Fake informatik via PN about a new address and DDoS on our server

[soerenh]

Hello, I have registered, because I have had some problems with my TS Server for about 2 weeks and meanwhile also with my provider.

First to the machine - this is Ubuntu 16.04 LTS, everything up-to-date, just under one gigabyte RAM and otherwise little performance, only TeamSpeak is on it.

Now to the problem. Since 2 weeks regularly, like every 2 days users on the server who call themselves "ServerAdmin" "Administrator" or similar, send a message via PN to all people that the server is moving now. Shortly after that, the server is no longer accessible, because a DDoS interrupts the server.

Part 1) Permission to send PN to all users: I dont understand the permission system so i asked someone who does this often and he set it up - today also checked and told me that the three users who did it last also have no rights to e.g. send a message to me as real server admin. I also tested it, on another machine I created and connected a new user - no rights to send a message to an admin.

Part 2) My hosting provider is about to kick me out because the DDoS attacks are also disrupting other customer servers.

I would like to know if something like this happens to others, what else I can do to contain it and especially - I live in Germany - if I should report it to the police, DDoS are not legal.

Would be great if someone could help me

[bialy]

Permission system is a little bit tricky. It's not only server groups to sort it out but you can also use specific client permission to give users specific permissions. You can even give specific permission only if client is on speciffic channel only.

If you have someone you can trust, ask him to check permissions for this particular UID for this permisions and save the logs.

In my opinion you have probably permissions problem from beggining (wrong server groups allowed to elevate permissions) or someone you give real server admin just use it against you.
In both scenarios, deep permission review is advised.
And in the meantime, someone use ddos website to just kick the server. If attack last about 5 minutes, you can be almost sure that it was "free test ride" for new users.