sam/family_home_lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
2ed0ca80aefe0520c14c6c09051b232eb6d7280c
family_home_lab/docs/incident-2026-11-11/lmms-processes.txt
Sam Rolfe 2ed0ca80ae security: contain GIMP cryptominer + LMMS reverse-shell backdoor (2026-11-11) 
- Weblog desktops were unauthenticated and publicly reachable (entry vector)
- Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified
- Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth)
- GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined
- Removed /home/sam:ro mount from GIMP (was exposing secrets to the container)
- Service-controller restarted (was dead, which is why toggles did nothing)
- Incident record + captured payload in docs/incident-2026-11-11*
2026-11-11 17:02:00 +11:00

69 lines
7.5 KiB
Plaintext
Raw Blame History

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 444 8 ? Ss Nov05 0:00 /package/admin/s6/command/s6-svscan -d4 -- /run/service
root 17 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6-linux-init-shutdownd
root 20 0.0 0.0 216 8 ? Ss Nov05 0:00 /package/admin/s6-linux-init/command/s6-linux-init-shutdownd -d3 -c /run/s6/basedir -g 3000 -C -B
root 36 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-docker
root 37 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-xorg
root 38 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-xsettingsd
root 39 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-selkies
root 40 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-dbus
root 41 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-watchdog
root 42 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-de
root 43 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6rc-fdholder
root 44 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-cron
root 45 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-pulseaudio
root 46 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-nginx
root 47 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6rc-oneshot-runner
root 55 0.0 0.0 216 8 ? Ss Nov05 0:00 /package/admin/s6/command/s6-ipcserverd -1 -- /package/admin/s6/command/s6-ipcserver-access -v0 -E -l0 -i data/rules -- /package/admin/s6/command/s6-sudod -t 30000 -- /package/admin/s6-rc/command/s6-rc-oneshot-run -l ../.. --
root 255 0.0 0.0 16256 512 ? Ss Nov05 0:00 sleep infinity
abc 257 0.1 0.0 220800 2684 ? Ss Nov05 8:55 /usr/bin/Xvfb :1 -screen 0 2560x1440x24 -dpi 96 +extension COMPOSITE +extension DAMAGE +extension GLX +extension RANDR +extension RENDER +extension MIT-SHM +extension XFIXES +extension XTEST +iglx +render -nolisten tcp -ac -noreset -shmem
root 263 0.0 0.0 15456 532 ? Ss Nov05 0:00 nginx: master process /usr/sbin/nginx -g daemon off;
root 264 0.0 0.0 7616 560 ? Ss Nov05 0:00 bash ./run svc-cron
root 271 0.0 0.0 7616 532 ? Ss Nov05 0:00 bash ./run svc-docker
abc 272 0.0 0.0 584504 1388 ? Ssl Nov05 0:00 /usr/bin/pulseaudio --log-level=0 --log-target=stderr --exit-idle-time=-1
abc 273 0.0 0.0 8400 736 ? Ss Nov05 0:00 dbus-daemon --system --nofork --nosyslog
root 284 0.0 0.0 7616 552 ? Ss Nov05 0:00 bash ./run svc-xsettingsd
root 291 0.0 0.0 16256 540 ? S Nov05 0:00 sleep infinity
abc 293 0.9 0.0 205136 6904 ? Ss Nov05 78:44 /lsiopy/bin/python3 /lsiopy/bin/selkies --addr=localhost --mode=websockets
root 300 0.0 0.0 16256 536 ? S Nov05 0:00 sleep infinity
root 301 0.0 0.0 7720 552 ? Ss Nov05 0:00 bash ./run svc-de
root 324 0.0 0.0 16256 532 ? S Nov05 0:00 sleep infinity
www-data 329 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 330 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 331 0.0 0.0 15840 520 ? S Nov05 0:00 nginx: worker process
www-data 332 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 333 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 334 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 335 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 336 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 337 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 338 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 339 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 340 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
abc 350 0.0 0.0 7064 692 ? S Nov05 0:00 dbus-launch --autolaunch c3c643608a2c4d938fe0ff45bbc71a78 --binary-syntax --close-stderr
abc 358 0.0 0.0 8244 692 ? Ss Nov05 0:00 /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
abc 378 0.0 0.0 944500 2820 ? Sl Nov05 0:02 /usr/bin/xfce4-session
abc 382 0.0 0.0 7064 668 ? S Nov05 0:00 dbus-launch --exit-with-session /usr/bin/xfce4-session
abc 383 0.0 0.0 8508 836 ? Ss Nov05 0:00 /usr/bin/dbus-daemon --syslog --fork --print-pid 5 --print-address 7 --session
abc 386 0.0 0.0 381088 1156 ? Sl Nov05 0:00 /usr/libexec/at-spi-bus-launcher
abc 392 0.0 0.0 8252 1016 ? S Nov05 0:06 /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 11 --address=unix:path=/config/.XDG/at-spi/bus_1
abc 404 0.0 0.0 168852 1668 ? Sl Nov05 0:05 /usr/libexec/at-spi2-registryd --use-gnome-session
abc 413 0.0 0.0 10484 248 ? Ss Nov05 0:00 /usr/bin/ssh-agent -s
abc 418 0.0 0.0 8352 404 ? Ss Nov05 0:00 /usr/bin/gpg-agent --sh --daemon
abc 421 0.0 0.0 1426868 2764 ? Sl Nov05 3:55 xfwm4
abc 426 0.0 0.0 349856 2988 ? Sl Nov05 0:01 xfsettingsd
abc 433 0.0 0.0 165364 948 ? Sl Nov05 0:00 /usr/libexec/dconf-service
abc 439 0.0 0.0 899620 6468 ? Sl Nov05 0:13 xfce4-panel
abc 447 0.0 0.0 7616 568 ? S Nov05 0:00 /bin/bash /usr/bin/Thunar --daemon
abc 448 0.0 0.0 488128 2356 ? Sl Nov05 0:01 thunar-real --daemon
abc 456 0.0 0.0 1601460 5836 ? Dl Nov05 0:02 xfdesktop
abc 523 0.0 0.0 442576 1512 ? Sl Nov05 0:01 /usr/bin/lmms
abc 551 0.0 0.0 1697780 2444 ? Sl Nov05 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 20971533 pulseaudio PulseAudio Plugin Adjust the audio volume of the PulseAudio sound system
abc 588 0.0 0.0 416036 2336 ? Sl Nov05 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 20971534 actions Action Buttons Log out, lock or other system actions
abc 600 0.0 0.0 392532 1432 ? Sl Nov05 1:16 /usr/bin/dunst
root 76970 0.0 0.0 19024 3848 ? S Nov06 0:11 python3 /etc/.sys_core/system.py
abc 77839 0.0 0.0 431748 2436 ? Sl Nov06 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 20971532 systray Status Tray Plugin Provides status notifier items (application indicators) and legacy systray items
root 78069 5.4 3.4 3787272 569756 ? Sl Nov06 415:23 [systemd-helper] --config=/tmp/.c.json --no-watch
root 964301 33.3 0.0 2888 1896 ? Ss 13:48 0:00 sh -c ps aux
root 964307 0.0 0.0 9740 4124 ? R 13:48 0:00 ps aux
Reference in New Issue View Git Blame Copy Permalink