Hello Everyone,
Internal case CPANEL-23314 is open to address an issue in cPanel & WHM version 76 where accessing phpMyAdmin as a cPanel user leads to the creation of
pma_template_compiles_$user files in the system's
/tmp directory. While this doesn't lead to any direct issues with cPanel & WHM itself, it's contrary to the behavior seen in applications such as Horde and Roundcube where temporary files are stored in the
/home/$user/tmp/ directory.
This can lead to false positives from applications such as CSF that monitor the system's
/tmp directory for suspicious files. I'll monitor this case and update this thread with more information on it's status as it becomes available.
In the meantime, anyone receiving these alerts from CSF can read the following section from the
CSF ReadMe for information on how the
Directory Watching feature works and how to configure it to ignore false positives:
Code:
9. Directory Watching
#####################
Directory Watching enables lfd to check /tmp and /dev/shm and other pertinent
directories for suspicious files, i.e. script exploits.
If a suspicious file is found an email alert is sent using the template
filealert.txt.
NOTE: Only one alert per file is sent until lfd is restarted, so if you remove
a suspicious file, remember to restart lfd
To remove any suspicious files found during directory watching, enable
corresponding setting the suspicious files will be appended to a tarball in
/var/lib/csf/suspicious.tar and deleted from their original location. Symlinks
are simply removed.
If you want to extract the tarball to your current location, use:
tar -xpf /var/lib/csf/suspicious.tar
This will preserver the path and permissions of the original file.
Any false-positives can be added to /etc/csf/csf.fignore and lfd will then
ignore those listed files and directories.
Within csf.fignore is a list of files that lfd directory watching will ignore.
You must specify the full path to the file
You can also use perl regular expression pattern matching, for example:
/tmp/clamav.*
/tmp/.*\.wrk
Remember that you will need to escape special characters (precede them with a
backslash) such as \. \?
Pattern matching will only occur with strings containing an asterisk (*),
otherwise full file path matching will be applied
You can also add entries to ignore files owner by a particular user by
preceding it with user:, for example:
user:bob
Note: files owned by root are ignored
For information on perl regular expressions:
http://www.perl.com/doc/manual/html/pod/perlre.html
Here's a user-submitted example from this thread that shows how to add the
pma_template_compiles_$user files in the system's
/tmp directory to the CSF ignore list:
You may be able to stop the emails from CSF until the cPanel fix is published by adding a down-and-dirty regex to the /etc/csf/csf.fignore file
Something like:
Code:
/tmp\/pma_template_compiles_*
Let us know if you have any questions.
Thanks!
