The Miner in ps Wasn’t Ollama, It Was a Container
A miner showed as user 'ollama' in ps, so I blamed the Ollama service for three days. It was a Postgres container whose UID collided with the host account.
Category Cybersecurity
Cybersecurity news and analysis – breaches, vulnerabilities, zero-days, and the attackers and defenders shaping the threat landscape.
Don’t Panic Over Docker’s Exec Artifacts
A monitor flagged runc --process /tmp/runc-process as suspicious. It's Docker's transient exec artifact — here's why I patched the detector, not the runtime.
rkhunter Flagged Four Hidden Paths. All Four Were Mine
rkhunter called four paths on my VPS suspicious. Every one was something I put there myself — and the whitelist in /etc/rkhunter.conf is where they belong.
fail2ban Bans That Quietly Do Nothing on Docker Ports
A fail2ban jail reported bans while the wp-login brute force continued, because Docker-published ports traverse FORWARD, not INPUT. The fix is DOCKER-USER.
SSH Brute-Force to Crypto Miner: Hardening a VPS the Hard Way
An unresponsive VPS turned out to be a crypto miner dropped through a brute-forced SSH login. The hardening steps that fixed it, with before/after numbers.
Crypto Miner in Docker: The Postgres Port I Forgot to Close
A 381% CPU spike on my VPS was a crypto miner in a Docker container — not where I first looked. The three-day misdiagnosis, root cause, and fix.