strange SOCK files in tmp folder

  • - IMSCP: 1.5.1

    - Distribution: Debian GNU/Linux 8.11 (jessie)

    - Proftpd


    - MariaDB 10.0

    - Courier

    - Roundcube

    - Web2FTP

    - Plugins:

    PMA Captcha, RoundCubePlugins, SpamAssassin , LetsEncrypt, WHMCS

    I found strange .sock files in / tmp (=tun7262.sock) with a filesize of 0, is this something I have to be worry about?

    How can I determine from which user these were generated?

    I know this installation is a little older will be migrated to a new server ASAP


  • Nothing to do with i-MSCP.


  • Nuxwin

    Added the Label not i-MSCP related
  • OK, I have found the owner and creator of these .sock files and blocked their websites ... there are about 4 prestashops installed .... but I guess the webuser should not be able to generate TUN.SOCK files inside /tmp and it looks like hacked or outdated PHP scripts causing this - right?

  • if anyone finds such tunxxx.socks files in /tmp, this is caused by a thirdparty PrestaShop database bridge.php which is trying to setup virtual proxy connections to their local computer accounting software, which also leads to a high system load. In MC you can set display info/details to the right side and then the respective vuXXXX owner are shown..