The Miner in ps Wasn’t Ollama, It Was a Container
A miner showed as user 'ollama' in ps, so I blamed the Ollama service for three days. It was a Postgres container whose UID collided with the host account.
Tag VPS
rkhunter Flagged Four Hidden Paths. All Four Were Mine
rkhunter called four paths on my VPS suspicious. Every one was something I put there myself — and the whitelist in /etc/rkhunter.conf is where they belong.
SSH Brute-Force to Crypto Miner: Hardening a VPS the Hard Way
An unresponsive VPS turned out to be a crypto miner dropped through a brute-forced SSH login. The hardening steps that fixed it, with before/after numbers.
Crypto Miner in Docker: The Postgres Port I Forgot to Close
A 381% CPU spike on my VPS was a crypto miner in a Docker container — not where I first looked. The three-day misdiagnosis, root cause, and fix.