2

We host our web application on a VPS, I maintain LAMP environment there to fulfill our client needs (I work on relatively small SaaS service provider), I also set up a script to backup the system regularly at night.

Our company had just upgraded all of our Linux VPS to specification of 5gb ram, 5 vcpu, 100gb ssd, etc., this is because my client complain about slow database processing, I thought it might have to do with low specification our VPS had before.

Still, the database problem persist, so my boss asked me to debug the mysql process on each VPS we have. From this I found that only one out of five core seem to be used, this also happens to another VPS.

I suspect that the provider enforce a CPU limit, so I headed out to their customer support to clarify this, first they asked me list of each VPS IP Address, so I handed them that (though I felt strange as why they couldn't do this by themselves ?). They say they will follow up my complain through email (I reached them via live chat on their website).

This morning an email from them landed on our company account, they asked for and I quote.

Dear Sir or Madam To follow up from our previous conversation, we need to access your VPS, please give us your port, user, and ssh password. We expect your replies.

This really surprised me as why do they need this information just to answer my question regarding their CPU policy, now I could never handing them this sensitive information. But is it really normal for an VPS support to request this information ?

Improve this question

2 Answers 2

Reset to default
2

No, this is not normal at all.

If you need to give them access, create a new account for them that exists only for as long as they need access. Only give them as much access as they need.

But they should have resource monitoring from the VPS side and shouldn't need local access to the server.

Improve this answer
3
  • Exactly what I thought, it's odd that they don't have monitoring program on their side. I haven't replied to the emails yet, gonna discuss this with our sysadmin first.
    – howardy3
    Apr 21, 2021 at 3:07
  • 1
    The VPS companies all have a root shell backdoor somewhere to fix your broken server if you bring it down, unless its just some little tiny company run out of a garage. They shouldnt need any password they already have full control
    – john doe
    Apr 21, 2021 at 14:18
  • @john doe: seriously ?
    – Kate
    Apr 21, 2021 at 18:08
1

It's not that surprising in this particular case. If you have an unmanaged VPS then they are not supposed to have credentials. If it were preinstalled they could have created an account for themselves, but they chose not to (and if they did, the customer should be made aware of this).

You may have installed the server from scratch too, in that case they are not supposed to have access either. Yes, they could dump the memory or clone the whole server and access all your data, but the point is that this a private virtual server, and not a shared server (meaning: you are the only one who is in control).

In theory SSH is not necessary, because there should be console access through QEMU or whatever virtualization system they are using. But they still need to log in.

The assumption here is that they provisioned additional resources, but they still need to adapt the configuration on the server. Then you could ask them for the commands that have to be run, and do it yourself.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .