up vote 1 down vote favorite
1
share [g+] share [fb]

I am running a web server (apache, mysql, php, cpanel) and I faced with an issue that some users start the httpd server from their accounts. This causes huge overload.

Part of the ps auxf command:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND    
infor8 30135  0.0  0.0  28996  3372 ?        SN   08:42   0:00 /usr/sbin/httpd
infor8 30136  0.0  0.0  28996  3440 ?        SN   08:42   0:00 /usr/sbin/httpd
infor8 30137  0.0  0.0  28996  3364 ?        SN   08:42   0:00 /usr/sbin/httpd

There are actually hundreds of such processes from the infor8 user. I am searching from which directory the process was started in the following way:

lsof -p 30135

perl    25631 infor8  cwd    DIR      8,3    4096 76735848 /home/infor8/public_html
perl    25631 infor8  rtd    DIR      8,3    4096        2 /
perl    25631 infor8  txt    REG      8,3 1184862 42976810 /usr/local/bin/perl
perl    25631 infor8  mem    REG      8,3   23736 63414584 /lib64/libnss_dns-2.5.so

Using the 'maldet' malware scanner I have found (and removed) a lot of files like:

{HEX}php.sessmasq.renata.519 : ./images/a96b6.php
{HEX}php.sessmasq.renata.519 : ./images/7fec3.php
{HEX}php.sessmasq.renata.519 : ./images/b1d10.php

Could someone please assist of how to block running apache locally from the customers' accounts on the web server?

Thank you for any assistance.

Update:

Permissions for httpd:

root@server [~]# which /usr/sbin/httpd
/usr/sbin/httpd
root@server [~]# ll /usr/sbin/httpd
lrwxrwxrwx 1 root root 31 Jul 15  2008 /usr/sbin/httpd -> /usr/local/apache/bin/apachectl*
root@server [~]# ll /usr/local/apache/bin/apachectl
-rwxr-xr-x 1 root root 2971 Sep  9  2009 /usr/local/apache/bin/apachectl*
root@server [~]#
link|improve this question
74% accept rate
feedback

2 Answers

up vote 3 down vote accepted

Changing the permissions or setting an ACL on httpd would be the simplest way.

link|improve this answer
Unfortunately, I cannot use ACL here. Could you please detail your answer regarding the permissions? Where should I change them? – Andrew May 23 '11 at 16:04
On the file you don't want users to run. chmod oa-x httpd might work, but it all depends on how httpd is supposed to be invoked normally and how the group is set up. – Hyppy May 23 '11 at 16:11
Please check the updated post with the permissions info. Apache is configured to run virtual hosts on the server. Do you need any info more? – Andrew May 23 '11 at 16:47
Test out removing other and everyone execute permissions on it, then. I can't guarantee it'll work with everything you have in your environment, but it's a start. – Hyppy May 23 '11 at 17:27
Thank you. Will do. – Andrew May 23 '11 at 17:41
feedback
up vote 2 down vote

You'll want to remove read permission, not just execute permission. Just because something's chmod -x, doesn't mean that you're unable to run it -- case in point:

tuttle@mrdo:/tmp/foo$ ls

hostname

tuttle@mrdo:/tmp/foo$ ls -l

total 16

-rw-r--r-- 1 tuttle tuttle 14688 2011-06-09 17:05 hostname

tuttle@mrdo:/tmp/foo$ ./hostname

bash: ./hostname: Permission denied

tuttle@mrdo:/tmp/foo$ /lib/ld-linux-x86-64.so.2 ./hostname

mrdo

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.