September 18, 20232 yr Need advice on security Noticed a root logon from an unfamiliar IP. Turns out its from the unraid-api docker. I set that up some time ago but as far as I know it shouldnt be able to do a successful weblogon? Its also connected to Homeassistant. Didnt fins much in my google searches about it. Changed all passwords and currently looking over my network/security. I have a bunch of random containers, been updating the unraid os regularly. Sep 17 04:20:18 webGUI: Successful login user root from 172.18.0.2 Any advice? Nuke the whole server? sysnova-diagnostics-20230918-0831.zip
September 18, 20232 yr Community Expert Solution That seems to be the normal modus operandi for the unraid-api docker, if its the same were talking about. It seems to scrape the webui and you do have to enter your credentials.
September 18, 20232 yr Author 10 hours ago, Mainfrezzer said: That seems to be the normal modus operandi for the unraid-api docker, if its the same were talking about. It seems to scrape the webui and you do have to enter your credentials. Yeah it's the one that integrates with mqtt and home assistant. Thanks, Im paranoid in general tho so I'll get rid of the docker at least.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.