Bare Metal - Anti-hack information #9225
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| --- | ||
| title: Anti-hack information - Dedicated Server and VPS | ||
| excerpt: Find out what information will be visible and provided when OVHcloud's internal Anti-DDoS protection is triggered | ||
| updated: 2026-XX-XX | ||
| --- | ||
|
|
||
| **Learn what information will be visible and provided when OVHcloud's internal Anti-DDoS protection is triggered on behalf of your Dedicated Server or VPS.** | ||
Jessica41 marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| ## Requirements | ||
|
|
||
| - a Dedicated Server or VPS that has been hacked | ||
| - access to the [OVHcloud Control Panel](/links/manager) | ||
|
|
||
| ## Anti-Hack information | ||
|
|
||
| ### **Dedicated Server** | ||
|
|
||
| When Anti-DDoS protection is triggered on your Dedicated Server, you will see a message in the [OVHcloud Control Panel](/links/manager): "*Your server has been hacked. Please contact our support team for instructions on what to do next.*" | ||
Jessica41 marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| Your server can be booted in rescue, which will allow a restart or the reinstallation of the operating system. Below are the boot options for your server: | ||
Jessica41 marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
Jessica41 marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| | Name | Function | Status | | ||
| | ------ | --------- | ----------- | | ||
Jessica41 marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| | Rescue | Will allow a restart or the reinstallation of the operating system. | Hacked | | ||
| | Rescue FTP | Will allow a restart or the reinstallation of the operating system. | Hacked | | ||
Jessica41 marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| | rescue12-ftp - FTP rescue system for anti-hack | Will **not** allow a restart or the reinstallation of the operating system. | Hacked and blocked | | ||
Jessica41 marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| {.thumbnail} | ||
|
|
||
| OVHcloud will also open a support ticket on your behalf containing the following: | ||
|
There was a problem hiding this comment. The "reboot into rescue-ftp" is not systematic. The server may also be rebooted in rescue12-customer. Does it need to be specified or can we leave documentation as-is, being not extremely precise? |
||
|
|
||
| > | ||
| > Dear Customer, | ||
| > | ||
| > As your server nsXXXXXXX.ip-XXX-XXX-XXX.eu is presenting too great a threat to our network, | ||
| we had no choice but to place it in 'rescue FTP' mode. An email | ||
| containing a username and password has been sent to you so that you can | ||
| easily retrieve any data still located in the storage space. | ||
| > | ||
| > Please do not hesitate to contact our technical support so that this | ||
| situation does not become critical. | ||
| > | ||
| > You can find the logs brought up by our system below which led to this alert. | ||
| > | ||
| > - START OF ADDITIONAL INFORMATION - | ||
| > | ||
| > <Attack Details> | ||
| > | ||
| > - END OF ADDITIONAL INFORMATION - | ||
| > | ||
| > Kind regards, | ||
| > | ||
| > OVHcloud Customer Support | ||
| > The OVHcloud Team | ||
|
|
||
| ### **VPS** | ||
|
|
||
| When Anti-DDoS protection is triggered on your VPS, your VPS will be placed in rescue mode. | ||
|
|
||
| {.thumbnail} | ||
|
|
||
| OVHcloud will also open a support ticket on your behalf containing the following: | ||
|
|
||
| > Dear Customer, | ||
| > | ||
| > Abnormal activity has been detected on your VPS vps-XXXXXXXX.vps.ovh.net. | ||
| > | ||
| > Your VPS has been placed in rescue mode. This is so that you can intervene | ||
| on your VPS to resolve the issues flagged up. An email containing information on rescue mode has been sent to you. | ||
| > | ||
| > Actions can no longer be carried out on your VPS via your Manager/API. Only the following actions are possible: | ||
| > | ||
| > - Reinstallation of your VPS. | ||
| > - Use of rescue mode to resolve the problems flagged. | ||
| > | ||
| > Once the issues have been resolved, please contact our technical support to get it restored to normal mode. | ||
| > | ||
| > Please do not hesitate to contact our technical support team so that this situation does not become critical. | ||
| > | ||
| > You will find the logs brought up by our system below, which led to this alert. | ||
| > | ||
|
|
||
| > [!primary] | ||
| > **Please take note of the bottom part of the message stating:** "*Once the issues have been resolved, please contact our technical support to get it restored to normal mode. Please do not hesitate to contact our technical support team so that this situation does not become critical.*" | ||
| > | ||
|
|
||
| ## Go further | ||
|
|
||
| Join our [community of users](/links/community). | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| --- | ||
| title: Informations anti-hack - Serveur dédié et VPS | ||
| excerpt: Découvrez les informations visibles et fournies lorsque la protection Anti-DDoS interne d'OVHcloud est déclenchée | ||
| updated: 2026-XX-XX | ||
| --- | ||
|
|
||
| **Découvrez les informations visibles et fournies lorsque la protection Anti-DDoS interne d'OVHcloud est déclenchée pour votre Serveur dédié ou votre VPS.** | ||
|
|
||
| ## Prérequis | ||
|
|
||
| - un Serveur dédié ou un VPS ayant été compromis | ||
| - un accès à l'[espace client OVHcloud](/links/manager) | ||
|
|
||
| ## Informations anti-hack | ||
|
|
||
| ### **Serveur dédié** | ||
|
|
||
| Lorsque la protection Anti-DDoS est déclenchée sur votre Serveur dédié, un message s'affiche dans votre [espace client OVHcloud](/links/manager) : « *Votre serveur a été compromis. Veuillez contacter notre équipe d'assistance pour obtenir des instructions sur la marche à suivre.* » | ||
|
|
||
| Votre serveur peut être démarré en mode rescue, ce qui permettra un redémarrage ou la réinstallation du système d'exploitation. Voici les options de démarrage de votre serveur : | ||
|
|
||
| | Nom | Fonction | Statut | | ||
| | ------ | --------- | ----------- | | ||
| | Rescue | Permettra un redémarrage ou la réinstallation du système d'exploitation. | Compromis | | ||
| | Rescue FTP | Permettra un redémarrage ou la réinstallation du système d'exploitation. | Compromis | | ||
| | rescue12-ftp - FTP rescue system for anti-hack | Ne permettra **pas** un redémarrage ou la réinstallation du système d'exploitation. | Compromis et bloqué | | ||
|
|
||
| {.thumbnail} | ||
|
|
||
| OVHcloud ouvrira également un ticket de support en votre nom contenant les informations suivantes : | ||
|
|
||
| > | ||
| > Cher client, | ||
| > | ||
| > Votre serveur nsXXXXXXX.ip-XXX-XXX-XXX.eu représentant une menace trop importante pour notre réseau, | ||
| nous avons dû le placer en mode « rescue FTP ». Un e-mail | ||
| contenant un nom d'utilisateur et un mot de passe vous a été envoyé afin que vous puissiez | ||
| récupérer facilement les données encore présentes dans l'espace de stockage. | ||
| > | ||
| > N'hésitez pas à contacter notre support technique afin que cette | ||
| situation ne devienne pas critique. | ||
| > | ||
| > Vous trouverez ci-dessous les logs remontés par notre système qui ont déclenché cette alerte. | ||
| > | ||
| > - DÉBUT DES INFORMATIONS COMPLÉMENTAIRES - | ||
| > | ||
| > <Détails de l'attaque> | ||
| > | ||
| > - FIN DES INFORMATIONS COMPLÉMENTAIRES - | ||
| > | ||
| > Cordialement, | ||
| > | ||
| > Support client OVHcloud | ||
| > L'équipe OVHcloud | ||
|
|
||
| ### **VPS** | ||
|
|
||
| Lorsque la protection Anti-DDoS est déclenchée sur votre VPS, celui-ci est placé en mode rescue. | ||
|
|
||
| {.thumbnail} | ||
|
|
||
| OVHcloud ouvrira également un ticket de support en votre nom contenant les informations suivantes : | ||
|
|
||
| > Cher client, | ||
| > | ||
| > Une activité anormale a été détectée sur votre VPS vps-XXXXXXXX.vps.ovh.net. | ||
| > | ||
| > Votre VPS a été placé en mode rescue. Cela vous permettra d'intervenir | ||
| sur votre VPS afin de résoudre les problèmes signalés. Un e-mail contenant des informations sur le mode rescue vous a été envoyé. | ||
| > | ||
| > Aucune action ne peut plus être effectuée sur votre VPS via votre Manager/API. Seules les actions suivantes sont possibles : | ||
| > | ||
| > - Réinstallation de votre VPS. | ||
| > - Utilisation du mode rescue pour résoudre les problèmes signalés. | ||
| > | ||
| > Une fois les problèmes résolus, veuillez contacter notre support technique pour le remettre en mode normal. | ||
| > | ||
| > N'hésitez pas à contacter notre équipe de support technique afin que cette situation ne devienne pas critique. | ||
| > | ||
| > Vous trouverez ci-dessous les logs remontés par notre système, qui ont déclenché cette alerte. | ||
| > | ||
|
|
||
| > [!primary] | ||
| > **Prenez note de la partie finale du message indiquant :** « *Une fois les problèmes résolus, veuillez contacter notre support technique pour le remettre en mode normal. N'hésitez pas à contacter notre équipe de support technique afin que cette situation ne devienne pas critique.* » | ||
| > | ||
|
|
||
| ## Aller plus loin | ||
|
|
||
| Échangez avec notre [communauté d'utilisateurs](/links/community). |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| id: 05986b25-279b-45f4-a7ce-6eadca666d35 | ||
| full_slug: dedicated-servers-antihack | ||
| reference_category: bare-metal-cloud-dedicated-servers-security-anti-hack | ||
| translation_banner: true |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@Y0Coss This article also applies for VPS
Shouldn't we consider adding 2 pages (1 for VPS only and one for dedicated servers only) ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should avoid duplicated content, we have the multi-location feature for that purpose.