0

Today morning I had powered on one of my machines after 2 months and apache was not running as daemon after digging here and there I found in /etc/init.d/ following files

-rwxr-xr-x 1 root root    0 2011-03-04 06:39 apache2
-rwxr-xr-x 1 root root    0 2011-02-03 06:40 apache2.1
-rwxr-xr-x 1 root root 6157 2010-04-14 01:50 apache2.2

I would like to mention I had not created these apache files in /etc/init.d/ which you see as apache2.1 and apache2.2 after wasting some times to start apache I found only
/etc/init.d/apache2.2 start is starting the apache2 daemon where as if I use /etc/init.d/apache start then this will not work.

Then I see following in ps output

 ps -el | grep apache2
1 S     0  2466     1  0  80   0 - 32139 poll_s ?        00:00:00 apache2
5 S    33  2617  2466  0  80   0 - 32268 inet_c ?        00:00:00 apache2
5 S    33  2625  2466  0  80   0 - 32310 inet_c ?        00:00:00 apache2
5 S    33  4211  2466  0  80   0 - 32271 inet_c ?        00:00:00 apache2
5 S    33  9072  2466  0  80   0 - 32179 inet_c ?        00:00:00 apache2
5 S    33  9079  2466  0  80   0 - 32177 inet_c ?        00:00:00 apache2
5 S    33  9080  2466  0  80   0 - 32177 inet_c ?        00:00:00 apache2
5 S    33  9081  2466  0  80   0 - 32179 inet_c ?        00:00:00 apache2
5 S    33  9082  2466  0  80   0 - 32177 inet_c ?        00:00:00 apache2
5 S    33  9083  2466  0  80   0 - 32179 inet_c ?        00:00:00 apache2
5 S    33  9084  2466  0  80   0 - 32177 poll_s ?        00:00:00 apache2

where as in /etc/passwd file I see

www-data:x:33:33:www-data:/var/www:/bin/sh

so remaining processes have 33 uid and pid which is corresponding to www-data but the first one in above output is having uid 0 if you notice

So is apache running correctly on this machine if I were to ask or I should further investigate in my server and does it appears compromised? The files apache2.1 and apache2 are blank and only apache2.2 is having required functions for init etc.

2 Answers 2

1

Don't know about the start scripts. The "master" apache process should run as root (you'll notice it's the one with pid 1 for parent). The entry in passwd looks correct.

0

This behavior is expected with the default Apache MPMs (worker and prefork). The parent process is started by root. By way of fork and setuid system calls the child processes drop privileges and run as the www-data user (uid 33 on your system). This user is controlled by the User directive in your httpd.conf.

Apache documentation is here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .