CQT

Now I was extremely worried!

Are you saying that aaPanel developers can access all content on installed servers?

    I can't say yet and I won't, but the lines make me think! First I want to have a statement from aaPanel_Jose, it can also be corpses, but why should one leave such corpses. In addition, we have not yet examined the entire script

      due to code is open on github we can invite pentesters to check vulnerabilities and tracking info i know few blackhat hackers i will invite them to do a pentest the web application

      CQT
      emmm, this is the file used when the database is initialized or the database is damaged. It will not be automatically called and needs to be executed manually.

      In addition, It is impossible for us to collect user login information. We take the privacy of each user very seriously

      The development of the shielding country function of the system firewall is nearing completion. Will be released soon~

          aaPanel_Jose

          thank you Jose for the answer.

          What about this line?

          <div class="copyright">Copyright © 2014-2099 <a href="http://www.bt.cn" target="_blank">{{data['lan']['BT']}}</a>{{data['lan']['PS1']}}(<a href="http://www.bt.cn" target="_blank">www.bt.cn</a>) All Rights Reserved</div>

          {{data ['lan'] ['BT']}} < / a> {{data ['lan'] ['PS1']}}

              CQT
              This is a front-end template for python, is there any problem?

                7 days later

                On some level, we need to find out why these servers are being attacked like this. I have one that I fired up today's ago, not shut down my OVH because of the non-stop attacks.

                So what are the footprints that are being targeted? Why are they going so hard after this panel. I had Virtualmin on this before this, no problem for years. Now with aapanel, in two days it gets shut down by my provider. I can't even get to it to move the websites. :-(
                https://www.screencast.com/t/RJKx0s31

                  I want to point out as well, people talk about Block at cloudflare etc, that only works against a domain, not an IP address. So if it's the IP and not the domain they are attacking, you are screwed.

                    gacott BWT, the footprint is NOT the port, because I change that right away.

                    • CQT likes this.

                      It's a shame, these sites and IPs have been up and working fine for years, now completely reached, can't even keep an IP up. Attacks from China, Hong Kong, and Africa. To the ip, so no way to stop them at cloud flare.

                      • CQT replied to this.
                      • CQT likes this.

                        aaPanel_Jose we have about 3800 attacks and 122 Ips in a week from which the attacks are carried out. it definitely has something to do with bt.cn. Before that, we also used Openscoure Panels and it was just about 20 or 30 attacks. Since we removed aaPanel and only ran it for the test, the whole thing has normalized again to about 30 attacks.

                          This only from yesterday until today 9:00 pm and today 8:40 am

                          Total banned26
                          Total failed18459
                          Currently banned25
                          Currently failed6

                          Attacks take place on Dovecot, Ostfix, FTP, and web server (NGINX). Although Fail2ban, SYS Firewall and some security measures are still active. Just like CDN etc. These are not normal scans, but definitive attacks on the panel. As already said, only on aaPanel. The modules are hosted at bt.cn and conclusions can be drawn about the IPS of the installed panels. We even took the IPs from other data centers so that these IPs could not be attacked explicitly. Even in other countries not Germany or Europe and yet only aaPanel web servers are attacked. I had the same thing in 2017 at http://centos-webpanel.com/ since the attacks came from Croatia, Russia, China and Serbia. We quickly deleted it and it calmed down again. Since then we have avoided this panel. In my opinion, the modules should be reloaded via a proxy server, as should the installation. We are currently testing this and are already seeing some serious differences. So you have to consider where the modules are stored, on which servers, should you switch your own proxy server between? !!! Here would be the solution to install a local proxy first and then load and install aaPanel.

                          gacott This is mostly done from China via VPN servers, hence from Africa