SolOS Server Intrusion Sweep — 2026-09-20
SolOS Server Intrusion Sweep — 2026-09-20
Ran Min's proven linux-malware-sweep procedure (read-only, non-destructive) against
ubuntu@161.33.71.67. Context: the skill documents a PRIOR deep compromise of this
same box (Jul 26–29 2026: two fake D-Bus rootkits defunct/gs-dbus, a crypto miner
lvsbyte/smpsun, and a VLESS covert proxy sing-box).
Verdict: CLEAN — no active intrusion, no live IOCs
| Check | Result |
|---|---|
| Load average (miner sig) | 1.19 — normal |
Masquerade unit files (exec -a '[k...]') | none |
| Fake D-Bus descriptions | none |
.dat rootkit payloads in systemd dirs | none |
| Miner/proxy binaries (lvsbyte/smpsun/sing-box/vless/defunct) | none |
| Suspicious user/system crontabs | none (user crontab empty; cron.d = certbot/e2scrub/sysstat) |
| authorized_keys | 6 keys, ALL legit (young-solos-lux, eva@laptop-tunnel, laptop->solos, tam restricted x2, tam@laptop) |
| /etc/hosts C2 entries | none |
| Rootkit process names | none (only real [ksmd] PID 50 PPID 2) |
| Established conns vs known C2 (47.86.46.179 / 212.132.98.170 / 104.28.x / 152.42.214.17) | none present |
Recent logins (last) | all from Young's 103.164.128.x range, last Aug 24, no foreign IPs |
| sudoers | unchanged since 2024-01-30 provisioning |
Ports resolved (all legitimate)
- :8010/:8011 — Saleor ecommerce API + Dashboard (Docker)
- :6333/:6334 — Qdrant vector DB (Docker)
- :1080 — pproxy SOCKS5 (python,
pproxy -l socks5://0.0.0.0:1080) — see flag below - :80/:443 — nginx; :4090 opencode; :8091 docs; :8300-8307 agents; :8432/8433 registry
- Established outbound: opencode→Cloudflare (172.65.90.21), Telegram API (91.108.x.x, 149.154.166.110) — all legit
⚠️ One hardening flag (not an intrusion)
pproxy SOCKS5 bound to 0.0.0.0:1080 (all interfaces, not loopback). A wide-open
SOCKS proxy is the same shape as the prior VLESS covert-proxy incident, even though
pproxy is a legitimate tool. If it only serves Pulse/moomoo scraping from localhost,
bind it to 127.0.0.1:1080. Owner confirmation needed (Sol).
Could NOT verify (need root/sudo — handed to Echo/Sol)
- /root/.ssh/authorized_keys (root-owned)
- /var/log/auth.log +
lastbfailed-login records (root-only) - root crontab (
/var/spool/cron/crontabs/) - process identity of :80/:443 (nginx — high confidence but unconfirmed as non-root read)
Prior-incident residual
/tmp/fakebin/ss = 17-byte #!/bin/sh exit 1 stub (Aug 26) — harmless, likely leftover
test artifact from the prior IR. Safe to delete; not malicious.
Recommendation
- Bind pproxy to 127.0.0.1 (or document why it must be 0.0.0.0).
- Echo/Sol re-run the 4 root-only checks above for a complete picture.
- Quarterly SSH key + host-key rotation already on file (skill reference).
Cloud X Berry — Engineering Playbook for the SolOS v2 Rebuild
Source: 8 full transcripts from the "Cloud X Berry" YouTube channel, pulled with youtube-transcript-api (Tam profile venv, ~/.hermes/profiles/tam/venv) into /tmp/yt_<ID>.txt. Transcript sizes: 3.6–8.9 KB each — all verified non-empty and plausible. Distilled by Tam for Sol (engineering lead) + Ace (developer), SolOS v2 rebuild.
SolOS v2 — Complete System Architecture
One-line thesis: OpenCode supplies the runtime core and the human-facing surface; a thin SolOS Python layer owns the fleet (multi-agent mesh, memory, cost, registry, vault); Hermes is decommissioned and kept only as a pattern reference. Zero Hermes runtime dependency.