I think my server was hacked

[crusher11 1127]

3 hours ago, Q-Droid said:

Enable SNI (many do by default) so that IP based requests are rejected. 

What's SNI?

[sh0rty 726]

38 minutes ago, crusher11 said:

What's SNI?

Server name indication. Simple: The reverse proxy just reacts when the specified hostname, e.g. emby.yourdomain.com is called by the client. Many simple bots, vulnerability scanners and automated scripts try to connect directly to your public IP address. 

Edited 5 hours ago by sh0rty

[Q-Droid 1000]

10 minutes ago, sh0rty said:

Server name indication. Simple: The reverse proxy just reacts when the specified hostname, e.g. emby.yourdomain.com is called by the client. Many simple bots, vulnerability scanners and automated scripts try to connect directly to your public IP address. 

This. And if your domain doesn't have a PTR record for reverse lookups then your IP is all they know and can't complete the TLS handshake to get any more info. Just don't run non-TLS services on the same IP. Most domains wouldn't need a PTR unless running an email server and if someone is then they should know enough to protect their services.

 

[crusher11 1127]

...I have no idea what any of that means, either.

[woofstream 4]

I'd really love to enable SNI, how should I get started?

[Lessaj 476]

Nginx Proxy Manager (NPM) is a pretty easy way to get started with SNI since it has a web GUI for configuration.