I am running a web server (apache, mysql, php, cpanel) and I faced with an issue that some users start the httpd server from their accounts. This causes huge overload.
Part of the ps auxf
command:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
infor8 30135 0.0 0.0 28996 3372 ? SN 08:42 0:00 /usr/sbin/httpd
infor8 30136 0.0 0.0 28996 3440 ? SN 08:42 0:00 /usr/sbin/httpd
infor8 30137 0.0 0.0 28996 3364 ? SN 08:42 0:00 /usr/sbin/httpd
There are actually hundreds of such processes from the infor8
user. I am searching from which directory the process was started in the following way:
lsof -p 30135
perl 25631 infor8 cwd DIR 8,3 4096 76735848 /home/infor8/public_html
perl 25631 infor8 rtd DIR 8,3 4096 2 /
perl 25631 infor8 txt REG 8,3 1184862 42976810 /usr/local/bin/perl
perl 25631 infor8 mem REG 8,3 23736 63414584 /lib64/libnss_dns-2.5.so
Using the 'maldet' malware scanner I have found (and removed) a lot of files like:
{HEX}php.sessmasq.renata.519 : ./images/a96b6.php
{HEX}php.sessmasq.renata.519 : ./images/7fec3.php
{HEX}php.sessmasq.renata.519 : ./images/b1d10.php
Could someone please assist of how to block running apache locally from the customers' accounts on the web server?
Thank you for any assistance.
Update:
Permissions for httpd:
root@server [~]# which /usr/sbin/httpd
/usr/sbin/httpd
root@server [~]# ll /usr/sbin/httpd
lrwxrwxrwx 1 root root 31 Jul 15 2008 /usr/sbin/httpd -> /usr/local/apache/bin/apachectl*
root@server [~]# ll /usr/local/apache/bin/apachectl
-rwxr-xr-x 1 root root 2971 Sep 9 2009 /usr/local/apache/bin/apachectl*
root@server [~]#