On 05/21/2018 02:40 PM, Bartosz Dmytrak wrote:
Hi Gurus,
Looking into my postgresql.log on one of my test servers I found scary
entry:
Is there a Web app running on this server?
The log entries below are from the Postgres logs in?:
/var/log/postgresql/
--2018-05-19 05:28:21-- http://207.148.79.161/post0514/post
Connecting to 207.148.79.161:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1606648 (1.5M) [application/octet-stream]
Hmm, the below says it downloaded 12.5M.
Saving to: ‘/var/lib/postgresql/10/main/postgresq1’
The postgresq1 file is actually there?
If so have you looked at the file:
file postgresq1
to get an idea of what it is?
0K .......... .......... .......... .......... .......... 3% 71.0K 21s
50K .......... .......... .......... .......... .......... 6%
106K 17s
100K .......... .......... .......... .......... .......... 9%
213K 13s
150K .......... .......... .......... .......... .......... 12%
213K 11s
200K .......... .......... .......... .......... .......... 15% 16.3M 9s
250K .......... .......... .......... .......... .......... 19% 215K 8s
300K .......... .......... .......... .......... .......... 22% 15.6M 7s
350K .......... .......... .......... .......... .......... 25% 11.7M 6s
400K .......... .......... .......... .......... .......... 28% 219K 5s
450K .......... .......... .......... .......... .......... 31% 12.1M 5s
500K .......... .......... .......... .......... .......... 35% 11.7M 4s
550K .......... .......... .......... .......... .......... 38% 12.2M 3s
600K .......... .......... .......... .......... .......... 41% 12.1M 3s
650K .......... .......... .......... .......... .......... 44% 228K 3s
700K .......... .......... .......... .......... .......... 47% 12.2M 3s
750K .......... .......... .......... .......... .......... 50% 12.1M 2s
800K .......... .......... .......... .......... .......... 54% 11.7M 2s
850K .......... .......... .......... .......... .......... 57% 12.1M 2s
900K .......... .......... .......... .......... .......... 60% 11.8M 2s
950K .......... .......... .......... .......... .......... 63% 12.1M 1s
1000K .......... .......... .......... .......... .......... 66% 12.0M 1s
1050K .......... .......... .......... .......... .......... 70% 243K 1s
1100K .......... .......... .......... .......... .......... 73% 12.1M 1s
1150K .......... .......... .......... .......... .......... 76% 12.1M 1s
1200K .......... .......... .......... .......... .......... 79% 11.7M 1s
1250K .......... .......... .......... .......... .......... 82% 12.1M 1s
1300K .......... .......... .......... .......... .......... 86% 12.1M 0s
1350K .......... .......... .......... .......... .......... 89% 11.8M 0s
1400K .......... .......... .......... .......... .......... 92% 12.1M 0s
1450K .......... .......... .......... .......... .......... 95% 12.1M 0s
1500K .......... .......... .......... .......... .......... 98% 11.8M 0s
1550K .......... ........ 100% 12.5M=2.6s
2018-05-19 05:28:25 (598 KB/s) -
‘/var/lib/postgresql/10/main/postgresq1’ saved [1606648/1606648]
Downloaded file is not posgresql but postgresq1(one).
It was pure pg instalation without any contrib modules addons etc,
istalled on ubuntu box by apt manager using repos:
http://apt.postgresql.org/pub/repos/apt xenial-pgdg/main
http://apt.postgresql.org/pub/repos/apt xenial-pgdg
I have never seen such entry on other my other servers…
Could you be so kind and explain me what is it? I am afraid my postgres
has been hacekd.
Best Regards
*/Bartosz Dmytrak/*
--
Adrian Klaver
adrian.klaver@xxxxxxxxxxx
