Topics

1

CSF Firewall / Suspicious File Alert

« on: April 18, 2024, 03:32:40 PM »

I setup a new server last week and since I got the DNS to resolve correct (allowing it to send emails) I keep getting these 2 messages.

Note that I do not have this issue with my other install of CWP.

Time:   Thu Apr 18 08:05:23 2024 -0700
File:   /var/tmp/.root_0f8430_salt/pyall/certifi/core.py
Reason: Script, file extension
Owner:  root:root (0:0)
Action: No action taken

Time:   Thu Apr 18 08:05:23 2024 -0700
File:   /var/tmp/.root_0f8430_salt/pyall/salt/grains/core.py
Reason: Script, file extension
Owner:  root:root (0:0)
Action: No action taken

I scanned that directory with CalmAV and it found nothing.

Here is the file structure of the .root_0f8430_salt directory.

[root@ .root_0f8430_salt]# ls -l
total 52
-rw-r--r-- 1 root root   65 Apr  5 02:45 code-checksum
-rw-r--r-- 1 salt salt   40 Apr  1 20:23 ext_version
-rw-r--r-- 1 root root   13 Apr  5 02:45 grains
-rw-r--r-- 1 root root  158 Apr  5 02:45 minion
drwx------ 9 root root 4096 Apr  5 02:45 py3
drwx------ 6 root root 4096 Apr  5 02:45 pyall
drwx------ 3 root root 4096 Apr  5 02:45 running_data
-rw-r--r-- 1 root root  757 Apr  5 02:45 salt-call
-rw------- 1 root root 8629 Apr  5 02:45 salt_state.tgz
-rw-r--r-- 1 root root    8 Apr  5 02:45 supported-versions
-rw-r--r-- 1 root root    6 Apr  5 02:45 version
[root@ .root_0f8430_salt]#