raytracy
Basic Pleskian
(CentOS 7.4 + Plesk Onyx 17.5)
We are investigating a Plesk website intrusion incident, and find that some of our /var/www/vhosts/<domain> has a newly created .pki directory, but some domain has not.
We don't know the purpose of .pki directory and would like to know does it related to Plesk?
Or it put by intruder from outside?
We try to delete it and created a read only file with same name (chmod 000 and chattr +i to it), but found that the file we created has been deleted within 24hr, and the .pki become a directory again....
We find the .pki by following command:
find /var/www/vhosts/ -maxdepth 2 -type d -name .pki -print | xargs stat
The stat of .pki directory looks like:
File: ‘/var/www/vhosts/<domain>/.pki’
Size: 19 Blocks: 0 IO Block: 4096 directory
Device: fd02h/64770d Inode: 67277663 Links: 3
Access: (0740/drwxr-----) Uid: (10001/clientuseradm) Gid: ( 1004/ psacln)
Context: system_u: object_r:httpd_sys_content_t:s0
Access: 2018-05-13 18:42:59.366486763 +0800
Modify: 2017-11-15 08:52:49.656936014 +0800
Change: 2017-11-15 08:52:49.656936014 +0800
Birth: -
We are investigating a Plesk website intrusion incident, and find that some of our /var/www/vhosts/<domain> has a newly created .pki directory, but some domain has not.
We don't know the purpose of .pki directory and would like to know does it related to Plesk?
Or it put by intruder from outside?
We try to delete it and created a read only file with same name (chmod 000 and chattr +i to it), but found that the file we created has been deleted within 24hr, and the .pki become a directory again....
We find the .pki by following command:
find /var/www/vhosts/ -maxdepth 2 -type d -name .pki -print | xargs stat
The stat of .pki directory looks like:
File: ‘/var/www/vhosts/<domain>/.pki’
Size: 19 Blocks: 0 IO Block: 4096 directory
Device: fd02h/64770d Inode: 67277663 Links: 3
Access: (0740/drwxr-----) Uid: (10001/clientuseradm) Gid: ( 1004/ psacln)
Context: system_u: object_r:httpd_sys_content_t:s0
Access: 2018-05-13 18:42:59.366486763 +0800
Modify: 2017-11-15 08:52:49.656936014 +0800
Change: 2017-11-15 08:52:49.656936014 +0800
Birth: -
Last edited: