MIME-Version: 1.0
References: 
 <CANnOdgb=p9mLcg=5BMJ76yEZ+RYR7WHgS1VJRf8EY5VvOcf3ng@mail.gmail.com>
 <6b344a9d0ae654ca0bda0381a2f7f96df76ae3b2.camel@cybertec.at>
In-Reply-To: <6b344a9d0ae654ca0bda0381a2f7f96df76ae3b2.camel@cybertec.at>
From: Priancka Chatz <pc9926@gmail.com>
Date: Fri, 11 Oct 2024 15:47:10 +0200
Message-ID: 
 <CANnOdgYuaUxnx2XwDek3ZQYK0OiO_XniVNhKB-Ezfz6TRANGtQ@mail.gmail.com>
Subject: Re: Unknown temp directories and library files
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: pgsql-admin <pgsql-admin@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000eeb518062433b9b5"
Archived-At: 
 <https://www.postgresql.org/message-id/CANnOdgYuaUxnx2XwDek3ZQYK0OiO_XniVNhKB-Ezfz6TRANGtQ%40mail.gmail.com>
Precedence: bulk

--000000000000eeb518062433b9b5
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Laurenz,

What kind of security was breached here or you think needs to be tightened
up?  And how to prove this is a security issue or not ?

Pretty worried,
Priyanka

On Fri, Oct 11, 2024 at 3:09=E2=80=AFPM Laurenz Albe <laurenz.albe@cybertec=
.at>
wrote:

> On Thu, 2024-10-10 at 12:22 +0200, Priancka Chatz wrote:
> > I am observing a new/unknown behavior on some of my instances. My
> postgres Data
> > directory path is /home/postgres/pgdata/pgroot/data. And I see a temp
> directory
> > present inside /home/postgres/pgdata which has 100s of directory
> underneath it
> > and inside each directory some library files related to Psycopg2. Not
> sure what
> > these files are and why it is getting created. I am attaching
> screenshots for reference.
> > Can anyone shed some light or direct me to any links to troubleshoot
> this?
>
> I'd say somebody broke into your database and is abusing it for his
> purposes.
>
> If that proves true, rescue what you can of the data and start with a new
> installation, preferably with better security.
>
> Yours,
> Laurenz Albe
>

--000000000000eeb518062433b9b5
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Laurenz,<div><br></div><div>What kind of security was b=
reached here or you think needs to be tightened up?=C2=A0 And how to prove =
this is a security issue or not ?=C2=A0</div><div><br></div><div>Pretty wor=
ried,</div><div>Priyanka</div></div><br><div class=3D"gmail_quote"><div dir=
=3D"ltr" class=3D"gmail_attr">On Fri, Oct 11, 2024 at 3:09=E2=80=AFPM Laure=
nz Albe &lt;<a href=3D"mailto:laurenz.albe@cybertec.at">laurenz.albe@cybert=
ec.at</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"ma=
rgin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:=
1ex">On Thu, 2024-10-10 at 12:22 +0200, Priancka Chatz wrote:<br>
&gt; I am observing a new/unknown behavior on some of my instances. My post=
gres Data<br>
&gt; directory path is /home/postgres/pgdata/pgroot/data. And I see a temp =
directory<br>
&gt; present inside /home/postgres/pgdata which has 100s of directory under=
neath it<br>
&gt; and inside each directory some library files related to Psycopg2. Not =
sure what<br>
&gt; these files are and why it is getting created. I am attaching screensh=
ots for reference.<br>
&gt; Can anyone shed some light or direct me to any links to troubleshoot t=
his?<br>
<br>
I&#39;d say somebody broke into your database and is abusing it for his pur=
poses.<br>
<br>
If that proves true, rescue what you can of the data and start with a new<b=
r>
installation, preferably with better security.<br>
<br>
Yours,<br>
Laurenz Albe<br>
</blockquote></div>

--000000000000eeb518062433b9b5--