Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1szZ0o-006hS2-9V for pgsql-admin@arkaria.postgresql.org; Sat, 12 Oct 2024 10:06:14 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1szZ0m-000aB2-Ck for pgsql-admin@arkaria.postgresql.org; Sat, 12 Oct 2024 10:06:12 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1szZ0l-000aAq-Vr for pgsql-admin@lists.postgresql.org; Sat, 12 Oct 2024 10:06:12 +0000 Received: from mail-ed1-x534.google.com ([2a00:1450:4864:20::534]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1szZ0i-000ekw-UJ for pgsql-admin@postgresql.org; Sat, 12 Oct 2024 10:06:11 +0000 Received: by mail-ed1-x534.google.com with SMTP id 4fb4d7f45d1cf-5c5b954c359so3250118a12.1 for ; Sat, 12 Oct 2024 03:06:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1728727569; x=1729332369; darn=postgresql.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=HEe6HdnOX6OutwS4u/9YpVUqC9VQXXFdNPtJzeHqas0=; b=koKJiTvc1HCle2r2zEpyf35dvONTfuR2fKIKZ4Z4scDJjL2ApfIvhxX0X6uKGWT5EE QsxOsReyzGsLeRIOdfMK8SZPJ9Wt0GV1QkKDuUSPHSkCVb2EIS8GpwEOG6DscFWKCD4q ARVHNYYWNoaaajolIE7Dvg0I1j/YurbB9l3p1NTZsrcbCLJEwppd3RlLJYObSom20UpF VfXlL2wvFZoTqkEpipgjy+SCgymzl8MV201AC9MRpH7meD4Q/UvvsneKLimmSbonebPZ CmP5fam+ZXl5FwJQDhekjd3cp6A9cjNH7txdGPHFDB2LDMxb6SRp/M5tbeoaI3Os4K0g dfcw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728727569; x=1729332369; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=HEe6HdnOX6OutwS4u/9YpVUqC9VQXXFdNPtJzeHqas0=; b=p3s7/eX/y35z1O9Eodj64wJX1pIDQjlvwxHLyE/irI5Zpdqi0hJaHHTMXa5vArJIGw onDnRhvfMS2rRF332YC3k5OfbipQxxH6KXs9j5Q3hJun9BrZkCBE1PDqcDexxRxLCbPe +KE7CrmVEHQHn7qLUIkDLZ5r9I0FE+r5JbuteM/wrw+g/lNy8/L7c4fEnr4mu+VTx6uQ zdP/LT8ntr94csLHKjJBhXfZKHhxGLryHqbem9z1KqwXnCvcWVjBt4WRMCbn8F6hwQp3 +KOxpkidYPymKVbuW4YUNr7O2/8MywWbl5plXkS48f7EBIEeDSVZz0bZbPaWwwBa6elX K+1A== X-Forwarded-Encrypted: i=1; AJvYcCW4Q/fJ9iw65j7/cWdl0Xqm7NxwFvORdarjdWHN6vxI47YnAQPmCiubGnUhYIr/5CLpjTtarq3PquGoKw==@postgresql.org X-Gm-Message-State: AOJu0Yx4Nm0XUrDBZ/IdEVFEOI8gcLu4xSTpnBEnJOsVvDXCEAx3ZSFw /MjDZ6OX5ErTZH8fi3p04tt1Ip/yXiBZqdx7pGFVrutNkSCyHLEEBT547T6jDejgwbIhwDEnT2v 5ir8bPwk1QR3IRtJKNiigIxA431s= X-Google-Smtp-Source: AGHT+IEYO0PUVzgMzNgqxNS62lQtITfqsqrdshuJltnfBnUq9n2eFujp6izRDe4B9zw1nqDE5MH5p1nG6/wCiAurBic= X-Received: by 2002:a17:907:9708:b0:a99:403e:257a with SMTP id a640c23a62f3a-a99e3e3e626mr192774766b.40.1728727568603; Sat, 12 Oct 2024 03:06:08 -0700 (PDT) MIME-Version: 1.0 References: <6b344a9d0ae654ca0bda0381a2f7f96df76ae3b2.camel@cybertec.at> <1eb200f88003972f2723967ddc95b70b3e61f5de.camel@cybertec.at> In-Reply-To: From: Priancka Chatz Date: Sat, 12 Oct 2024 12:05:57 +0200 Message-ID: Subject: Re: Unknown temp directories and library files To: Imran Khan Cc: Jeff Janes , Laurenz Albe , pgsql-admin Content-Type: multipart/alternative; boundary="000000000000a3e29c062444c0dc" List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --000000000000a3e29c062444c0dc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable It is not pgsql_tmp but a directory two level before the postgres data directory. I tried deleting the files but they reappear in about 10 mins or so, so it is not a sysadmin leftover. I am suspecting it is something that probably is assisting with some tools maybe: there is Patroni ,pgqd, wal-g running and some of these require python. However, I am still not sure why they exist and what is creating it. Regards, Priyanka On Fri, Oct 11, 2024 at 11:01=E2=80=AFPM Imran Khan = wrote: > In that case involving OS admin make sense. > > On Fri, Oct 11, 2024, 11:51=E2=80=AFPM Jeff Janes = wrote: > >> >> >> On Fri, Oct 11, 2024 at 4:16=E2=80=AFPM Laurenz Albe >> wrote: >> >>> On Fri, 2024-10-11 at 15:47 +0200, Priancka Chatz wrote: >>> > On Fri, Oct 11, 2024 at 3:09=E2=80=AFPM Laurenz Albe >>> wrote: >>> > > On Thu, 2024-10-10 at 12:22 +0200, Priancka Chatz wrote: >>> > > > I am observing a new/unknown behavior on some of my instances. My >>> postgres Data >>> > > > directory path is /home/postgres/pgdata/pgroot/data. And I see a >>> temp directory >>> > > > present inside /home/postgres/pgdata which has 100s of directory >>> underneath it >>> > > > and inside each directory some library files related to Psycopg2. >>> Not sure what >>> > > > these files are and why it is getting created. I am attaching >>> screenshots for reference. >>> > > > Can anyone shed some light or direct me to any links to >>> troubleshoot this? >>> > > >>> > > I'd say somebody broke into your database and is abusing it for his >>> purposes. >>> > > >>> > > If that proves true, rescue what you can of the data and start with >>> a new >>> > > installation, preferably with better security. >>> >>> I have no conclusive proof for abuse, but a library has no business in >>> "pgsql_tmp". >>> That looks very much like somebody guessed your superuser password and >>> is hijacking >>> the operating system account. >>> >> >> But he didn't say they were in pgsql_tmp, just that they were in some >> temp directory apparently 3 or 4 levels higher in the directory tree tha= n >> where I would expect pgsql_tmp to be. To me this looks like some cruft l= eft >> over from some sysadmin running the python package manager, perhaps whil= e >> logged in as the wrong user. (Although I suppose that running a package >> manager as the wrong user is also something a hacker might try to do...) >> >> Cheers, >> >> Jeff >> > --000000000000a3e29c062444c0dc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
It is not pgsql_tmp but a directory two level before the p= ostgres data directory. I tried deleting the files but they reappear in abo= ut 10 mins or so, so it is not a sysadmin leftover.=C2=A0 I am suspecting i= t is something that probably is assisting with some tools maybe: there is P= atroni ,pgqd, wal-g running and some of these require python. However, I am= still not sure why they exist and what is creating it.=C2=A0

Regards,
Priyanka

On Fri, Oct 11, 2024 at 11:01=E2=80= =AFPM Imran Khan <imran.k.23@gma= il.com> wrote:
In that=C2=A0case involving OS admin make sense.
On = Fri, Oct 11, 2024, 11:51=E2=80=AFPM Jeff Janes <jeff.janes@gmail.com> wrote:


On Fri, Oct 11, 2024 at 4:16=E2=80=AFPM Laurenz Albe <<= a href=3D"mailto:laurenz.albe@cybertec.at" rel=3D"noreferrer" target=3D"_bl= ank">laurenz.albe@cybertec.at> wrote:
On Fri, 2024-10-11 at 15:47 +0200, Priancka Ch= atz wrote:
> On Fri, Oct 11, 2024 at 3:09=E2=80=AFPM Laurenz Albe <laurenz= .albe@cybertec.at> wrote:
> > On Thu, 2024-10-10 at 12:22 +0200, Priancka Chatz wrote:
> > > I am observing a new/unknown behavior on some of my instance= s. My postgres Data
> > > directory path is /home/postgres/pgdata/pgroot/data. And I s= ee a temp directory
> > > present inside /home/postgres/pgdata which has 100s of direc= tory underneath it
> > > and inside each directory some library files related to Psyc= opg2. Not sure what
> > > these files are and why it is getting created. I am attachin= g screenshots for reference.
> > > Can anyone shed some light or direct me to any links to trou= bleshoot this?
> >
> > I'd say somebody broke into your database and is abusing it f= or his purposes.
> >
> > If that proves true, rescue what you can of the data and start wi= th a new
> > installation, preferably with better security.

I have no conclusive proof for abuse, but a library has no business in &quo= t;pgsql_tmp".
That looks very much like somebody guessed your superuser password and is h= ijacking
the operating system account.

But he di= dn't say they were in pgsql_tmp, just that they were in some temp direc= tory apparently 3 or 4 levels higher in the directory tree than where I wou= ld expect pgsql_tmp to be. To me this looks like some cruft left over from = some sysadmin running the python package manager, perhaps while logged in a= s the wrong user. (Although I suppose that running a package manager as the= wrong user is also something a hacker might try to do...)

Cheers,

Jeff
--000000000000a3e29c062444c0dc--