Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I get a lot of emails reporting this and I want this issue to auto correct itself. These process are run by my server and are a result of updates, session deletion and other legitimate session handling reported as false positives.

Here's a sample report:

Time:    Sat Oct 20 00:00:03 2012 -0400
PID:     20077
Account: named
Uptime:  326117 seconds

Executable:

/usr/sbin/nsd\00507d27e9\0053\00\00\00\00\00 (deleted)

The file system shows this process is running an executable file that has
been deleted. This typically happens when the original file has been replaced
by a new file when the application is updated. To prevent this being reported
again, restart the process that runs this excecutable file. See csf.conf and
the PT_DELETED text for more information about the security implications of
processes running deleted executable files.


Command Line (often faked in exploits):

/usr/sbin/nsd -c /etc/nsd/nsd.conf


Network connections by the process (if any):

udp: xx.xx.xxx.xx:53 -> 0.0.0.0:0
udp: 127.0.0.1:53 -> 0.0.0.0:0
udp: xx.xx.xxx.xx:53 -> 0.0.0.0:0
tcp: xx.xx.xxx.xx:53 -> 0.0.0.0:0
tcp: 127.0.0.1:53 -> 0.0.0.0:0
tcp: xx.xx.xxx.xx:53 -> 0.0.0.0:0


Files open by the process (if any):

/dev/null
/dev/null
/dev/null


Memory maps by the process (if any):

0045e000-00479000 r-xp 00000000 fd:00 2582025    /lib/ld-2.5.so
00479000-0047a000 r--p 0001a000 fd:00 2582025    /lib/ld-2.5.so
0047a000-0047b000 rw-p 0001b000 fd:00 2582025    /lib/ld-2.5.so
0047d000-005d5000 r-xp 00000000 fd:00 2582073    /lib/i686/nosegneg/libc-2.5.so
005d5000-005d7000 r--p 00157000 fd:00 2582073    /lib/i686/nosegneg/libc-2.5.so
005d7000-005d8000 rw-p 00159000 fd:00 2582073    /lib/i686/nosegneg/libc-2.5.so
005d8000-005db000 rw-p 005d8000 00:00 0 
005dd000-005e0000 r-xp 00000000 fd:00 2582087    /lib/libdl-2.5.so
005e0000-005e1000 r--p 00002000 fd:00 2582087    /lib/libdl-2.5.so
005e1000-005e2000 rw-p 00003000 fd:00 2582087    /lib/libdl-2.5.so
0062b000-0063d000 r-xp 00000000 fd:00 2582079    /lib/libz.so.1.2.3
0063d000-0063e000 rw-p 00011000 fd:00 2582079    /lib/libz.so.1.2.3
00855000-0085f000 r-xp 00000000 fd:00 2582022    /lib/libnss_files-2.5.so
0085f000-00860000 r--p 00009000 fd:00 2582022    /lib/libnss_files-2.5.so
00860000-00861000 rw-p 0000a000 fd:00 2582022    /lib/libnss_files-2.5.so
00ac0000-00bea000 r-xp 00000000 fd:00 2582166    /lib/libcrypto.so.0.9.8e
00bea000-00bfe000 rw-p 00129000 fd:00 2582166    /lib/libcrypto.so.0.9.8e
00bfe000-00c01000 rw-p 00bfe000 00:00 0 
00e68000-00e69000 r-xp 00e68000 00:00 0          [vdso]
08048000-08074000 r-xp 00000000 fd:00 927261     /usr/sbin/nsd
08074000-08079000 rw-p 0002b000 fd:00 927261     /usr/sbin/nsd
08079000-0808c000 rw-p 08079000 00:00 0 
08a20000-08a67000 rw-p 08a20000 00:00 0 
b7f8d000-b7ff2000 rw-p b7f8d000 00:00 0 
b7ffd000-b7ffe000 rw-p b7ffd000 00:00 0 
bfa6d000-bfa91000 rw-p bffda000 00:00 0          [stack]

Would /etc/nsd/restart or kill -1 20077 solve the problem?

share|improve this question

migrated from stackoverflow.com Oct 22 '12 at 7:14

This question came from our site for professional and enthusiast programmers.

add comment

1 Answer 1

Would /etc/nsd/restart [...] solve the problem?

Yes. As your ConfigServer report script is already telling you

To prevent this being reported again, restart the process that runs this excecutable file.

This is also an advisable action from the security perspective: the update you have applied is likely to be security-related and the fixed code will not be in effect unless the affected process is restarted.

These process are run by my server and are a result of updates, session deletion and other legitimate session handling

Session deletion and session handling would (hopefully, otherwise your server is screwed) not impact the nsd binary - it is a name server daemon.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.