Message-ID: <1eb200f88003972f2723967ddc95b70b3e61f5de.camel@cybertec.at>
Subject: Re: Unknown temp directories and library files
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Priancka Chatz <pc9926@gmail.com>
Cc: pgsql-admin <pgsql-admin@postgresql.org>
Date: Fri, 11 Oct 2024 22:16:39 +0200
In-Reply-To: 
 <CANnOdgYuaUxnx2XwDek3ZQYK0OiO_XniVNhKB-Ezfz6TRANGtQ@mail.gmail.com>
References: 
	<CANnOdgb=p9mLcg=5BMJ76yEZ+RYR7WHgS1VJRf8EY5VvOcf3ng@mail.gmail.com>
	 <6b344a9d0ae654ca0bda0381a2f7f96df76ae3b2.camel@cybertec.at>
	 <CANnOdgYuaUxnx2XwDek3ZQYK0OiO_XniVNhKB-Ezfz6TRANGtQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.52.4 (3.52.4-1.fc40) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/1eb200f88003972f2723967ddc95b70b3e61f5de.camel%40cybertec.at>
Precedence: bulk

On Fri, 2024-10-11 at 15:47 +0200, Priancka Chatz wrote:
> On Fri, Oct 11, 2024 at 3:09=E2=80=AFPM Laurenz Albe <laurenz.albe@cybert=
ec.at> wrote:
> > On Thu, 2024-10-10 at 12:22 +0200, Priancka Chatz wrote:
> > > I am observing a new/unknown behavior on some of my instances. My pos=
tgres Data
> > > directory path is /home/postgres/pgdata/pgroot/data. And I see a temp=
 directory
> > > present inside /home/postgres/pgdata which has 100s of directory unde=
rneath it
> > > and inside each directory some library files related to Psycopg2. Not=
 sure what
> > > these files are and why it is getting created. I am attaching screens=
hots for reference.
> > > Can anyone shed some light or direct me to any links to troubleshoot =
this?
> >=20
> > I'd say somebody broke into your database and is abusing it for his pur=
poses.
> >=20
> > If that proves true, rescue what you can of the data and start with a n=
ew
> > installation, preferably with better security.

I have no conclusive proof for abuse, but a library has no business in "pgs=
ql_tmp".
That looks very much like somebody guessed your superuser password and is h=
ijacking
the operating system account.

Is that by any event a database accessible on the internet?  Did you have a=
 really
secure password?

Yours,
Laurenz Albe