strange SOCK files in tmp folder

- IMSCP: 1.5.1

- Distribution: Debian GNU/Linux 8.11 (jessie)

- Proftpd

- PHP FCGID

- MariaDB 10.0

- Courier

- Roundcube

- Web2FTP

- Plugins:

PMA Captcha, RoundCubePlugins, SpamAssassin , LetsEncrypt, WHMCS

I found strange .sock files in / tmp (=tun7262.sock) with a filesize of 0, is this something I have to be worry about?

How can I determine from which user these were generated?

I know this installation is a little older will be migrated to a new server ASAP

thanks, I thought the same ... or "maybe" caused by a module (letsencrypt)

so it seems created by a PHP script, something like tun2socks or typo3 SOCKS5 scripts etc.

https://superuser.com/question…erface-from-a-socks-proxy

I have already scanned the complete system but did not find anything extraordinary or malware ...

so I guess typo3 SOCKS5 scripts etc. could possibly cause this tmp files.

OK, I have found the owner and creator of these .sock files and blocked their websites ... there are about 4 prestashops installed .... but I guess the webuser should not be able to generate TUN.SOCK files inside /tmp and it looks like hacked or outdated PHP scripts causing this - right?

if anyone finds such tunxxx.socks files in /tmp, this is caused by a thirdparty PrestaShop database bridge.php which is trying to setup virtual proxy connections to their local computer accounting software, which also leads to a high system load. In MC you can set display info/details to the right side and then the respective vuXXXX owner are shown..