Resolved Is /var/www/vhosts/<domain>/.pki a plesk directory?

[raytracy]

(CentOS 7.4 + Plesk Onyx 17.5)

We are investigating a Plesk website intrusion incident, and find that some of our /var/www/vhosts/<domain> has a newly created .pki directory, but some domain has not.

We don't know the purpose of .pki directory and would like to know does it related to Plesk?
Or it put by intruder from outside?

We try to delete it and created a read only file with same name (chmod 000 and chattr +i to it), but found that the file we created has been deleted within 24hr, and the .pki become a directory again....

We find the .pki by following command:
find /var/www/vhosts/ -maxdepth 2 -type d -name .pki -print | xargs stat

The stat of .pki directory looks like:

File: ‘/var/www/vhosts/<domain>/.pki’
Size: 19 Blocks: 0 IO Block: 4096 directory
Device: fd02h/64770d Inode: 67277663 Links: 3
Access: (0740/drwxr-----) Uid: (10001/clientuseradm) Gid: ( 1004/ psacln)
Context: system_u: object_r:httpd_sys_content_t:s0
Access: 2018-05-13 18:42:59.366486763 +0800
Modify: 2017-11-15 08:52:49.656936014 +0800
Change: 2017-11-15 08:52:49.656936014 +0800
Birth: -

 

[Brujo]

it seems .pki comes from Plesk, see for example folder structure Question - Strange folders in FTP? & Resolved - In the domain folder appeared new folders as root

 

[Bitpalast]

.pki is something like "package installer" and is a directory that appears whenever you choose the application archive to install an application like Wordpress, Joomla, Drupal or any others from there. It is a safe directory and can be left where it is.