How to stop webhost frome entering vps without permission?

[AlphaNine_Vini]

The administrator who have the access over a physical server is verified by web hosting companies. There is no way you can stop them to access your Openvz VPS. Just in case you have issues on your VPS. The administrator can help you to resolve the issue from the backend. Many a times customer damage there SSH config or network config. Then a adminstrator can resolve the issue from backend.

 

[Francisco]

This above all else. If you flip the coin and look at it from the providers point of view; what are you doing on/with your VM that makes you want to hide from me (the provider) so badly? Will the police be knocking on my door and at the DC's door simultaneously wanting to confiscate equipment?

Then they knock.

To date we've had a half dozen in-person visits from the RCMP, 4 visits to a DC and, & multiple talks with FBI agents. One chat got extremely heated since they were being unreasonable in their demands but they finally backed down and were far more co-operative.

Up until it has been proven that the customer in question has broken federal laws, it's your due diligence to protect them to the best of your ability, as well as your other clients. Even once proof is provided (or a court order is issued so it becomes irreverent), you should still understand what's a reasonable request and what isn't.

They require the details you have on file for the client, transactions, etc? OK. They want a copy of your whole billing database? Not OK.

They want a snapshot of the VPS/etc in question? OK. They want to snapshot the whole box? Generally not OK.

For us we have a public record for being hard asses on people about client details but it's because we do stick our necks out and protect our users. I'm not going to be very happy if i'm sticking my neck out for 'Aa Zz' and his supposed CP ring with a side of botnet.

Francisco

 

[vRozenSch00n]

Up until it has been proven that the customer in question has broken federal laws, it's your due diligence to protect them to the best of your ability, as well as your other clients. Even once proof is provided (or a court order is issued so it becomes irreverent), you should still understand what's a reasonable request and what isn't.

Given that, by all means Fran, you may browse my container anytime you like without having to have my permission

 

[drmike]

To be fair, I'm sure your host has better things to do then vzctl into your container to look at your wordpress files, or beyond that dig through memory. Prying eyes will always be in the back of your mind, but I'm sure your host has better things to do. If not, then you should reconsider what kind of hosts you sign up with.

I am not an admin.  I have however helped a bunch of companies in the VPS spectrum and been exposed to shoddy biz practices many of they engage in.

I have seen staff in multiple lowend companies wholesale rifling through containers and peeking at folks stuff.

The basis for such?  Shady.  Oh the container is using resources, using disk space, etc.  Really most of the time, bullshit boredom rummaging.

Some of the rifling would start based on a process that would show up in entire service monitoring.  Maybe they see rtorrent running, while the provider in fact allows such.

It's all this sort of behavior that is VERY RAMPANT among the lowend VPS companies that has soured me to using VPS services in general.  I am down to a handful of accounts with what I deem trustworthy companies.

 

[drmike]

Then they knock.


To date we've had a half dozen in-person visits from the RCMP, 4 visits to a DC and, & multiple talks with FBI agents. One chat got extremely heated since they were being unreasonable in their demands but they finally backed down and were far more co-operative.


Up until it has been proven that the customer in question has broken federal laws, it's your due diligence to protect them to the best of your ability, as well as your other clients. Even once proof is provided (or a court order is issued so it becomes irreverent), you should still understand what's a reasonable request and what isn't.


They require the details you have on file for the client, transactions, etc? OK. They want a copy of your whole billing database? Not OK.


They want a snapshot of the VPS/etc in question? OK. They want to snapshot the whole box? Generally not OK.

And ... ^ THIS IS WHY I RECOMMEND BUYVM.  They are the real deal and do the right thing all said.

 

[DomainBop]

This above all else. If you flip the coin and look at it from the providers point of view; what are you doing on/with your VM that makes you want to hide from me (the provider) so badly? Will the police be knocking on my door and at the DC's door simultaneously wanting to confiscate equipment?

I'm assuming that providers who don't understand why some customers (e.g. a business customer) don't want the provider to access their data probably have a customer base that is primarily comprised of hobbyists, illegal torrenters, VPN users, skids,  and other low paying customers (and I'm also assuming that the provider probably draws a blank when things like PCI compliance are mentioned).  If the hosting provider's customer is a business then "what they are trying to hide" from the prying eyes of the provider and his staff is more than likely their sensitive business information, their business's customers records/info, etc.

The proliferation of hosting providers who put a low value on a customer's need for data privacy and security is the reason why businesses who are really concerned about data privacy should ask prospective virtualization providers the following set of questions (in particular, the ones in the "privacy and access to data" , "legal process"  and "connecting to the service" sections) before they entrust their data to the provider. > questions to ask your provider (and yes, I've linked to these questions before when the subject of data privacy and hosting provider policies on accessing customer data came up)

 

[vRozenSch00n]

This might be strange, but when I choose a service I tend to look who's who behind that. 

To me it is important as I know any provider could easily access my containers, leak my personal Information, CC, etc., therefore I appreciate certain qualities from my providers.

Trust - Not simply blind trust of a desert dweller to his leader, but more to how they run their services as well as handling and protecting my data.

Helpfulness - Most of my services are unsupported. Some providers simply ignore my tickets, some who also offer managed services reply and explain that my request is not included in my package, some are willing to help then or at least they point me to the right direction i.e. "O.K. we'll help you this once, but please read this tutorial in our Knowledge Base or at this url" or "Your service is not supported, but you can read tutorials in our Knowledge Base or at this url".

Openness - some providers hide incident that happened to their gear or network, some openly inform customers of what happened and provide some directives of what customer should do in such situation, and keep the customers up to date.

Common Sense - related to TOS/AUP & incident. i.e. some ignorant customers uses unsafe application, got hacked and sending DDoS attak or unsolicited email. Some providers directly terminate the service, but some are willing to help the customer pointing them into the right direction and mark the specific customer to know whether the incident is on purpose or simply out of customer ignorance. At this point providers have full right to probe what is in customer's container using automated means or manually.

 

[KuJoe]

Then they knock.

But sometimes they don't knock. While we've been lucky to not have experienced this first hand, I've also been lucky enough to be privy to some details of data centers that get regular visits from multiple agencies sometimes weekly. The staff say that most of the time it's just a drive pull or a network port mirror, but on some occasions they just pull the power and walk out with the whole server based on a single IP on the server (and the client won't know why it was taken until days or weeks later). Most of the time the techs are told to blame hardware failure until a lawyer tells them otherwise as to not tip off the users.

 

[Aldryic C'boas]

But sometimes they don't knock. While we've been lucky to not have experienced this first hand, I've also been lucky enough to be privy to some details of data centers that get regular visits from multiple agencies sometimes weekly. The staff say that most of the time it's just a drive pull or a network port mirror, but on some occasions they just pull the power and walk out with the whole server based on a single IP on the server (and the client won't know why it was taken until days or weeks later). Most of the time the techs are told to blame hardware failure until a lawyer tells them otherwise as to not tip off the users.

And this is why I will recommend FiberHub to anyone needing colocation/etc.  Rob absolutely won't tolerate that kind of theft - even when the feds have paperwork, if there's so much as a single typo he'll send them packing.  I can't begin to describe how nice it is to not be constantly stressed over the security of our gear there, especially compared to some of our prior upstreams.

 

[Francisco]

But sometimes they don't knock. While we've been lucky to not have experienced this first hand, I've also been lucky enough to be privy to some details of data centers that get regular visits from multiple agencies sometimes weekly. The staff say that most of the time it's just a drive pull or a network port mirror, but on some occasions they just pull the power and walk out with the whole server based on a single IP on the server (and the client won't know why it was taken until days or weeks later). Most of the time the techs are told to blame hardware failure until a lawyer tells them otherwise as to not tip off the users.

Then that means you need to find a new datacenter that does their due diligence by you. The feds don't just have the badges to the datacenter floor to just walk off with gear. Every datacenter that wasn't run by a conartist that we've been with has always called us when there's a visit. Fiberhub, EGIHosting, etc, have all called me when there's people for me to talk to.

At this point I'd like to think that we're earning ourselves a reputation with the federal agencies of not screwing around when they do right by us. Do you think they want to be stuck in an extremely sketchy situation where there could be Canadian Federal data on that equipment? Health records? Christ, that'd be asking for badges right there.

Just like everyone tells the LE penny pinchers: When picking a host, know how they will react when the shit hits the fan because that's when the company shows their true knowledge, skill, & dedication. This applies just as much to node outages as it does (un)lawful visits.

Francisco

 

[IntegralHost]

I read that it is easy to enter vps without permission with openvz if you are the host. Is there anyway to stop this so they must ask first?

It wont possible with OpenVZ. You may choose Hyper-V vps, there host cant access customer server without correct password.

 

[serverian]

L. E. Pennypincher

Sounds like a real name!