Hey guys, I saw this in my VPS when checking history:

    1  chmod +x /usr/lib/virt-sysprep/scripts/0001-swapoff--dev-vda2-mkswap--dev-vda2-swapon--dev-vda2-resize2f
    2  cat /usr/lib/virt-sysprep/scripts/0001-swapoff--dev-vda2-mkswap--dev-vda2-swapon--dev-vda2-resize2f
    3  vi /usr/lib/virt-sysprep/scripts/0001-swapoff--dev-vda2-mkswap--dev-vda2-swapon--dev-vda2-resize2f

here is the content of the script:

# cat /usr/lib/virt-sysprep/scripts/0001-swapoff--dev-vda2-mkswap--dev-vda2-swapon--dev-vda2-resize2f
swapoff /dev/vda2;mkswap /dev/vda2;swapon /dev/vda2;resize2fs /dev/vda1;yum -y update;systemctl disable guestfs-firstboot;reboot

This is a new server I provisioned on my VPS in racknerd. The command looks safe, but I’m wondering if these commands were executed on its own? Or someone has logged in to my VPS? This is also not normal, isn’t it?

EDIT:

confirmed, commands are still in history after reinstalling OS. As others have said, maybe the image builder ran commands and forgot to clear history

  • heyfrancisOPEnglish
    2·
    1 year ago

    good point, it’s just a test server for now so I’ll try to reinstall OS and check if same commands will show in history

    • heyfrancisOPEnglish
      1·
      1 year ago

      confirmed, commands are still in history after reinstalling OS. As others have said, maybe the image builder ran commands and forgot to clear history