strange SOCK files in tmp folder

  • - IMSCP: 1.5.1

    - Distribution: Debian GNU/Linux 8.11 (jessie)

    - Proftpd

    - PHP FCGID

    - MariaDB 10.0

    - Courier

    - Roundcube

    - Web2FTP

    - Plugins:

    PMA Captcha, RoundCubePlugins, SpamAssassin , LetsEncrypt, WHMCS



    I found strange .sock files in / tmp (=tun7262.sock) with a filesize of 0, is this something I have to be worry about?

    How can I determine from which user these were generated?


    I know this installation is a little older will be migrated to a new server ASAP


    Screenshot-20190217-091911.png

  • Nothing to do with i-MSCP.

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

  • Nuxwin

    Added the Label not i-MSCP related
  • OK, I have found the owner and creator of these .sock files and blocked their websites ... there are about 4 prestashops installed .... but I guess the webuser should not be able to generate TUN.SOCK files inside /tmp and it looks like hacked or outdated PHP scripts causing this - right?

  • if anyone finds such tunxxx.socks files in /tmp, this is caused by a thirdparty PrestaShop database bridge.php which is trying to setup virtual proxy connections to their local computer accounting software, which also leads to a high system load. In MC you can set display info/details to the right side and then the respective vuXXXX owner are shown..