icemounty - I just lost operating system

[icemounty]

Not sure what happened, but came home this morning and the parity check was done, and came back

 

Last check completed on Sun 21 Mar 2021 08:04:46 PM PDT (yesterday)
Finding 0 errors  Duration: 21 hours, 57 minutes, 29 seconds. Average speed: 126.5 MB/sec

Parity disk(s) content will be overwritten

 

Now all my disks are showing empty.

 

Don't tell me 54 TB worth of data is gone

Edited March 22, 2021 by icemounty
spelling

[trurl]

On 3/21/2021 at 5:48 AM, JorgeB said:

If you have any forwarded ports from your router to the server make sure you close them all, a number of users have been similarly hacked lately.
 

Did you have any forwarded ports? Did you allow access to your server outside your LAN?

[icemounty]

i had my server in the dmz in order to for me to port forward plex, because my isp has a firewall through their modem, that causes a double Nat

[JorgeB]

There have been several cases in the last week or so of hacked users will all the data deleted, forwarded ports (or dmz) appears to be the common denominator, doing that has always been a very bad idea, but apparently lately there are hackers actively looking for open Unraid servers.

[icemounty]

How do i check my drives to see what data is left on them, since none of my previous shares are available to me.  

[JorgeB]

If the drives are empty only option is using a data recovery tool, like for example UFS explorer.

[icemounty]

So, you are saying, that my unraid server was hacked, and that my entire drives are cleaned of all data, and unraid didnt have anything in place to prevent my drives from being cleaned.  Is unraid that vulnerable to outside hackers.  I mean, it takes me almost 24 hours to just do a parity check, and it takes me almost as long to replace a failed drive.  So, they were able to scrub my drives instantly.  I guess what Im asking, is it worth trying to rebuild everything in unraid, if I could be targeted again.  I might as well lust turn my unraid server into a windows computer  

[JorgeB]

11 minutes ago, icemounty said:

if I could be targeted again. 

It won't if don't do this:

 

40 minutes ago, icemounty said:

i had my server in the dmz

 

[ChatNoir]

Limetech is repeating regularly that the administration part of Unraid is not to be directly exposed to the Internet, just like you would not open the administration part of your router or a Synology.

 

There are secure ways to access the server from the outside, Wireguard for example.