Suspicious file in /var/tmp/.X1-unix

postcd

• October 01, 2015 03:52

Hello, i want to ask i got warning from firewall: File: /var/tmp/.X1-unix Reason: Suspicious directory it has rights of one of the cpanel accounts. i want to ask what is this /var/tmp and how it could create this file, how to prevent?

• 

  dalem

  • October 01, 2015 13:57

  /var/tmp is /tmp is symbolically linked

  0
• 

  lx24

  • October 02, 2015 12:48

  You can find many threads around the fourm regarding securing tmp folder. Use : /scripts/securetmp

  0
• 

  postcd

  • October 04, 2015 14:16

  You can find many threads around the fourm regarding securing tmp folder. Use : /scripts/securetmp

  
  /scripts/securetmp failes because OpenVZ which im using do not work with "loop devices", you taking like there can be more ways on how to secure /tmp, what are other ways except using loop device/s? thank you

  0
• 

  lx24

  • October 05, 2015 16:47

  Under VPS edit /etc/fstab, nano /etc/fstab and insert below lines,
  mount /dev/loop0 -o noexec,nosuid,rw /dev/tmpFS /tmp mount /dev/loop0 /dev/tmpFS -o noexec,nosuid,rw
  Now run command below,
  mount -obind,nosuid,noexec,nodev,rw /usr/tmp /tmp
  You /tmp is mounted now with noexec secure!

  0
• 

  cPanelMichael

  • October 05, 2015 23:02

  Hello :) Feel free to try the steps offered in the previous post and let us know if that helps. Thank you.

  0
• 

  postcd

  • October 07, 2015 20:53

  Feel free to try the steps offered in the previous post and let us know if that helps.

  
  I want to try it and update this thread with results, but can You please tell me what it basically do? How i can safelly revert that process? Thank you

  0
• 

  quizknows

  • October 07, 2015 21:18

  I would advise against editing your /etc/fstab unless you are fully aware of the changes you are making and the implications of them. You can backup the file first before editing it and revert, however, you are changing file system mounting configuration by editing that file. If in doubt consult with your host. You mention that /scripts/securetmp fails due to lack of support for loop devices on your virtualiztaion platform: the advice given is using /dev/loop0 which will likely not work if the securetmp script does not work.

  0

Please sign in to leave a comment.