{"action":"created","issue":{"url":"https://api.github.com/repos/cowrie/cowrie/issues/898","repository_url":"https://api.github.com/repos/cowrie/cowrie","labels_url":"https://api.github.com/repos/cowrie/cowrie/issues/898/labels{/name}","comments_url":"https://api.github.com/repos/cowrie/cowrie/issues/898/comments","events_url":"https://api.github.com/repos/cowrie/cowrie/issues/898/events","html_url":"https://github.com/cowrie/cowrie/issues/898","id":362933904,"node_id":"MDU6SXNzdWUzNjI5MzM5MDQ=","number":898,"title":"Failure to delete temporary files","user":{"login":"bontchev","id":580507,"node_id":"MDQ6VXNlcjU4MDUwNw==","avatar_url":"https://avatars0.githubusercontent.com/u/580507?v=4","gravatar_id":"","url":"https://api.github.com/users/bontchev","html_url":"https://github.com/bontchev","followers_url":"https://api.github.com/users/bontchev/followers","following_url":"https://api.github.com/users/bontchev/following{/other_user}","gists_url":"https://api.github.com/users/bontchev/gists{/gist_id}","starred_url":"https://api.github.com/users/bontchev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bontchev/subscriptions","organizations_url":"https://api.github.com/users/bontchev/orgs","repos_url":"https://api.github.com/users/bontchev/repos","events_url":"https://api.github.com/users/bontchev/events{/privacy}","received_events_url":"https://api.github.com/users/bontchev/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-09-23T11:08:23Z","updated_at":"2018-09-24T06:37:14Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"I just noticed that during its operation, Cowrie leaves a humongous number of what seem to be 0-length temporary files (their names all begin with `tmp`, followed by some random letters) in the directory where it saves the file created/uploaded by the attackers.\r\n\r\nI am not talking about the symbolic links (created when the attacker uploads a file with exactly the same contents as an existing one). I am talking about normal, zero-byte files. Just for 3 months operation (January-March this year), it had created something like 260,000 of them.\r\n\r\nI am not sure where they are created - in Cowrie itself, or by Twisted. I don't know when they aren't deleted (maybe if the session times out?). I am currently coping with the issue by having the cron job that restarts the honeypot every night also delete any 0-length files, but it would be nice if this could be fixed properly in the code."},"comment":{"url":"https://api.github.com/repos/cowrie/cowrie/issues/comments/423886745","html_url":"https://github.com/cowrie/cowrie/issues/898#issuecomment-423886745","issue_url":"https://api.github.com/repos/cowrie/cowrie/issues/898","id":423886745,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMzg4Njc0NQ==","user":{"login":"micheloosterhof","id":1063043,"node_id":"MDQ6VXNlcjEwNjMwNDM=","avatar_url":"https://avatars0.githubusercontent.com/u/1063043?v=4","gravatar_id":"","url":"https://api.github.com/users/micheloosterhof","html_url":"https://github.com/micheloosterhof","followers_url":"https://api.github.com/users/micheloosterhof/followers","following_url":"https://api.github.com/users/micheloosterhof/following{/other_user}","gists_url":"https://api.github.com/users/micheloosterhof/gists{/gist_id}","starred_url":"https://api.github.com/users/micheloosterhof/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/micheloosterhof/subscriptions","organizations_url":"https://api.github.com/users/micheloosterhof/orgs","repos_url":"https://api.github.com/users/micheloosterhof/repos","events_url":"https://api.github.com/users/micheloosterhof/events{/privacy}","received_events_url":"https://api.github.com/users/micheloosterhof/received_events","type":"User","site_admin":false},"created_at":"2018-09-24T06:37:14Z","updated_at":"2018-09-24T06:37:14Z","author_association":"MEMBER","body":"I think the issue is still there. The 'tmp' files are temporary files, written by a process while the file is still being transferred. Once the file is complete is should be renamed. Maybe the user gets disconnected in the process, or maybe there's another bug in the code.\r\n\r\nAs a workaround for now, you can safely delete them."}}
{"actor":{"display_login":"micheloosterhof"}}