Results 1 to 3 of 3
  1. #1

    New Files Are a Concern

    Before I begin, I'll mention this is a cPanel/WHM server with about 15 accounts on it.

    I get an e-mail everyday from my server's backup script telling me what new or changed files it found. Yesterday this summary was massive, and it showed new or changed files in these directories:

    /proc

    and

    /home/virtfs

    The type of files it contains:

    "/home/virtfs/[username]/proc/140/task/140/exe"
    "/home/virtfs/[username]/proc/139/exe"
    "/home/virtfs/[username]/proc/139/task/139/exe"
    "/home/virtfs/[username]/proc/227/exe"
    "/home/virtfs/[username]/proc/227/task/227/exe"
    "/home/virtfs/[username]/proc/374/exe"


    The /home/virtfs directory is something I haven't seen before, and it contained two directories belonging to two accounts on the server.

    Does anyone know why these directories would be created or what they are for? The bit of reading I've done on this so far mentions that these directories will be created as a result of jailed SSH, but neither of those two accounts have ever had jailed SSH enabled.

    Any guidance? I'm just wondering if this is indicative of a security breach.

    Thanks,

    Brandon

  2. #2
    Join Date
    Feb 2004
    Location
    New Zealand
    Posts
    1,202
    This is normal of backups.

    virtfs - Virtual File System

    As far as I know its just indexing for the disk space stats, however I could be incorrect. ( Check the cpanel forums )
    DigitalGoods.info
    FREE Shared, Mega Resellers + Dedicated Servers

  3. #3
    Join Date
    Oct 2004
    Location
    Kerala, India
    Posts
    4,750
    virtfs folders will be made when a user login with the jail shell. It is hardlink and deleting them will delete the original file/folders. They can be unmounted as follows.

    Code:
    cd /home/virtfs
    find . -regex '^.*[^.]' -type d > list
    for i in $(cat list); do umount $i; done
    David | www.cliffsupport.com
    Affordable Server Management Solutions sales AT cliffsupport DOT com
    CliffWebManager | Access WHM from iPhone and Android

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •