntp there are instructions HERE to secure
Most likely you missunderstood the report from your datacenter but without reading it myself I can’t be 100% sure.
But from the terminology used in the original post, it looks like your server was target of a ddos coming from 500 hosts in form of a volumetric udp amplification attack. And in this case there is nothing you can do on your server to stop it, so the DC is forced to nullroute incoming traffic destined to your server ip.
Also there is nothing wrong in running NTP on Hestia (although it isn’t installed by default ) as the default firewall is not accepting traffic on UDP port 123
what does that even mean? incoming?outgoing?
why should that relate to ntpd (Port 123 and none of the above)?
did you install ubuntu from a template of the provider or via ISO?
sorry to say, but if you believe this to be an issue with HestiaCP then you might assume wrongly to be safe now.
as others pointed out even if you were to run ntpd, iptables is set to DROP everything by default and only allows a very small set of services. ntpd/123 udp is not part of that list (and never has been).
so unless something else opened these ports to send something out it much more likely is the case, that this ‘attack’ was incoming from whatever ‘enemy’. and while it probably never even reached your server the DC decided to nullroute the IP to not have to deal with the ddos on the level of your server/VM.
that’s totally normal on how provider without dedicated DDOS protection act on incoming attacks.
and for sure that is no vulnerability in anything. could be you just took over a IP from someone who ran a gameserver or voiceserver or whatever before and was a regular ddos target anyway.
TL;DR; uninstalling ntpd won’t change anything. running it on a normal hestia install without explicitly open the ports would still be safe.