Абуза с хенцнера

После покупки (на аукционе, после кого-то) своего сервера на Хетцнере за неделю пришло уже второе письмо от них про какую-то проблему. Сисадмин который ставил сервак отмахнулся, типа ерунда, а меня второе письмо уже заставило насторожиться.

На серваке поставлен хостинг + винда под файлы для офиса.

Вот что пишут (вопрос - что делать?):

Dear Mr N,

We received a security alert from the German Federal Office for Information Security (BSI).

Please see the original report included below for details.

Please investigate and solve the reported issue.

It is not required that you reply to either us or the BSI.

If the issue has been fixed successfully, you should not receive any further notifications.

Additional information is provided with the HOWTOs referenced in the report.

In case of further questions, please contact certbund@bsi.bund.de and keep the ticket number of the original report [CB-Report#...] in the subject line.

Do not reply <reports@reports.cert-bund.de> as this is just the sender address for the reports and messages sent to this address will not be read.

Kind regards

Abuse team

On 07 May 10:31, reports@reports.cert-bund.de wrote:

> [CB-Report#20170507-22670821]

>

> Dear Sir or Madam,

>

> the Portmapper service (portmap, rpcbind) is required for mapping RPC

> requests to a network service. The Portmapper service is needed e.g.

> for mounting network shares using the Network File System (NFS).

> The Portmapper service runs on port 111 tcp/udp.

>

> In addition to being abused for DDoS reflection attacks, the

> Portmapper service can be used by attackers to obtain information on

> the target network like available RPC services or network shares.

>

> Over the past months, systems responding to Portmapper requests from

> anywhere on the Internet have been increasingly abused DDoS reflection

> attacks against third parties.

>

> Please find below a list of affected systems hosted on your network.

> The timestamp (timezone UTC) indicates when the openly accessible

> Portmapper service was identified.

>

> We would like to ask you to check this issue and take appropriate

> steps to secure the Portmapper services on the affected systems or

> notify your customers accordingly.

>

> If you have recently solved the issue but received this notification

> again, please note the timestamp included below. You should not

> receive any further notifications with timestamps after the issue has

> been solved.

>

> Additional information on this notification, advice on how to fix

> reported issues and answers to frequently asked questions:

> <https://reports.cert-bund.de/en/>

>

> This message is digitally signed using PGP. Information on the

> signature key is available at the aforementioned URL.

>

> Please note:

> This is an automatically generated message. Replies to the

> sender address <reports@reports.cert-bund.de> will NOT be read

> but silently be discarded. In case of questions, please contact

> <certbund@bsi.bund.de> and keep the ticket number [CB-Report#...]

> of this message in the subject line.

>

> !! Please make sure to consult our HOWTOs and FAQ available at !!

> <https://reports.cert-bund.de/en/> first.