Hello.
Runining ps -aux and top I've found a process running something like:
"sudo nobody find ./ ... /tmp ... etc"
I can not post here the full command and I can not remember very well because server reach a very high load and must be remote rebooted. Now is not there.
My question is: does plesk execute some kind of this commands somewhere (or any application used by plesk) or should I consider some compromised virtual host.
At this moment I've search /srv/www/vhosts/ directory for executable files and checked all wwwrun owned files (uploaded files) and found nothing relevant (at first sight), but all know how difficult is to detect what is good and bad. Also listed /tmp (/var/tmp is also /tmp and booth noexec, but we all know noexec is not solution for all) and found nothing relevant too, but plesk make lots of garbadge on this directory, so it is difficult to check what is system or external.
Any other ideas?
Thank you.
Regards.
Runining ps -aux and top I've found a process running something like:
"sudo nobody find ./ ... /tmp ... etc"
I can not post here the full command and I can not remember very well because server reach a very high load and must be remote rebooted. Now is not there.
My question is: does plesk execute some kind of this commands somewhere (or any application used by plesk) or should I consider some compromised virtual host.
At this moment I've search /srv/www/vhosts/ directory for executable files and checked all wwwrun owned files (uploaded files) and found nothing relevant (at first sight), but all know how difficult is to detect what is good and bad. Also listed /tmp (/var/tmp is also /tmp and booth noexec, but we all know noexec is not solution for all) and found nothing relevant too, but plesk make lots of garbadge on this directory, so it is difficult to check what is system or external.
Any other ideas?
Thank you.
Regards.