Tighten OVA security

[phuongdh]

Our OVA was taken over by a bot while running on bridged network. We need to either randomize passwords or warn people of the risk.

[mbklein]

How did the bot gain access? Which password / attack vector was compromised?

[phuongdh]

@mbklein Tomcat was open and had default manager password, so someone was able to drop a webapp in and started mining for Bitcoins.