Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am running a web server (apache, mysql, php, cpanel) and I faced with an issue that some users start the httpd server from their accounts. This causes huge overload.

Part of the ps auxf command:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND    
infor8 30135  0.0  0.0  28996  3372 ?        SN   08:42   0:00 /usr/sbin/httpd
infor8 30136  0.0  0.0  28996  3440 ?        SN   08:42   0:00 /usr/sbin/httpd
infor8 30137  0.0  0.0  28996  3364 ?        SN   08:42   0:00 /usr/sbin/httpd

There are actually hundreds of such processes from the infor8 user. I am searching from which directory the process was started in the following way:

lsof -p 30135

perl    25631 infor8  cwd    DIR      8,3    4096 76735848 /home/infor8/public_html
perl    25631 infor8  rtd    DIR      8,3    4096        2 /
perl    25631 infor8  txt    REG      8,3 1184862 42976810 /usr/local/bin/perl
perl    25631 infor8  mem    REG      8,3   23736 63414584 /lib64/libnss_dns-2.5.so

Using the 'maldet' malware scanner I have found (and removed) a lot of files like:

{HEX}php.sessmasq.renata.519 : ./images/a96b6.php
{HEX}php.sessmasq.renata.519 : ./images/7fec3.php
{HEX}php.sessmasq.renata.519 : ./images/b1d10.php

Could someone please assist of how to block running apache locally from the customers' accounts on the web server?

Thank you for any assistance.


Update:

Permissions for httpd:

root@server [~]# which /usr/sbin/httpd
/usr/sbin/httpd
root@server [~]# ll /usr/sbin/httpd
lrwxrwxrwx 1 root root 31 Jul 15  2008 /usr/sbin/httpd -> /usr/local/apache/bin/apachectl*
root@server [~]# ll /usr/local/apache/bin/apachectl
-rwxr-xr-x 1 root root 2971 Sep  9  2009 /usr/local/apache/bin/apachectl*
root@server [~]# 
share|improve this question

2 Answers 2

up vote 3 down vote accepted

Changing the permissions or setting an ACL on httpd would be the simplest way.

share|improve this answer
    
Unfortunately, I cannot use ACL here. Could you please detail your answer regarding the permissions? Where should I change them? –  Andrew May 23 '11 at 16:04
    
On the file you don't want users to run. chmod oa-x httpd might work, but it all depends on how httpd is supposed to be invoked normally and how the group is set up. –  Hyppy May 23 '11 at 16:11
    
Please check the updated post with the permissions info. Apache is configured to run virtual hosts on the server. Do you need any info more? –  Andrew May 23 '11 at 16:47
    
Test out removing other and everyone execute permissions on it, then. I can't guarantee it'll work with everything you have in your environment, but it's a start. –  Hyppy May 23 '11 at 17:27
    
Thank you. Will do. –  Andrew May 23 '11 at 17:41

You'll want to remove read permission, not just execute permission. Just because something's chmod -x, doesn't mean that you're unable to run it -- case in point:

tuttle@mrdo:/tmp/foo$ ls

hostname

tuttle@mrdo:/tmp/foo$ ls -l

total 16

-rw-r--r-- 1 tuttle tuttle 14688 2011-06-09 17:05 hostname

tuttle@mrdo:/tmp/foo$ ./hostname

bash: ./hostname: Permission denied

tuttle@mrdo:/tmp/foo$ /lib/ld-linux-x86-64.so.2 ./hostname

mrdo

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.