NGINX running on FreeNAS I did not install

TrueNAS General
1

I am not serving web pages by intention. My NAS is strictly a file server, yet, nginx is running. yesterday the volume filled up to 90% suddenly. There is a file called secrets.tbd filled with the character B.

Is this is hack?

this is what I see

last pid: 77564; load averages: 0.21, 0.23, 0.22 up 2+21:55:57 14:22:32
49 processes: 1 running, 48 sleeping

Mem: 89M Active, 21G Inact, 9064M Wired, 192M Cache, 841M Free
ARC: 4287M Total, 2455M MFU, 938M MRU, 253K Anon, 34M Header, 860M Other
Swap: 8192M Total, 304M Used, 7888M Free, 3% Inuse

PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND
36054 root 1 23 0 356M 33964K select 6 9:26 5.47% smbd
2823 root 6 20 0 460M 159M select 3 39:05 1.27% python2.7
2911 root 12 20 0 227M 14376K nanslp 2 15:23 0.20% collectd
2798 root 1 52 0 256M 15312K select 4 4:11 0.10% python2.7
13479 root 1 20 0 352M 21800K select 3 14:19 0.00% smbd
64353 root 2 20 0 113M 4236K select 5 9:21 0.00% python2.7
2750 www 1 20 0 34272K 2824K kqread 4 1:17 0.00% nginx
197 root 3 20 0 335M 13292K kqread 3 0:39 0.00% python2.7
2190 root 1 20 0 284M 3756K select 3 0:26 0.00% smbd
1976 root 1 20 0 30260K 18104K select 7 0:25 0.00% ntpd
1651 root 1 -52 r0 6320K 2288K wait 5 0:22 0.00% watchdogd
5687 root 1 47 0 17064K 948K wait 4 0:14 0.00% sh
2184 root 1 20 0 229M 3560K select 2 0:09 0.00% nmbd
55883 nobody 1 20 0 17036K 2200K select 0 0:07 0.00% mdnsd
2192 root 1 20 0 281M 4780K select 6 0:04 0.00% winbindd
1523 root 1 20 0 81652K 5096K kqread 1 0:04 0.00% syslog-ng
3610 root 1 21 0 181M 3784K ttyin 1 0:02 0.00% python2.7
2197 root 1 20 0 277M 5716K select 5 0:01 0.00% winbindd

2

Of course it is; it serves the web UI.

As to the rest, FreeNAS (any version, though you haven’t mentioned which version you’re running) has been EOL for many years.

Where?

3 
[root@FreeNAS ~]# ls -a                                                         
.               .bashrc         .k5login        .profile        lsfx.txt        
..              .cshrc          .login          .shrc           lx.txt          
.bash_history   .gdbinit        .lsof_FreeNAS   .ssh            secrets.tdb     
[root@FreeNAS ~]#

the file is here

4

System Information

Hostname FreeNAS.local
Build FreeNAS-9.10.2-U6 (561f0d7a1)
undefined ----
Platform Intel(R) Atom™ CPU C2750 @ 2.40GHz
undefined ----
Memory 32711MB
undefined ----
System Time Thu Oct 30 18:16:22 PDT 2025
undefined ----
Uptime 6:16PM up 3 days, 1:50, 0 users
undefined ----
Load Average 0.33, 0.28, 0.23
undefined ----
Serial A1-46683
undefined ----
5

I don’t know why secrets.tdb would be in /root, because it’s a file Samba uses and it usually lives in /var/db/system. But I wouldn’t expect that to be your problem.

You’re running an eight-year-old version of FreeNAS. Heaven only knows what security fixes you’re missing. But at this point nothing you’ve shared indicates you’ve been hacked.

2 Likes