Control Web Panel

WebPanel => Apache => Topic started by: thomash on October 08, 2015, 09:21:02 PM

Title: Suspicious File Alert mail every night
Post by: thomash on October 08, 2015, 09:21:02 PM

Hello.

Can someone tell me why I get those mails every night?

What can I do to prevent this, and is it something that I need to worry about?

Time:   Thu Oct  8 00:05:09 2015 +0000
File:   /tmp/apache-build/apr-1.5.1/configure
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:09 2015 +0000
File:   /tmp/apache-build/apr-1.5.1/buildconf
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:09 2015 +0000
File:   /tmp/apache-build/apr-1.5.1/apr-config.in
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/ltmain.sh
Reason: Script, file extension
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/install-sh
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/configure
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/config.sub
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/config.guess
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/depcomp
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Time:   Thu Oct  8 00:05:08 2015 +0000
File:   /tmp/apache-build/suphp-0.7.1/config/missing
Reason: Script, starts with #!
Owner:  : (1000:1000)
Action: No action taken

Regards
Thomas.

Title: Re: Suspicious File Alert mail every night
Post by: Glenn on October 09, 2015, 06:28:37 AM

Did you re compile Apache ?

Title: Re: Suspicious File Alert mail every night
Post by: thomash on October 11, 2015, 07:26:22 PM

No. The crew here at CWP installed and compiled CentOS, and I have not recompiled it afterwords..

/Thomas.

Title: Re: Suspicious File Alert mail every night
Post by: Administrator on October 13, 2015, 05:27:26 AM

you can simply delete this files, but you should be careful with this command as you could end-up with your server deleted.

Code: [Select]

rm -Rf /tmp/apache-build/

Title: Re: Suspicious File Alert mail every night
Post by: misterpat on January 20, 2016, 09:51:02 PM

Will this work for php-build also in the tmp directory?

File:   /tmp/php-build/php-5.4.45/*

Title: Re: Suspicious File Alert mail every night
Post by: Administrator on January 20, 2016, 11:14:52 PM

yes

Title: Re: Suspicious File Alert mail every night
Post by: crmgddn63 on March 09, 2016, 08:19:47 AM

File:   /tmp/apache-build/httpd-2.2.27/server/core.o
Reason: Linux Binary
Owner:  root:root (0:0)
Action: No action taken

i give this message every hour. how can i fix this ?

Title: Re: Suspicious File Alert mail every night
Post by: Neo2SHYAlien on March 20, 2016, 02:02:07 PM

Append at the end of /etc/csf/csf.fignore those 2 rows

Code: [Select]

/tmp/apache-build/.*
/tmp/php-build/.*After that restart lfd and everything will be ok :) I prefer this approach will be better if is added as CWP CUSTOM rules as as the rows in /etc/csf/csf.pignore

Title: Re: Suspicious File Alert mail every night
Post by: crmgddn63 on March 24, 2016, 10:46:28 PM

thank you for your support dude.
 ;)

Title: Re: Suspicious File Alert mail every night
Post by: johnhelmer on March 26, 2016, 10:59:29 PM

Quote from: Neo2SHYAlien on March 20, 2016, 02:02:07 PM

Append at the end of /etc/csf/csf.fignore those 2 rows

Code: [Select]

/tmp/apache-build/.*
/tmp/php-build/.*After that restart lfd and everything will be ok :) I prefer this approach will be better if is added as CWP CUSTOM rules as as the rows in /etc/csf/csf.pignore

Can you just add these two lines as is to pignore or does it require a different format?

Title: Re: Suspicious File Alert mail every night
Post by: Neo2SHYAlien on March 27, 2016, 04:38:39 AM

Quote from: johnhelmer on March 26, 2016, 10:59:29 PM

Can you just add these two lines as is to pignore or does it require a different format?

You should add them to /etc/csf/csf.fignore not ot pignoner file. pigone is for process ignoring respectively fignore for file ignoring rules :)