Hi,
it would seem that I have been hacked. someone or something has managed to pause specific antlets at will. changing the root password on the antman did nothing, they were still able to pause the antlets within seconds of me starting them. Currently the antlet doesn’t even start, just stays paused.
Any ideas how I can stop this?
changed the password here, no avail
Even with the changed password the antlets are paused.
Where do i even start to look? Or How can i reset this whole machine back to factory? I can rebuild all the antlets, re install all the software, there’s nothing on any of the machines that is super important besides databases that don’t hold production data anyway.
In case it's still useful, or for anyone who finds this later:
Antlets that pause by themselves a few seconds after starting are almost never a sign of a break-in. KVM pauses a virtual machine automatically when it can't write to its disk, and on an antsle the most common cause is a full zpool. Changing the password doesn't help because nobody else is doing it.
To check, SSH into your antsle and run zpool list and zfs list. If the pool is at or near 100%, free up space by deleting old snapshots or backups you no longer need, or unused antlets. Then start the antlets again. If space is fine, zpool status shows whether a drive is reporting errors.
If you still want a clean start, a fresh install of antMan 4 is a good way to do it: antman4.antsle.com
— Antsle Team
