Questions about system security and integrity

[legitnyck]

Hi Fuzziqer,

First of all, thank you for your amazing work and for sharing such valuable tools with the community — they’ve been incredibly helpful and inspiring.

I’m reaching out to ask for your advice on a situation that’s been troubling me. Recently, my system experienced some suspicious behavior: several folders were deleted without explanation, and others were created with random names like ddeeeeeaa. More critically, key .json files used by my newserv service — such as users.json, config.json, and permissions.json — mysteriously disappeared.

As far as I know, I’m the only person with access to my VPS, which makes this even more puzzling. I plan to restore the system from a backup made before the incident, but I’m still trying to understand how this could have happened and how to prevent it in the future.

To add to that, I recently dealt with a bot attack on my phpBB forum, which I was only able to mitigate after setting up CloudFlare — that helped a lot in filtering malicious traffic.

I’m not implying any connection to your tools, but since I use some of your projects and respect your expertise, I wanted to ask:

Do you have any recommendations for securing small systems like mine that rely on newserv?

Is there a way to automatically apply official updates or patches to newserv as they’re released, to ensure I’m always running the latest and most secure version?

I really appreciate any guidance you can offer. I’m just trying to learn from those with more experience and make sure my setup is as resilient as possible.

Best regards, legit

[fuzziqersoftware]

Do you run newserv along with phpBB and other things on the same host? If so, it's likely that one of the other services was compromised and let an attacker run scripts on the host, which could have been responsible for the damage. It's generally a good idea to keep services isolated from each other somehow, either via containers (e.g. Docker) or by using separate VMs / hardware. You could also apply some other common security best practices, like restricting access to the SSH port to your own IP address.

As for automatically updating newserv, I'm not even sure that's a good idea... test coverage isn't as good as it should be, and there's a nontrivial risk that I make changes in the future that accidentally break existing functionality.

[legitnyck]

Sorry for the delay, this problem was resolved with CloudFlare. Thank you for responding.and yes all running in same vps