We use CentOS.  We've been hacked and trying to figure out why. Looking at the /tmp folder I'm wondering if these are security threats:  -rw-rw----  1 mysql    mysql    11665408 Apr  3 18:59 #sql_6bc_0.MYD -rw-rw----  1 mysql    mysql        1024 Apr  3 18:59 #sql_6bc_0.MYI drwxrwxrwt  5 root     root       647168 Apr  3 18:59 ./ dr-xr-xr-x 25 root     root         4096 Mar 31 19:34 ../ drwxrwxrwt  2 root     root         4096 Mar 31 19:34 .ICE-unix/ -rw-------  1 cpanel   cpanel          0 Dec  3 11:18 .ftpquota -rw-------  1 root     root            1 Mar 18 00:19 cache_03ccc987bb84ad942c7bdc1b37a1d5af -rw-------  1 root     root            1 Mar 18 00:19 cache_0f1ff313f7d5dc65958843d70148d9f6 -rw-------  1 root     root            1 Mar 18 00:19 cache_3ebbab63ff1d3bffdaddb17747049f2d -rw-------  1 root     root          581 Mar 14 00:46 cache_5a3dafb5b1cf70a9b76b7e70107b3ba0 -rw-------  1 root     root            1 Mar 18 00:19 cache_763860a21a94412ffb8081c5efb43196 -rw-------  1 root     root            1 Mar 18 00:19 cache_85daced7c4de2f5a2c332a7d8a7a3803 -rw-------  1 root     root            1 Mar 18 00:19 cache_8c1e2d0573ed1f99fd247768110f872f -rw-------  1 root     root        16093 Mar 18 00:19 cache_b9813b3134c6afdd77d72c595ebda25d -rw-------  1 root     root          440 Mar 18 00:19 horde_cache_gc -rwxr-xr-x  1 root     root        34087 May 16  2013 latest* lrwxrwxrwx  1 root     root           27 Dec  3 11:15 mysql.sock -&gt; ../var/lib/mysql/mysql.sock= drwxr-xr-x  3 root     root         4096 Dec  3 11:31 pear/ -rw-------  1 user user   122856 Mar 31 00:13 php9YFHLD -rw-------  1 user user           0 Apr  3 18:38 sess_00257f10fae6be00b90d5ba805ad30af -rw-------  1 user user           0 Apr  3 18:58 sess_003d98e029b3d2c0fab09d926c0dd761 -rw-------  1 user user           0 Apr  3 18:59 sess_0047577f2d01487f4fa75724d0b3f7ee -rw-------  1 user user           0 Apr  3 18:58 sess_0070e5da229b113786f64f39cae87daf -rw-------  1 user user           0 Apr  3 18:59 sess_0077dea73523b2548e8eb100ff76359f -rw-------  1 user user           0 Apr  3 18:46 sess_00882cd396bd3452665c9d973918afdb -rw-------  1 user user           0 Apr  3 18:46 sess_00b82f19cf9a685d1aceeb7f70de6608 -rw-------  1 user user           0 Apr  3 18:50 sess_00d77c2027af0c19151a1b99021f3758 -rw-------  1 user user           0 Apr  3 18:51 sess_0108c3a1bd1f79e0aa0b27045e23ea08 -rw-------  1 user user           0 Apr  3 18:53 sess_011637bd373ae7cffb2725820d89fd5a -rw-------  1 user user           0 Apr  3 18:43 sess_0131292a1d637c2317dcaafed09df456   Was wondering why so many of them are run by root? Why are some of them still there after so many days?  I heard about tmp files being a vulnerability. How should I monitor the /tmp files?
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
How does the garage system work in GTA V? Prove by induction that $n^2<n!$ Prove continuous functions $f$ and $g$ are equal Suppose $f,g$: $\Bbb R$ → $\Bbb R$ are continuous functions such that $f(r) = g(r)$ for all $r$ in $\Bbb Q$. That is to say, $f$ and $g$ are equal on the rational numbers.   Prove that  $f(x) = g(x)$  for all $x$ in $\Bbb R$ How to split larger files into smaller parts? Print file content without the first and last lines Is there a simple way I can echo a file, skipping the first and last lines? I was looking at piping from head into tail, but for those it seems like I would have to know the total lines from the outset. I was also looking at split, but I don't see a way to do it with that either. Deducing $\sin x + \cos x \ge 1$ from $(\sin x + \cos x)^2 = 1 + 2 \sin x \cos x$ So in trig, say I have an acute angle $X$. And one can intuitively conclude that $\sin x + \cos x \ge 1$, but how does the fact that $$(\sin x + \cos x)^2 = 1 + 2 \sin x \cos x$$ tell me that it is true that $\sin x + \cos x \ge 1$? I don't quite see the connection. Thanks How did Luke know where to land on Dagobah? Minimal polynomial of $\sqrt[3]{2} + \sqrt{3}$ Suppose I want to find the minimal polynomial of the number $\sqrt[3]{2} + \sqrt{3}$.   Now that means I want to find a  unique polynomial that is irreducible over $\Bbb Q$ such that $f(x)=0$. Now I know that because   $\sqrt[3]{2} + \sqrt{3}$ belongs to $\Bbb Q( \sqrt[3]{2} , \sqrt{3})$  it might be degree $2$, $3$ or $6$ and does not belong to $\Bbb Q( \sqrt[3]{2})$ so it cannot be of degree $3$ or  $\Bbb Q( \sqrt{3})$ so it cannot be of degree $2$.  So it is of degree $6$. I think my sayings are a bit intuitive and not formal and lack rigorous. Couldn't it belong to another extension of degree $2$? or $3$? I can't answer that. Why checking only those $2$ is enough? Or is it wrong at all to say that? Let $s_n$ be a sequence defined as given below for $n \geq 1$. Then find out $\lim\limits_{n \to \infty} s_n$.   \begin{align}   s_n = \int\limits_0^1 \frac{nx^{n-1}}{1+x} dx  \end{align}  I have written a solution of my own, but I would like to know it is completely correct, and also I would like if people post more alternative solutions. "Can not setup lock file:/tmp/g2ipmsg.lock errno : -11 (Resource temporarily unavailable)" I installed IP Messenger (GNOME 2) from Ubuntu software center but its not working. It's always showing an error message on Ubuntu 12.04.  FileName:ipmsg.c Function:create_lock_file Line:157 Can not setup lock file:/tmp/g2ipmsg.lock errno : -11 (Resource temporarily unavailable) What are WPF Preview Events? Why do first years cross the lake to get to the castle? It makes sense to keep them together, and to have them arrive in the Great Hall separately from the rest of the school for the Sorting. But why the boats? The lake crossing is dramatic, but inefficient - as we see in book 4 when Dennis Creevey falls in the lake during the storm.   Is there a canon (books/movies or JKR) explanation for why the first years come up from the train in boats instead of carriages? How to create a Geometric Polygonal Art portrait I've been interested in creating Geometric Polygonal art illustrations, i.e. making polygons and shapes with different color shading represent a face, or an object, see  set of .  How are they achieved? Is there some script for Illustrator which alters the image adding the shapes according to the colors or shades? How would I transform a normal image of Marilyn Monroe for example, to a polygonal illustration of her? If a derivative of a continuous function has a limit, must it agree with that limit? Evaluating even binomial coefficients Can someone give me a hint how to evaluate $$ \binom{n}{0}+\binom{n}{2}+\cdots+\binom{n}{o(n)},$$ where $o(n)$ is $n$ if $n$ is even and $n-1$ otherwise ? I want to copy/modify/delete a Minecraft world. Where can I find my saves folder? Do harmonic numbers have a “closed-form” expression? Ubuntu 18.04: switch back to /etc/network/interfaces Starting sometime around Ubuntu 18.04, the Ubuntu devs stopped using the classic /etc/init.d/networking and /etc/network/interfaces method of configuring the network and switched to some thing called . This has made a lot of people very angry and been widely regarded as a bad move. Is it possible to remove netplan and use the correct /etc/network/interfaces method for configuring the network? Unity doesn't load, no Launcher, no Dash appears When I login, nothing happens.   I am presented with my desktop wallpaper.    No Dash, no Launcher, nothing. How can I take shallow depth of field photos with a point-and-shoot camera? I have a compact digital camera, and in macro mode I can manage to achieve a blurred background, if the background is far enough away. Can this be done when taking non-macro pictures, and if not, is there a way to simulate it?  When I shoot portraits with my brother's DSLR, it is quite easy to fade out the background. But with my point and shoot camera, I haven't been able to take such photos.   I choose a large aperture for my camera but it still doesn't work. I know that standing further and zooming will result in a smaller depth of field, but it doesn't seem to be enough to get the really nice "bokeh" look. I've tried macro mode, and that will work if the subject is close enough and the background far enough away, but how can it be done with non-macro pictures?   Why are DSLR cameras are so much better in this area? What are the general recommendations to do this using a compact or super-zoom camera?