===== USER-LEVEL AUDIT Thu Oct 15 12:16:34 UTC 2026 ===== ## Identity uid=1000(myfifasalon) gid=1000(myfifasalon) groups=1000(myfifasalon) myfifasalon myfifasalon Linux myfifasalon 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux 12:16:34 up 856 days, 22:38, 1 user, load average: 0.01, 0.01, 0.00 ## My account info myfifasalon:x:1000:1000:,,,:/home/myfifasalon:/bin/bash myfifasalon ## Sudo access (no pass) sudo: a password is required ## SUID/SGID readable 5145 36 -rwxr-sr-x 1 root shadow 34816 Feb 2 2023 /sbin/pam_extrausers_chkpwd 5600 36 -rwxr-sr-x 1 root shadow 34816 Feb 2 2023 /sbin/unix_chkpwd 13885 44 -rwsr-xr-x 1 root root 43088 Sep 16 2020 /bin/mount 260 32 -rwsr-xr-x 1 root root 30800 Aug 11 2016 /bin/fusermount 10512 44 -rwsr-xr-x 1 root root 44664 Nov 29 2022 /bin/su 13908 28 -rwsr-xr-x 1 root root 26696 Sep 16 2020 /bin/umount 1870 64 -rwsr-xr-x 1 root root 64424 Jun 28 2019 /bin/ping 140698 60 -rwsr-xr-x 1 root root 59640 Nov 29 2022 /usr/bin/passwd 135341 40 -rwxr-sr-x 1 root crontab 39352 May 10 2022 /usr/bin/crontab 134966 72 -rwxr-sr-x 1 root shadow 71816 Nov 29 2022 /usr/bin/chage 140696 24 -rwxr-sr-x 1 root shadow 22808 Nov 29 2022 /usr/bin/expiry 135509 76 -rwsr-xr-x 1 root root 76496 Nov 29 2022 /usr/bin/chfn 140697 76 -rwsr-xr-x 1 root root 75824 Nov 29 2022 /usr/bin/gpasswd 134139 148 -rwsr-xr-x 1 root root 149080 Apr 4 2023 /usr/bin/sudo 171124 32 -rwxr-sr-x 1 root tty 30800 Sep 16 2020 /usr/bin/wall 156500 44 -rwxr-sr-x 1 root mlocate 43088 Mar 1 2018 /usr/bin/mlocate 154304 20 -rwsr-xr-x 1 root root 18448 Jun 28 2019 /usr/bin/traceroute6.iputils 132099 40 -rwsr-xr-x 1 root root 40344 Nov 29 2022 /usr/bin/newgrp 135521 356 -rwxr-sr-x 1 root ssh 362640 Aug 11 2021 /usr/bin/ssh-agent 139447 44 -rwsr-xr-x 1 root root 44528 Nov 29 2022 /usr/bin/chsh 133012 16 -rwxr-sr-x 1 root tty 14328 Jan 17 2018 /usr/bin/bsd-write 137187 44 -rwsr-xr-- 1 root messagebus 42992 Oct 25 2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper 134415 12 -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device 264611 428 -rwsr-xr-x 1 root root 436552 Aug 11 2021 /usr/lib/openssh/ssh-keysign ## World-writable dirs in PATH drwxrwxr-x 2 myfifasalon myfifasalon 4096 Sep 17 11:40 /home/myfifasalon/bin drwxrwxr-x 2 myfifasalon myfifasalon 4096 Sep 30 22:36 /home/myfifasalon/.local/bin drwxr-xr-x 2 myfifasalon myfifasalon 4096 Sep 7 23:56 /home/myfifasalon/.nvm/versions/node/v24.21.0/bin drwxrwxr-x 2 myfifasalon myfifasalon 4096 Sep 17 11:40 /home/myfifasalon/bin drwxr-xr-x 2 root root 4096 Nov 28 2016 /usr/local/sbin drwxr-xr-x 2 root root 4096 Dec 14 2019 /usr/local/bin drwxr-xr-x 2 root root 12288 Jul 4 2023 /usr/sbin drwxr-xr-x 2 root root 36864 Jul 17 06:48 /usr/bin drwxr-xr-x 2 root root 12288 Jul 4 2023 /sbin drwxr-xr-x 2 root root 4096 Mar 8 2023 /bin drwxr-xr-x 2 root root 4096 Apr 12 2016 /usr/games drwxr-xr-x 2 root root 4096 Nov 28 2016 /usr/local/games ## Files I own with weird perms 795470 8 -rwxrwxrwx 1 root root 5415 Sep 19 2018 /home/myfifasalon/Virtualka\ (\320\272\320\276\320\277\320\270\321\217)/myfifasalon_v3/lib/python3.5/site-packages/pgadmin4/pgAdmin4.py 1088640 8 -rwxrwxrwx 1 root root 6048 Mar 20 2019 /home/myfifasalon/myfifasalon/gulpfile.js 1050130 136 -rwxrwxrwx 1 root root 137460 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/candara.ttf 1050139 136 -rwxrwxrwx 1 root root 137460 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/original-candara.ttf 1060474 704 -rwxrwxrwx 1 root root 719495 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/candara.svg 1060477 8 -rwxrwxrwx 1 root root 7536 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/revicons/revicons.woff 1060478 12 -rwxrwxrwx 1 root root 11968 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/revicons/revicons.ttf 1060479 16 -rwxrwxrwx 1 root root 13691 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/revicons/revicons.svg 1060480 12 -rwxrwxrwx 1 root root 12136 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/revicons/revicons.eot 1060481 0 -rwxrwxrwx 1 root root 0 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/revicons/index.php 1060497 156 -rwxrwxrwx 1 root root 159653 Jul 19 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Regular/Candara-Regular.ttf 1060498 112 -rwxrwxrwx 1 root root 114516 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Regular/Candara-Regular.woff 1060499 948 -rwxrwxrwx 1 root root 967042 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Regular/Candara-Regular.svg 1060500 160 -rwxrwxrwx 1 root root 159819 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Regular/Candara-Regular.eot 1060501 232 -rwxrwxrwx 1 root root 235528 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Regular/Candara-Regular.otf 1060521 80 -rwxrwxrwx 1 root root 80600 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/candara.woff 1060536 60 -rwxrwxrwx 1 root root 60168 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/candara.woff2 1060541 136 -rwxrwxrwx 1 root root 137626 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/candara.eot 1060546 112 -rwxrwxrwx 1 root root 114232 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Bold/Candara-Bold.woff 1060547 232 -rwxrwxrwx 1 root root 237288 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Bold/Candara-Bold.otf 1060548 160 -rwxrwxrwx 1 root root 161963 Jul 19 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Bold/Candara-Bold.ttf 1060549 940 -rwxrwxrwx 1 root root 960464 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Bold/Candara-Bold.svg 1060550 160 -rwxrwxrwx 1 root root 162133 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Bold/Candara-Bold.eot 1062376 4 -rwxrwxrwx 1 root root 1145 Jun 3 2018 /home/myfifasalon/myfifasalon/static/theme/1default/1sass/reset.sass 1361021 4 -rwxrwxrwx 1 root root 1139 Jun 30 2017 /home/myfifasalon/myfifasalon/static/theme/1default/css/reset.css 1360997 16 -rwxrwxrwx 1 root root 13706 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/css/jquery.fancybox.min.css 1361008 96 -rwxrwxrwx 1 root root 96417 Nov 8 2018 /home/myfifasalon/myfifasalon/static/theme/1default/production/old/1jquery.min.js 1062368 96 -rwxrwxrwx 1 root root 96417 Nov 8 2018 /home/myfifasalon/myfifasalon/static/theme/1default/1production/old/1jquery.min.js 1060554 4 -rwxrwxrwx 1 root root 2513 Mar 14 2018 /home/myfifasalon/myfifasalon/static/theme/1default/js/map-contacts.js 1061706 88 -rwxrwxrwx 1 root root 86659 Jun 14 2018 /home/myfifasalon/myfifasalon/static/theme/1default/js/jquery-3.2.1.min.js 1061765 8 -rwxrwxrwx 1 root root 6943 Nov 11 2018 /home/myfifasalon/myfifasalon/static/theme/1default/js/common.js 1061768 4 -rwxrwxrwx 1 root root 477 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/js/old/equal-height.js 1061769 0 -rwxrwxrwx 1 root root 0 Nov 8 2018 /home/myfifasalon/myfifasalon/static/theme/1default/js/common2.js 1062383 4 -rwxrwxrwx 1 root root 1139 Jun 30 2017 /home/myfifasalon/myfifasalon/static/theme/1default/1css/reset.css 1061688 16 -rwxrwxrwx 1 root root 13706 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/1css/jquery.fancybox.min.css 1361016 4 -rwxrwxrwx 1 root root 1145 Jun 3 2018 /home/myfifasalon/myfifasalon/static/theme/1default/sass/reset.sass 1485488 136 -rwxrwxrwx 1 root root 137460 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/candara.ttf 1485490 136 -rwxrwxrwx 1 root root 137460 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/original-candara.ttf 1485509 704 -rwxrwxrwx 1 root root 719495 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/candara.svg 1485512 8 -rwxrwxrwx 1 root root 7536 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/default/fonts/revicons/revicons.woff 1485513 12 -rwxrwxrwx 1 root root 11968 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/default/fonts/revicons/revicons.ttf 1485514 16 -rwxrwxrwx 1 root root 13691 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/default/fonts/revicons/revicons.svg 1485515 12 -rwxrwxrwx 1 root root 12136 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/default/fonts/revicons/revicons.eot 1485516 0 -rwxrwxrwx 1 root root 0 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/default/fonts/revicons/index.php 1616815 156 -rwxrwxrwx 1 root root 159653 Jul 19 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/Candara-Regular/Candara-Regular.ttf 1616816 112 -rwxrwxrwx 1 root root 114516 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/Candara-Regular/Candara-Regular.woff 1616817 948 -rwxrwxrwx 1 root root 967042 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/Candara-Regular/Candara-Regular.svg 1616818 160 -rwxrwxrwx 1 root root 159819 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/Candara-Regular/Candara-Regular.eot 1616819 232 -rwxrwxrwx 1 root root 235528 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/Candara-Regular/Candara-Regular.otf 1485550 80 -rwxrwxrwx 1 root root 80600 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/candara.woff 1485565 60 -rwxrwxrwx 1 root root 60168 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/candara.woff2 1485570 136 -rwxrwxrwx 1 root root 137626 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/candara.eot 1743201 112 -rwxrwxrwx 1 root root 114232 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/Candara-Bold/Candara-Bold.woff 1743202 232 -rwxrwxrwx 1 root root 237288 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/Candara-Bold/Candara-Bold.otf 1743203 160 -rwxrwxrwx 1 root root 161963 Jul 19 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/Candara-Bold/Candara-Bold.ttf 1743204 940 -rwxrwxrwx 1 root root 960464 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/Candara-Bold/Candara-Bold.svg 1743207 160 -rwxrwxrwx 1 root root 162133 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/fonts/Candara-Bold/Candara-Bold.eot 1485601 4 -rwxrwxrwx 1 root root 2757 Mar 18 2019 /home/myfifasalon/myfifasalon/static/theme/default/1js/map-contacts.js 1485605 88 -rwxrwxrwx 1 root root 86659 Jun 14 2018 /home/myfifasalon/myfifasalon/static/theme/default/1js/jquery-3.2.1.min.js 1485608 8 -rwxrwxrwx 1 root root 6010 Mar 20 2019 /home/myfifasalon/myfifasalon/static/theme/default/1js/common.js 1485612 4 -rwxrwxrwx 1 root root 477 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/1js/old/equal-height.js 1485613 0 -rwxrwxrwx 1 root root 0 Nov 8 2018 /home/myfifasalon/myfifasalon/static/theme/default/1js/common2.js 1485576 40 -rwxrwxrwx 1 root root 38078 Aug 4 2017 /home/myfifasalon/myfifasalon/static/theme/default/favicon.ico 1743222 1044 -rwxrwxrwx 1 root root 1068766 Aug 10 2017 /home/myfifasalon/myfifasalon/static/theme/default/img/\320\273\320\276\320\263\320\276\321\202\320\270\320\277\ \320\262\320\265\320\272\321\202\320\276\321\200.eps 1860402 52 -rwxrwxrwx 1 root root 52851 Jul 19 2017 /home/myfifasalon/myfifasalon/static/theme/default/img/original/price-3.jpg 1860403 12 -rwxrwxrwx 1 root root 12178 Jul 25 2017 /home/myfifasalon/myfifasalon/static/theme/default/img/original/logo2.png 1860404 1044 -rwxrwxrwx 1 root root 1068766 Aug 10 2017 /home/myfifasalon/myfifasalon/static/theme/default/img/original/\320\273\320\276\320\263\320\276\321\202\320\270\320\277\ \320\262\320\265\320\272\321\202\320\276\321\200.eps 1860416 48 -rwxrwxrwx 1 root root 45151 Jul 19 2017 /home/myfifasalon/myfifasalon/static/theme/default/img/original/price-2.jpg 1860434 32 -rwxrwxrwx 1 root root 30078 Jul 19 2017 /home/myfifasalon/myfifasalon/static/theme/default/img/original/price-1.jpg 1860437 276 -rwxrwxrwx 1 root root 280608 Aug 10 2017 /home/myfifasalon/myfifasalon/static/theme/default/img/original/\320\273\320\276\320\263\320\276\321\202\320\270\320\277\ \320\262\320\265\320\272\321\202\320\276\321\200.png 1860440 44 -rwxrwxrwx 1 root root 43381 Jul 19 2017 /home/myfifasalon/myfifasalon/static/theme/default/img/original/price-4.jpg 1860442 12 -rwxrwxrwx 1 root root 8196 Jun 7 2017 /home/myfifasalon/myfifasalon/static/theme/default/img/original/.DS_Store 1861918 4 -rwxrwxrwx 1 root root 1139 Jun 30 2017 /home/myfifasalon/myfifasalon/static/theme/default/css/reset.css 1860477 16 -rwxrwxrwx 1 root root 13706 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/css/jquery.fancybox.min.css 1487185 4 -rwxrwxrwx 1 root root 2757 Mar 18 2019 /home/myfifasalon/myfifasalon/static/theme/default/js/map-contacts.js 1487189 88 -rwxrwxrwx 1 root root 86659 Jun 14 2018 /home/myfifasalon/myfifasalon/static/theme/default/js/jquery-3.2.1.min.js 1487193 8 -rwxrwxrwx 1 root root 6010 Mar 20 2019 /home/myfifasalon/myfifasalon/static/theme/default/js/common.js 1487198 4 -rwxrwxrwx 1 root root 477 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/default/js/old/equal-height.js 1487199 0 -rwxrwxrwx 1 root root 0 Nov 8 2018 /home/myfifasalon/myfifasalon/static/theme/default/js/common2.js 1616931 4 -rwxrwxrwx 1 root root 1145 Jun 3 2018 /home/myfifasalon/myfifasalon/static/theme/default/sass/reset.sass 1179836 4 -rwxrwxrwx 1 root root 58 Oct 1 11:16 /home/myfifasalon/myfifasalon/configs/nginx_myfifasalon.conf 1583517 8 -rwxrwxrwx 1 www-data www-data 7166 Dec 14 2019 /home/myfifasalon/Virtualka/myfifasalon/lib/python3.6/site-packages/pgadmin4/pgAdmin4.py 1716152 8 -rwxrwxrwx 1 root root 7166 Dec 14 2019 /home/myfifasalon/Virtualka/newmyfifasalon/lib/python3.6/site-packages/pgadmin4/pgAdmin4.py 1601446 8 -rwxrwxrwx 1 www-data www-data 5415 Sep 19 2018 /home/myfifasalon/Virtualka/myfifasalon_v3/lib/python3.5/site-packages/pgadmin4/pgAdmin4.py ## My cron no crontab for myfifasalon ## System cron readable -rw-r--r-- 1 root root 722 Apr 5 2016 /etc/crontab /etc/cron.d: total 36 drwxr-xr-x 2 root root 4096 Dec 1 2022 . drwxr-xr-x 99 root root 12288 Sep 30 21:12 .. -rw-r--r-- 1 root root 485 Oct 27 2020 certbot -rw-r--r-- 1 root root 712 Aug 14 2019 php -rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder -rw-r--r-- 1 root root 191 Nov 28 2016 popularity-contest -rw-r--r-- 1 root root 396 Jan 27 2016 sysstat /etc/cron.daily: total 56 drwxr-xr-x 2 root root 4096 Jul 17 06:49 . drwxr-xr-x 99 root root 12288 Sep 30 21:12 .. -rwxr-xr-x 1 root root 1478 Sep 3 2019 apt-compat -rwxr-xr-x 1 root root 355 May 22 2012 bsdmainutils -rwxr-xr-x 1 root root 1176 Sep 5 2019 dpkg -rwxr-xr-x 1 root root 372 May 6 2015 logrotate -rwxr-xr-x 1 root root 1065 Apr 7 2018 man-db -rwxr-xr-x 1 root root 538 Mar 1 2018 mlocate -rwxr-xr-x 1 root root 249 Nov 12 2015 passwd -rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder -rwxr-xr-x 1 root root 3477 Feb 21 2018 popularity-contest -rwxr-xr-x 1 root root 441 Jan 27 2016 sysstat /etc/cron.hourly: total 20 drwxr-xr-x 2 root root 4096 May 12 2022 . drwxr-xr-x 99 root root 12288 Sep 30 21:12 .. -rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder /etc/cron.monthly: total 20 drwxr-xr-x 2 root root 4096 May 12 2022 . drwxr-xr-x 99 root root 12288 Sep 30 21:12 .. -rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder /etc/cron.weekly: total 24 drwxr-xr-x 2 root root 4096 May 12 2022 . drwxr-xr-x 99 root root 12288 Sep 30 21:12 .. -rwxr-xr-x 1 root root 723 Apr 7 2018 man-db -rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do. SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # m h dom mon dow user command 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) # ## My SSH keys total 12 drwx------ 2 myfifasalon myfifasalon 4096 Oct 4 10:44 . drwxr-xr-x 15 myfifasalon myfifasalon 4096 Oct 15 12:16 .. -rw------- 1 myfifasalon myfifasalon 883 Sep 17 11:31 authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCqZPxvVBICXGw4bHjBNmJnL+JkVqiCGP6mdmMkin8X6yr7EclGezR/rnFd2xfVjUQ/32Z0XF96bmv306+qq4eI5zKcPCJctLgRb0E6CT/ZdpSUKzh+CXJawybNCy4xJxQrqfnuvbyYYdgDgHa+bHox59+dacQIGZ4qXJ3WctCI+olKPYal/aGCSqOoW5AT9XOI5x4/kfsHDPwef/4nJ1M2yb5F94mHh4+spdaJN/KDvKKiB4S+QvcyWaJYQf48Qqb3R7VS6sKnVE/VrWfXxZqfshCuUYvIivOs2nHVmTXYxus6dGlrUmidKZDDSLE9OxDbUi332Nxh6Q/BxrFKTvG+0tbZsJdXQiKJj/dHmbgsqR8gaUfzJfZsgAMfdiTh8hCbYTTq7tIjQ7pXhiX8Q7lq4mq1AeCoy3lZ//5bt81mlVsJ2Pn+TZv6vnA2pDptzLTqf+VctPuAio6V+kU3C/gZ4romKfFJXSSyboiJ0eJADKrYTnzOeDpxl6OWGo3Ad5E= admin ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID2rtZ9snsDxW2YYT9EbxLwjXCEKij2hQwNHGjP9WR7G ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID2rtZ9snsDxW2YYT9EbxLwjXCEKij2hQwNHGjP9WR7G ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID2rtZ9snsDxW2YYT9EbxLwjXCEKij2hQwNHGjP9WR7G ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID2rtZ9snsDxW2YYT9EbxLwjXCEKij2hQwNHGjP9WR7G ## My processes PID PPID USER CMD 6241 6206 myfifas+ sshd: myfifasalon@pts/0 6242 6241 myfifas+ \_ -bash 6768 6242 myfifas+ \_ bash -c R="$HOME/vps_audit_$(date +%F_%H%M%S).txt"; { echo "===== USER-LEVEL AUDIT $(date) ====="; echo "## Identity"; id; whoami; hostname; uname -a; uptime; echo "## My account info"; getent passwd "$USER"; groups; echo "## Sudo access (no pass)"; sudo -n -l 2>&1; echo "## SUID/SGID readable"; find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -ls 2>/dev/null; echo "## World-writable dirs in PATH"; echo "$PATH" | tr ":" "\n" | while read d; do ls -ld "$d" 2>/dev/null; done; echo "## Files I own with weird perms"; find "$HOME" -xdev -type f \( -perm -4000 -o -perm -2000 -o -perm -0002 \) -ls 2>/dev/null; echo "## My cron"; crontab -l 2>&1; echo "## System cron readable"; ls -la /etc/cron* 2>/dev/null; cat /etc/crontab 2>/dev/null; echo "## My SSH keys"; ls -la ~/.ssh 2>/dev/null; cat ~/.ssh/authorized_keys 2>/dev/null; echo "## My processes"; ps -u "$USER" -o pid,ppid,user,cmd --forest 2>/dev/null; echo "## All processes (visible)"; ps auxww 2>/dev/null; echo "## Listening ports"; ss -tulpn 2>/dev/null || netstat -tulpn 2>/dev/null; echo "## Established connections"; ss -tnp 2>/dev/null || netstat -tnp 2>/dev/null; echo "## Recently modified files in HOME (7d)"; find "$HOME" -xdev -type f -mtime -7 -ls 2>/dev/null | head -100; echo "## Recently modified in /tmp /var/tmp /dev/shm"; find /tmp /var/tmp /dev/shm -type f -mtime -7 -ls 2>/dev/null | head -100; echo "## My logins"; last -a 2>/dev/null | head -30; who -a; w; echo "## Failed logins (if readable)"; lastb -a 2>/dev/null | head -20; echo "## Environment"; env | sort; echo "## LD_PRELOAD"; echo "LD_PRELOAD=$LD_PRELOAD"; cat /etc/ld.so.preload 2>/dev/null; echo "## Kernel/modules"; lsmod 2>/dev/null | head; cat /proc/version; echo "## Writable sensitive files check"; for f in /etc/passwd /etc/shadow /etc/sudoers /etc/crontab ~/.bashrc ~/.profile; do [ -w "$f" ] && echo "WRITABLE: $f"; done; echo "## Capabilities (own binaries)"; getcap -r "$HOME" 2>/dev/null; echo "===== END ====="; } | tee "$R"; echo "SAVED: $R" 6771 6768 myfifas+ \_ bash -c R="$HOME/vps_audit_$(date +%F_%H%M%S).txt"; { echo "===== USER-LEVEL AUDIT $(date) ====="; echo "## Identity"; id; whoami; hostname; uname -a; uptime; echo "## My account info"; getent passwd "$USER"; groups; echo "## Sudo access (no pass)"; sudo -n -l 2>&1; echo "## SUID/SGID readable"; find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -ls 2>/dev/null; echo "## World-writable dirs in PATH"; echo "$PATH" | tr ":" "\n" | while read d; do ls -ld "$d" 2>/dev/null; done; echo "## Files I own with weird perms"; find "$HOME" -xdev -type f \( -perm -4000 -o -perm -2000 -o -perm -0002 \) -ls 2>/dev/null; echo "## My cron"; crontab -l 2>&1; echo "## System cron readable"; ls -la /etc/cron* 2>/dev/null; cat /etc/crontab 2>/dev/null; echo "## My SSH keys"; ls -la ~/.ssh 2>/dev/null; cat ~/.ssh/authorized_keys 2>/dev/null; echo "## My processes"; ps -u "$USER" -o pid,ppid,user,cmd --forest 2>/dev/null; echo "## All processes (visible)"; ps auxww 2>/dev/null; echo "## Listening ports"; ss -tulpn 2>/dev/null || netstat -tulpn 2>/dev/null; echo "## Established connections"; ss -tnp 2>/dev/null || netstat -tnp 2>/dev/null; echo "## Recently modified files in HOME (7d)"; find "$HOME" -xdev -type f -mtime -7 -ls 2>/dev/null | head -100; echo "## Recently modified in /tmp /var/tmp /dev/shm"; find /tmp /var/tmp /dev/shm -type f -mtime -7 -ls 2>/dev/null | head -100; echo "## My logins"; last -a 2>/dev/null | head -30; who -a; w; echo "## Failed logins (if readable)"; lastb -a 2>/dev/null | head -20; echo "## Environment"; env | sort; echo "## LD_PRELOAD"; echo "LD_PRELOAD=$LD_PRELOAD"; cat /etc/ld.so.preload 2>/dev/null; echo "## Kernel/modules"; lsmod 2>/dev/null | head; cat /proc/version; echo "## Writable sensitive files check"; for f in /etc/passwd /etc/shadow /etc/sudoers /etc/crontab ~/.bashrc ~/.profile; do [ -w "$f" ] && echo "WRITABLE: $f"; done; echo "## Capabilities (own binaries)"; getcap -r "$HOME" 2>/dev/null; echo "===== END ====="; } | tee "$R"; echo "SAVED: $R" 6811 6771 myfifas+ | \_ ps -u myfifasalon -o pid,ppid,user,cmd --forest 6772 6768 myfifas+ \_ tee /home/myfifasalon/vps_audit_2026-10-15_121634.txt 6208 1 myfifas+ /lib/systemd/systemd --user 6209 6208 myfifas+ \_ (sd-pam) ## All processes (visible) USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.3 225224 3536 ? Ss 2024 241:24 /sbin/init root 2 0.0 0.0 0 0 ? S 2024 0:13 [kthreadd] root 4 0.0 0.0 0 0 ? I< 2024 0:00 [kworker/0:0H] root 6 0.0 0.0 0 0 ? I< 2024 0:00 [mm_percpu_wq] root 7 0.1 0.0 0 0 ? S 2024 1471:59 [ksoftirqd/0] root 8 0.0 0.0 0 0 ? I 2024 543:50 [rcu_sched] root 9 0.0 0.0 0 0 ? I 2024 0:00 [rcu_bh] root 10 0.0 0.0 0 0 ? S 2024 0:09 [migration/0] root 11 0.0 0.0 0 0 ? S 2024 2:35 [watchdog/0] root 12 0.0 0.0 0 0 ? S 2024 0:00 [cpuhp/0] root 13 0.0 0.0 0 0 ? S 2024 0:00 [cpuhp/1] root 14 0.0 0.0 0 0 ? S 2024 2:34 [watchdog/1] root 15 0.0 0.0 0 0 ? S 2024 0:06 [migration/1] root 16 0.1 0.0 0 0 ? S 2024 1566:23 [ksoftirqd/1] root 18 0.0 0.0 0 0 ? I< 2024 0:00 [kworker/1:0H] root 19 0.0 0.0 0 0 ? S 2024 0:00 [kdevtmpfs] root 20 0.0 0.0 0 0 ? I< 2024 0:00 [netns] root 21 0.0 0.0 0 0 ? S 2024 0:00 [rcu_tasks_kthre] root 22 0.0 0.0 0 0 ? S 2024 0:00 [kauditd] root 24 0.0 0.0 0 0 ? S 2024 1:39 [khungtaskd] root 25 0.0 0.0 0 0 ? S 2024 0:00 [oom_reaper] root 26 0.0 0.0 0 0 ? I< 2024 0:00 [writeback] root 27 0.0 0.0 0 0 ? S 2024 0:00 [kcompactd0] root 28 0.0 0.0 0 0 ? SN 2024 0:00 [ksmd] root 29 0.0 0.0 0 0 ? SN 2024 0:00 [khugepaged] root 30 0.0 0.0 0 0 ? I< 2024 0:00 [crypto] root 31 0.0 0.0 0 0 ? I< 2024 0:00 [kintegrityd] root 32 0.0 0.0 0 0 ? I< 2024 0:00 [kblockd] root 33 0.0 0.0 0 0 ? I< 2024 0:00 [ata_sff] root 34 0.0 0.0 0 0 ? I< 2024 0:00 [md] root 35 0.0 0.0 0 0 ? I< 2024 0:00 [edac-poller] root 36 0.0 0.0 0 0 ? I< 2024 0:00 [devfreq_wq] root 37 0.0 0.0 0 0 ? I< 2024 0:00 [watchdogd] root 39 0.0 0.0 0 0 ? S 2024 9:27 [kswapd0] root 40 0.0 0.0 0 0 ? I< 2024 0:00 [kworker/u5:0] root 41 0.0 0.0 0 0 ? S 2024 0:00 [ecryptfs-kthrea] root 84 0.0 0.0 0 0 ? I< 2024 0:00 [kthrotld] root 85 0.0 0.0 0 0 ? I< 2024 0:00 [acpi_thermal_pm] root 86 0.0 0.0 0 0 ? S 2024 0:00 [scsi_eh_0] root 87 0.0 0.0 0 0 ? I< 2024 0:00 [scsi_tmf_0] root 88 0.0 0.0 0 0 ? S 2024 0:00 [scsi_eh_1] root 89 0.0 0.0 0 0 ? I< 2024 0:00 [scsi_tmf_1] root 95 0.0 0.0 0 0 ? I< 2024 0:00 [ipv6_addrconf] root 105 0.0 0.0 0 0 ? I< 2024 0:00 [kstrp] root 122 0.0 0.0 0 0 ? I< 2024 0:00 [charger_manager] root 188 0.0 0.0 0 0 ? I< 2024 2:47 [kworker/0:1H] root 190 0.0 0.0 0 0 ? S 2024 24:11 [jbd2/vda1-8] root 191 0.0 0.0 0 0 ? I< 2024 0:00 [ext4-rsv-conver] root 221 0.0 0.0 0 0 ? I< 2024 12:47 [kworker/1:1H] root 239 0.0 1.7 475448 17776 ? S&1; echo "## SUID/SGID readable"; find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -ls 2>/dev/null; echo "## World-writable dirs in PATH"; echo "$PATH" | tr ":" "\n" | while read d; do ls -ld "$d" 2>/dev/null; done; echo "## Files I own with weird perms"; find "$HOME" -xdev -type f \( -perm -4000 -o -perm -2000 -o -perm -0002 \) -ls 2>/dev/null; echo "## My cron"; crontab -l 2>&1; echo "## System cron readable"; ls -la /etc/cron* 2>/dev/null; cat /etc/crontab 2>/dev/null; echo "## My SSH keys"; ls -la ~/.ssh 2>/dev/null; cat ~/.ssh/authorized_keys 2>/dev/null; echo "## My processes"; ps -u "$USER" -o pid,ppid,user,cmd --forest 2>/dev/null; echo "## All processes (visible)"; ps auxww 2>/dev/null; echo "## Listening ports"; ss -tulpn 2>/dev/null || netstat -tulpn 2>/dev/null; echo "## Established connections"; ss -tnp 2>/dev/null || netstat -tnp 2>/dev/null; echo "## Recently modified files in HOME (7d)"; find "$HOME" -xdev -type f -mtime -7 -ls 2>/dev/null | head -100; echo "## Recently modified in /tmp /var/tmp /dev/shm"; find /tmp /var/tmp /dev/shm -type f -mtime -7 -ls 2>/dev/null | head -100; echo "## My logins"; last -a 2>/dev/null | head -30; who -a; w; echo "## Failed logins (if readable)"; lastb -a 2>/dev/null | head -20; echo "## Environment"; env | sort; echo "## LD_PRELOAD"; echo "LD_PRELOAD=$LD_PRELOAD"; cat /etc/ld.so.preload 2>/dev/null; echo "## Kernel/modules"; lsmod 2>/dev/null | head; cat /proc/version; echo "## Writable sensitive files check"; for f in /etc/passwd /etc/shadow /etc/sudoers /etc/crontab ~/.bashrc ~/.profile; do [ -w "$f" ] && echo "WRITABLE: $f"; done; echo "## Capabilities (own binaries)"; getcap -r "$HOME" 2>/dev/null; echo "===== END ====="; } | tee "$R"; echo "SAVED: $R" myfifas+ 6771 0.0 0.2 13008 2136 pts/0 S+ 12:16 0:00 bash -c R="$HOME/vps_audit_$(date +%F_%H%M%S).txt"; { echo "===== USER-LEVEL AUDIT $(date) ====="; echo "## Identity"; id; whoami; hostname; uname -a; uptime; echo "## My account info"; getent passwd "$USER"; groups; echo "## Sudo access (no pass)"; sudo -n -l 2>&1; echo "## SUID/SGID readable"; find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -ls 2>/dev/null; echo "## World-writable dirs in PATH"; echo "$PATH" | tr ":" "\n" | while read d; do ls -ld "$d" 2>/dev/null; done; echo "## Files I own with weird perms"; find "$HOME" -xdev -type f \( -perm -4000 -o -perm -2000 -o -perm -0002 \) -ls 2>/dev/null; echo "## My cron"; crontab -l 2>&1; echo "## System cron readable"; ls -la /etc/cron* 2>/dev/null; cat /etc/crontab 2>/dev/null; echo "## My SSH keys"; ls -la ~/.ssh 2>/dev/null; cat ~/.ssh/authorized_keys 2>/dev/null; echo "## My processes"; ps -u "$USER" -o pid,ppid,user,cmd --forest 2>/dev/null; echo "## All processes (visible)"; ps auxww 2>/dev/null; echo "## Listening ports"; ss -tulpn 2>/dev/null || netstat -tulpn 2>/dev/null; echo "## Established connections"; ss -tnp 2>/dev/null || netstat -tnp 2>/dev/null; echo "## Recently modified files in HOME (7d)"; find "$HOME" -xdev -type f -mtime -7 -ls 2>/dev/null | head -100; echo "## Recently modified in /tmp /var/tmp /dev/shm"; find /tmp /var/tmp /dev/shm -type f -mtime -7 -ls 2>/dev/null | head -100; echo "## My logins"; last -a 2>/dev/null | head -30; who -a; w; echo "## Failed logins (if readable)"; lastb -a 2>/dev/null | head -20; echo "## Environment"; env | sort; echo "## LD_PRELOAD"; echo "LD_PRELOAD=$LD_PRELOAD"; cat /etc/ld.so.preload 2>/dev/null; echo "## Kernel/modules"; lsmod 2>/dev/null | head; cat /proc/version; echo "## Writable sensitive files check"; for f in /etc/passwd /etc/shadow /etc/sudoers /etc/crontab ~/.bashrc ~/.profile; do [ -w "$f" ] && echo "WRITABLE: $f"; done; echo "## Capabilities (own binaries)"; getcap -r "$HOME" 2>/dev/null; echo "===== END ====="; } | tee "$R"; echo "SAVED: $R" myfifas+ 6772 0.0 0.0 7484 636 pts/0 R+ 12:16 0:00 tee /home/myfifasalon/vps_audit_2026-10-15_121634.txt root 6803 0.3 0.5 72304 5460 ? Ss 12:16 0:00 sshd: [accepted] root 6804 0.0 0.0 0 0 ? I 12:16 0:00 [kworker/u4:2] sshd 6805 0.0 0.3 72304 3068 ? S 12:16 0:00 sshd: [net] myfifas+ 6812 0.0 0.3 37376 3292 pts/0 R+ 12:16 0:00 ps auxww www-data 7599 0.0 0.3 150676 3388 ? S Aug20 1:39 nginx: worker process www-data 7600 0.0 0.3 152080 3556 ? S Aug20 21:46 nginx: worker process root 7988 0.0 0.0 0 0 ? I Oct07 0:18 [kworker/0:0] root 9245 0.0 0.0 145404 272 ? Ss 2025 0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on; root 27965 0.0 0.0 0 0 ? I 06:00 0:01 [kworker/u4:1] root 28287 0.0 0.0 16188 0 tty1 Ss+ Jun17 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux root 29929 0.0 0.0 0 0 ? I 07:28 0:01 [kworker/u4:0] ## Listening ports Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* tcp LISTEN 0 80 127.0.0.1:3306 0.0.0.0:* tcp LISTEN 0 128 0.0.0.0:80 0.0.0.0:* tcp LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:* tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* tcp LISTEN 0 128 127.0.0.1:5432 0.0.0.0:* tcp LISTEN 0 128 127.0.0.1:5433 0.0.0.0:* tcp LISTEN 0 128 0.0.0.0:5050 0.0.0.0:* tcp LISTEN 0 128 0.0.0.0:443 0.0.0.0:* tcp LISTEN 0 128 [::]:80 [::]:* tcp LISTEN 0 128 [::]:22 [::]:* tcp LISTEN 0 128 [::1]:5432 [::]:* tcp LISTEN 0 128 [::1]:5433 [::]:* ## Established connections State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 92.53.107.208:5050 193.124.20.249:31071 ESTAB 0 0 92.53.107.208:5050 194.50.235.150:20026 ESTAB 0 0 92.53.107.208:5050 69.5.169.73:39016 ESTAB 0 0 92.53.107.208:5050 193.176.31.225:46319 ESTAB 0 0 92.53.107.208:5050 69.5.169.57:47472 ESTAB 0 0 92.53.107.208:5050 69.5.169.78:34718 ESTAB 0 0 92.53.107.208:5050 193.176.31.236:30288 ESTAB 0 0 92.53.107.208:5050 193.124.20.235:41567 ESTAB 0 0 92.53.107.208:5050 213.166.84.61:57011 ESTAB 0 0 92.53.107.208:5050 217.146.80.108:20102 ESTAB 0 0 92.53.107.208:5050 5.252.83.232:44607 ESTAB 0 0 92.53.107.208:5050 81.19.219.251:64102 ESTAB 0 0 92.53.107.208:5050 193.176.29.30:50596 ESTAB 0 0 92.53.107.208:5050 123.160.223.74:48121 ESTAB 0 0 92.53.107.208:5050 69.5.169.181:16620 ESTAB 0 0 92.53.107.208:5050 69.5.169.40:25234 ESTAB 0 25728 92.53.107.208:22 104.28.154.46:58685 ESTAB 0 0 92.53.107.208:5050 69.5.169.98:58310 ESTAB 0 0 92.53.107.208:5050 137.74.181.252:56667 ESTAB 0 0 92.53.107.208:5050 66.132.153.127:55234 ESTAB 0 0 92.53.107.208:5050 194.88.98.107:48929 ESTAB 0 0 92.53.107.208:5050 81.19.219.217:23268 ESTAB 0 0 92.53.107.208:5050 193.124.20.246:20792 ESTAB 0 0 92.53.107.208:5050 69.5.169.138:30613 ESTAB 0 0 92.53.107.208:5050 194.88.98.106:53036 ESTAB 0 0 92.53.107.208:5050 66.132.153.126:27182 ESTAB 0 0 92.53.107.208:5050 193.176.31.152:38252 ESTAB 0 0 92.53.107.208:5050 5.252.83.253:37720 ESTAB 0 0 92.53.107.208:5050 91.196.152.116:33961 ESTAB 0 0 92.53.107.208:5050 193.124.20.250:17004 ESTAB 0 0 92.53.107.208:5050 45.133.173.250:63876 ESTAB 0 0 92.53.107.208:5050 69.5.169.147:55169 ESTAB 0 0 92.53.107.208:5050 159.65.237.176:61000 ESTAB 0 0 92.53.107.208:5050 167.94.138.36:37634 ESTAB 0 0 92.53.107.208:5050 5.252.83.166:29105 ESTAB 0 0 92.53.107.208:5050 27.115.124.40:30500 ESTAB 0 0 92.53.107.208:5050 5.252.83.79:56221 ESTAB 0 0 92.53.107.208:5050 52.210.151.115:19185 ESTAB 0 0 92.53.107.208:5050 194.88.98.90:39502 ESTAB 0 0 92.53.107.208:5050 193.176.31.153:43310 ESTAB 0 0 92.53.107.208:5050 206.123.145.4:31618 ESTAB 0 0 92.53.107.208:5050 220.197.51.135:48559 ESTAB 0 0 92.53.107.208:5050 66.132.153.141:2416 ESTAB 0 0 92.53.107.208:5050 69.5.169.178:49760 ESTAB 0 0 92.53.107.208:5050 69.5.169.63:48960 ESTAB 0 0 92.53.107.208:5050 185.216.145.172:52603 ESTAB 0 0 92.53.107.208:5050 193.32.209.240:20687 ESTAB 0 0 92.53.107.208:5050 185.223.235.34:22110 ESTAB 0 0 92.53.107.208:5050 217.146.80.105:51013 ESTAB 0 0 92.53.107.208:5050 193.32.209.238:22603 ESTAB 0 0 92.53.107.208:5050 47.250.142.129:11460 ESTAB 0 0 92.53.107.208:5050 69.5.169.234:57754 ESTAB 0 0 92.53.107.208:5050 179.43.186.220:62282 ESTAB 0 0 92.53.107.208:5050 193.176.31.247:18072 ESTAB 0 0 92.53.107.208:5050 200.138.46.148:24993 ESTAB 0 0 92.53.107.208:5050 193.176.31.230:18586 ESTAB 0 0 92.53.107.208:5050 193.176.31.154:59268 ESTAB 0 0 92.53.107.208:5050 69.5.169.15:48996 ESTAB 0 0 92.53.107.208:5050 69.5.169.231:60988 ESTAB 0 0 92.53.107.208:5050 69.5.169.159:24666 ESTAB 0 0 92.53.107.208:5050 5.252.83.74:20342 ESTAB 0 0 92.53.107.208:5050 217.151.76.98:60243 ESTAB 0 0 92.53.107.208:5050 199.45.155.92:63120 ESTAB 0 0 92.53.107.208:5050 194.88.98.89:64118 ESTAB 0 0 92.53.107.208:5050 5.226.140.19:48741 ESTAB 0 0 92.53.107.208:5050 69.5.169.240:17675 ESTAB 0 0 92.53.107.208:5050 69.5.169.99:60922 ESTAB 0 0 92.53.107.208:5050 8.221.141.33:47576 ESTAB 0 0 92.53.107.208:5050 64.227.18.98:33273 ESTAB 0 0 92.53.107.208:5050 81.19.219.194:23865 ESTAB 0 0 92.53.107.208:5050 69.5.169.171:17854 ESTAB 0 0 92.53.107.208:5050 8.211.37.65:26500 ESTAB 0 0 92.53.107.208:5050 69.5.169.184:44314 ESTAB 0 0 92.53.107.208:5050 194.88.98.93:59157 ESTAB 0 0 92.53.107.208:5050 193.176.29.2:35193 ESTAB 0 0 92.53.107.208:5050 47.74.63.114:18074 ESTAB 0 0 92.53.107.208:5050 112.112.212.90:41922 ESTAB 0 0 92.53.107.208:5050 89.21.67.140:41717 ESTAB 0 0 92.53.107.208:5050 69.5.169.183:33792 ESTAB 0 0 92.53.107.208:5050 87.250.9.79:53794 ESTAB 0 0 92.53.107.208:5050 154.16.44.218:40837 ESTAB 0 0 92.53.107.208:5050 89.21.67.176:25235 ESTAB 0 0 92.53.107.208:5050 194.88.98.86:29038 ESTAB 0 0 92.53.107.208:5050 185.216.145.177:36525 ESTAB 0 0 92.53.107.208:5050 45.133.173.189:54333 ESTAB 0 0 92.53.107.208:5050 69.5.169.104:63543 ESTAB 0 0 92.53.107.208:5050 81.19.216.77:39620 ESTAB 0 0 92.53.107.208:5050 193.124.20.246:20306 ESTAB 0 0 92.53.107.208:5050 69.5.169.4:24413 ESTAB 0 0 92.53.107.208:22 23.95.18.196:46360 ESTAB 0 0 92.53.107.208:5050 195.160.245.8:51384 ESTAB 0 0 92.53.107.208:5050 69.5.169.55:51332 ESTAB 0 0 92.53.107.208:5050 69.5.169.5:36684 ESTAB 0 0 92.53.107.208:5050 188.240.59.10:19169 ESTAB 0 0 92.53.107.208:5050 69.5.169.198:48545 ESTAB 0 0 92.53.107.208:5050 34.253.213.201:2683 ESTAB 0 0 92.53.107.208:5050 193.176.31.246:23048 ESTAB 0 0 92.53.107.208:5050 193.176.29.13:33741 ESTAB 0 0 92.53.107.208:5050 195.140.214.21:46707 ESTAB 0 0 92.53.107.208:5050 213.166.84.35:19980 ESTAB 0 0 92.53.107.208:5050 194.88.98.84:47817 ESTAB 0 0 92.53.107.208:5050 137.74.181.255:50287 ESTAB 0 0 92.53.107.208:5050 193.124.20.236:49457 ESTAB 0 0 92.53.107.208:5050 193.176.31.147:29263 ESTAB 0 0 92.53.107.208:5050 69.5.169.113:61993 ESTAB 0 0 92.53.107.208:5050 47.250.81.19:12266 ESTAB 0 0 92.53.107.208:5050 69.5.169.187:34121 ESTAB 0 0 92.53.107.208:5050 69.5.169.230:19155 ESTAB 0 0 92.53.107.208:5050 193.176.31.223:34579 ESTAB 0 0 92.53.107.208:5050 85.217.140.23:49534 ESTAB 0 0 92.53.107.208:5050 8.221.141.128:34778 ESTAB 0 0 92.53.107.208:5050 217.146.80.126:17656 ESTAB 0 0 92.53.107.208:5050 122.231.191.3:56252 ESTAB 0 0 92.53.107.208:5050 213.248.24.254:57388 ESTAB 0 0 92.53.107.208:5050 179.43.186.220:62804 ESTAB 0 0 92.53.107.208:5050 69.5.169.149:36517 ESTAB 0 0 92.53.107.208:5050 193.176.31.217:27833 ESTAB 0 0 92.53.107.208:5050 69.5.169.97:25203 ESTAB 0 0 92.53.107.208:5050 31.14.254.45:43990 ESTAB 0 0 92.53.107.208:5050 66.132.153.128:16442 ESTAB 0 0 92.53.107.208:5050 188.17.156.224:55511 ESTAB 0 0 92.53.107.208:5050 64.205.72.79:56914 ESTAB 0 0 92.53.107.208:5050 66.132.153.119:27832 ESTAB 0 0 92.53.107.208:5050 193.176.31.157:25126 ESTAB 0 0 92.53.107.208:5050 193.176.29.30:29491 ESTAB 0 0 92.53.107.208:5050 193.124.20.243:42679 ESTAB 0 0 92.53.107.208:5050 45.133.173.42:31645 ESTAB 0 0 92.53.107.208:5050 69.5.169.137:35218 ESTAB 0 0 92.53.107.208:5050 69.5.169.48:2188 ESTAB 0 0 92.53.107.208:5050 47.74.35.75:11778 ESTAB 0 0 92.53.107.208:5050 69.5.169.66:19725 ESTAB 0 0 92.53.107.208:5050 185.247.137.220:59717 ESTAB 0 0 92.53.107.208:5050 81.19.219.198:18659 ESTAB 0 0 92.53.107.208:5050 199.45.155.92:37318 ESTAB 0 0 92.53.107.208:5050 193.124.20.253:11308 ESTAB 0 0 92.53.107.208:5050 69.5.169.69:27555 ESTAB 0 0 92.53.107.208:5050 31.14.254.84:47778 ESTAB 0 0 92.53.107.208:5050 194.88.98.101:20784 ESTAB 0 0 92.53.107.208:5050 69.5.169.118:51815 ESTAB 0 0 92.53.107.208:5050 2.57.17.40:17201 ESTAB 0 0 92.53.107.208:5050 69.5.169.168:39851 ESTAB 0 0 92.53.107.208:5050 89.21.67.172:47507 ESTAB 0 0 92.53.107.208:5050 165.154.135.215:59868 ESTAB 0 0 92.53.107.208:5050 159.223.184.214:61000 ESTAB 0 0 92.53.107.208:5050 36.255.97.33:44144 ESTAB 0 0 92.53.107.208:5050 69.5.169.200:41633 ESTAB 0 0 92.53.107.208:5050 81.19.219.220:50620 ESTAB 0 0 92.53.107.208:5050 193.124.20.243:54515 ESTAB 0 0 92.53.107.208:5050 31.14.254.33:22616 ESTAB 0 0 92.53.107.208:5050 34.253.213.201:49414 ESTAB 0 0 92.53.107.208:5050 89.21.67.161:43819 ESTAB 0 0 92.53.107.208:5050 45.33.109.8:48453 ESTAB 0 0 92.53.107.208:5050 69.5.169.52:64710 ESTAB 0 0 92.53.107.208:5050 91.196.152.35:44819 ESTAB 0 0 92.53.107.208:5050 89.21.67.151:54837 ESTAB 0 0 92.53.107.208:5050 81.19.216.108:26338 ESTAB 0 0 92.53.107.208:5050 193.124.20.249:24814 ESTAB 0 0 92.53.107.208:5050 69.5.169.106:46493 ESTAB 0 0 92.53.107.208:5050 159.223.179.74:61000 ESTAB 0 0 92.53.107.208:5050 195.140.214.24:22607 ESTAB 0 0 92.53.107.208:5050 195.206.182.222:47692 ESTAB 0 0 92.53.107.208:5050 213.248.24.254:52273 ESTAB 0 0 92.53.107.208:5050 193.176.31.243:26172 ESTAB 0 0 92.53.107.208:5050 185.223.235.38:34095 ESTAB 0 0 92.53.107.208:5050 37.10.113.217:3952 ESTAB 0 0 92.53.107.208:5050 217.146.80.108:22700 ESTAB 0 0 92.53.107.208:5050 69.5.169.245:40818 ESTAB 0 0 92.53.107.208:5050 69.5.169.184:46455 ESTAB 0 0 92.53.107.208:5050 69.5.169.214:56385 ESTAB 0 0 92.53.107.208:5050 31.14.254.115:43689 ESTAB 0 0 92.53.107.208:5050 185.223.235.52:60374 ESTAB 0 0 92.53.107.208:5050 188.240.59.26:44982 ESTAB 0 0 92.53.107.208:5050 69.5.169.175:33171 ESTAB 0 0 92.53.107.208:5050 194.50.235.138:60332 ESTAB 0 0 92.53.107.208:5050 194.195.210.47:54204 ESTAB 0 0 92.53.107.208:5050 194.88.98.92:28073 ESTAB 0 0 92.53.107.208:5050 69.5.169.6:46164 ESTAB 0 0 92.53.107.208:5050 193.176.31.155:28768 ESTAB 0 0 92.53.107.208:5050 89.37.172.131:46222 ESTAB 0 0 92.53.107.208:5050 2.57.17.184:36924 ESTAB 0 0 92.53.107.208:5050 154.16.44.118:23455 ESTAB 0 0 92.53.107.208:5050 157.230.178.76:61000 ESTAB 0 0 92.53.107.208:5050 194.88.98.103:50219 ESTAB 0 0 92.53.107.208:5050 81.19.219.197:29296 ESTAB 0 0 92.53.107.208:5050 66.132.172.136:30088 ESTAB 0 0 92.53.107.208:5050 213.32.32.83:38987 ESTAB 0 0 92.53.107.208:5050 193.176.31.152:4046 ESTAB 0 0 92.53.107.208:5050 47.237.190.171:27436 ESTAB 0 0 92.53.107.208:5050 69.5.169.77:30781 ESTAB 0 0 92.53.107.208:5050 185.223.235.10:36348 ESTAB 0 0 92.53.107.208:5050 51.91.174.252:50777 ESTAB 0 0 92.53.107.208:5050 52.210.151.115:53062 ESTAB 0 0 92.53.107.208:5050 69.5.169.179:64986 ESTAB 0 0 92.53.107.208:5050 199.45.155.18:36672 ESTAB 0 0 92.53.107.208:5050 66.132.153.119:11422 ESTAB 0 0 92.53.107.208:5050 69.5.169.202:29887 ESTAB 0 0 92.53.107.208:5050 154.16.44.24:49496 ESTAB 0 0 92.53.107.208:5050 81.19.216.117:16753 ESTAB 0 0 92.53.107.208:5050 194.88.98.94:25122 ESTAB 0 0 92.53.107.208:5050 193.176.29.5:39399 ESTAB 0 0 92.53.107.208:5050 194.50.235.155:47822 ESTAB 0 0 92.53.107.208:5050 5.226.140.121:56261 ESTAB 0 0 92.53.107.208:5050 69.5.169.7:36028 ESTAB 0 0 92.53.107.208:5050 69.5.169.160:52193 ESTAB 0 0 92.53.107.208:5050 69.5.169.203:34128 ESTAB 0 0 92.53.107.208:5050 122.231.191.3:37164 ## Recently modified files in HOME (7d) 1466835 545640 -rw-r--r-- 1 www-data root 558728049 Oct 15 12:12 /home/myfifasalon/new_myfifasalon/logs/nginx_access.log 1466836 5784 -rw-r--r-- 1 www-data root 5916165 Oct 15 09:41 /home/myfifasalon/new_myfifasalon/logs/nginx_error.log 786509 88 -rw------- 1 myfifasalon myfifasalon 82937 Oct 14 15:38 /home/myfifasalon/.bash_history 809836 56 -rw-rw-r-- 1 myfifasalon myfifasalon 56948 Oct 15 12:16 /home/myfifasalon/vps_audit_2026-10-15_121634.txt 1179671 1235156 -rw-r--r-- 1 www-data root 1264791916 Oct 15 12:04 /home/myfifasalon/myfifasalon/logs/nginx_access.log 1179672 11560 -rw-r--r-- 1 www-data root 11829617 Oct 15 09:41 /home/myfifasalon/myfifasalon/logs/nginx_error.log ## Recently modified in /tmp /var/tmp /dev/shm ## My logins myfifasa pts/0 Thu Oct 15 12:06 still logged in 104.28.154.46 myfifasa pts/0 Wed Oct 14 15:37 - 15:38 (00:00) 154.53.57.37 myfifasa pts/0 Thu Oct 8 09:28 - 09:28 (00:00) 51.170.134.54 myfifasa pts/0 Wed Oct 7 16:04 - 16:06 (00:01) 51.170.134.54 myfifasa pts/0 Wed Oct 7 08:56 - 09:17 (00:21) 109.205.176.197 myfifasa pts/0 Wed Oct 7 08:19 - 08:38 (00:19) 109.205.176.197 myfifasa pts/0 Wed Oct 7 08:13 - 08:18 (00:05) 109.205.176.197 myfifasa pts/0 Wed Oct 7 08:10 - 08:13 (00:02) 109.205.176.197 myfifasa pts/0 Wed Oct 7 07:45 - 07:52 (00:07) 109.205.176.197 myfifasa pts/0 Tue Oct 6 18:45 - 19:17 (00:31) 105.129.244.180 myfifasa pts/0 Tue Oct 6 18:44 - 18:45 (00:00) 105.129.244.180 myfifasa pts/0 Tue Oct 6 11:52 - 12:07 (00:14) 57.131.151.159 myfifasa pts/0 Mon Oct 5 22:06 - 22:11 (00:05) 57.131.151.159 myfifasa pts/0 Mon Oct 5 21:34 - 21:35 (00:01) 171.244.39.67 myfifasa pts/0 Sun Oct 4 18:25 - 18:29 (00:04) 171.244.39.67 myfifasa pts/0 Sun Oct 4 18:19 - 18:23 (00:04) 171.244.39.67 myfifasa pts/0 Sun Oct 4 11:24 - 11:25 (00:01) 194.163.135.65 myfifasa pts/0 Sun Oct 4 10:28 - 10:44 (00:15) 194.163.135.65 myfifasa pts/0 Sat Oct 3 19:50 - 19:56 (00:05) 194.163.135.65 myfifasa pts/0 Sat Oct 3 19:49 - 19:50 (00:01) 194.163.135.65 myfifasa pts/0 Sat Oct 3 10:37 - 10:38 (00:00) 194.163.135.65 myfifasa pts/0 Thu Oct 1 17:17 - 17:18 (00:01) 217.77.8.203 myfifasa pts/0 Thu Oct 1 11:34 - 11:48 (00:13) 171.244.39.67 myfifasa pts/1 Thu Oct 1 11:17 - 11:34 (00:16) 171.244.39.67 myfifasa pts/0 Thu Oct 1 10:58 - 11:18 (00:20) 171.244.39.67 myfifasa pts/0 Thu Oct 1 09:43 - 09:45 (00:01) 172.239.124.4 myfifasa pts/0 Thu Oct 1 09:03 - 09:43 (00:40) 172.239.124.4 wtmp begins Thu Oct 1 09:03:08 2026 system boot 2024-06-10 13:37 run-level 5 2024-06-10 13:37 LOGIN ttyS0 2024-06-10 13:37 599 id=tyS0 LOGIN tty1 2026-06-17 12:36 28287 id=tty1 myfifasalon + pts/0 2026-10-15 12:06 . 6206 (104.28.154.46) pts/1 2026-10-01 11:34 14954 id=ts/1 term=0 exit=0 12:16:48 up 856 days, 22:39, 1 user, load average: 0.31, 0.08, 0.02 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT myfifasa pts/0 104.28.154.46 12:06 16.00s 0.11s 0.00s w ## Failed logins (if readable) ## Environment HOME=/home/myfifasalon LANG=en_US.UTF-8 LESSCLOSE=/usr/bin/lesspipe %s %s LESSOPEN=| /usr/bin/lesspipe %s LOGNAME=myfifasalon LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36: MAIL=/var/mail/myfifasalon NVM_BIN=/home/myfifasalon/.nvm/versions/node/v24.21.0/bin NVM_CD_FLAGS= NVM_DIR=/home/myfifasalon/.nvm NVM_INC=/home/myfifasalon/.nvm/versions/node/v24.21.0/include/node PATH=/home/myfifasalon/bin:/home/myfifasalon/.local/bin:/home/myfifasalon/.nvm/versions/node/v24.21.0/bin:/home/myfifasalon/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin PWD=/home/myfifasalon S_COLORS=auto SHELL=/bin/bash SHLVL=2 SSH_CLIENT=104.28.154.46 58685 22 SSH_CONNECTION=104.28.154.46 58685 92.53.107.208 22 SSH_TTY=/dev/pts/0 TERM=xterm-256color USER=myfifasalon _=/usr/bin/env XDG_RUNTIME_DIR=/run/user/1000 XDG_SESSION_ID=1411773 ## LD_PRELOAD LD_PRELOAD= ## Kernel/modules Module Size Used by udp_diag 16384 0 binfmt_misc 20480 1 tcp_diag 16384 0 inet_diag 24576 2 tcp_diag,udp_diag cirrus 24576 1 ttm 106496 1 cirrus drm_kms_helper 172032 1 cirrus input_leds 16384 0 joydev 24576 0 Linux version 4.15.0-213-generic (buildd@lcy02-amd64-079) (gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)) #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 ## Writable sensitive files check WRITABLE: /home/myfifasalon/.bashrc WRITABLE: /home/myfifasalon/.profile ## Capabilities (own binaries) ===== END =====