Hey guys, I saw this in my VPS when checking history:
1 chmod +x /usr/lib/virt-sysprep/scripts/0001-swapoff--dev-vda2-mkswap--dev-vda2-swapon--dev-vda2-resize2f
2 cat /usr/lib/virt-sysprep/scripts/0001-swapoff--dev-vda2-mkswap--dev-vda2-swapon--dev-vda2-resize2f
3 vi /usr/lib/virt-sysprep/scripts/0001-swapoff--dev-vda2-mkswap--dev-vda2-swapon--dev-vda2-resize2f
here is the content of the script:
# cat /usr/lib/virt-sysprep/scripts/0001-swapoff--dev-vda2-mkswap--dev-vda2-swapon--dev-vda2-resize2f
swapoff /dev/vda2;mkswap /dev/vda2;swapon /dev/vda2;resize2fs /dev/vda1;yum -y update;systemctl disable guestfs-firstboot;reboot
This is a new server I provisioned on my VPS in racknerd. The command looks safe, but I’m wondering if these commands were executed on its own? Or someone has logged in to my VPS? This is also not normal, isn’t it?
i contacted support and they provided me this doc page
https://support.solusvm.com/hc/en-us/articles/360007449180-How-to-modify-first-boot-script-in-the-TDN-KVM-template-in-SolusVM-