Hello Cloudron Team,
After further investigation into the server performance issues, we've identified some suspicious activity that may not be related to Cloudron itself. Here's a summary of our findings:
- System and Security Checks Performed:
- We confirmed that no software other than Cloudron was intentionally installed before today.
- We reviewed recent command history to ensure no unintended actions were performed manually.
- Unrecognized User Activity:
- Initially, we noticed a MySQL instance running under the user
pollinate, which is not part of Cloudron’s standard services. - Upon further analysis, we found that after removing the
pollinateuser, a new user with UID106took over running similar services, including MySQL, PostgreSQL, and MongoDB. - Most recently, these processes have transitioned to running under the
netdatauser, which we installed today for monitoring purposes.- is it possible it’s a malicious entity changing user each time ?
- Initially, we noticed a MySQL instance running under the user
- System Observations:
- We have gathered the following screenshots for further analysis:
-
Service View Screenshot: (Attach the image)
-
System Info Screenshot: (Attach the image)
-
Top Command Output Screenshot: (Attach the image)
update of the screenshot for our wordpress service, very high CPU usage, how can we investigate these ?
-
- We have gathered the following screenshots for further analysis:
Next Steps:
- We're investigating if the unauthorized services were installed via a privilege escalation method.
- We're considering reinstallation of Cloudron on a fresh system if no other resolution is found.
Any insights or suggestions from the Cloudron team would be greatly appreciated.
Thank you for your continued support!
