Re: Malware in /tmp/nginx_client

2015-06-29 Thread Lucas Rolff
It's not cached requests: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_in_file_only It's just temporary files that isn't deleted, if you set it to 'clean' instead of 'on' - I think you can even put it off as default... I don't know why it's actually enabled. guillefar

Re: Malware in /tmp/nginx_client

2015-06-29 Thread guillefar
Yes, I think I will do that. So they are indeed cached requests? Posted at Nginx Forum: http://forum.nginx.org/read.php?2,259948,259960#msg-259960 ___ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx

Re: Malware in /tmp/nginx_client

2015-06-27 Thread Lucas Rolff
It's not harmful that they're there, but you could simply exclude the /tmp/nginx_client folder from maldet, It's due to the option client_body_in_file_only being set to on in your nginx.conf (Sounds like you're using http://www.nginxcp.com/ for cpanel) guillefar 2

Malware in /tmp/nginx_client

2015-06-27 Thread guillefar
The software maldet, discovered some malware in the the /tmp/nginx_client directory, like this: > {HEX}php.cmdshell.unclassed.357 : /tmp/nginx_client/0050030641 > {HEX}php.cmdshell.unclassed.357 : /tmp/nginx_client/0060442670 I did some research, and found out that indeed, there were some malicio