Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Linux server at a large hosting provider that has approximately 75 Joomla! websites being hosted on it. We use maldet to scan daily for possible malware on all these sites. In the last week or so, files have been showing up in /tmp


They are owned by the user apache runs as, and they contain malicious encoded PHP code. We would like to find out which site, or sites, are being attacked. We need to know where or how these files are being created from. Obviously, just 1 user account controls all those sites, so that makes things difficult to narrow down.

Is there anyway to audit Apache and determine which website these files are being created from?

Thanks, Jay

share|improve this question

You should examine apache2-mod-itk and provide a user by virtualhost. You will find easilly which user have a problem, which virtualhost should be stopped, which file is created, which packet is going through your iptables firewall...

Then it becomes easy in a shared world

share|improve this answer
That is a good suggestion that I will investigate. In the event that my hosting provider will not allow us to install and use that, they might throw a fit and consider us unsupported, are there any other options? – titleistfour Oct 3 '13 at 14:24

do you have a list of your joomla-sites telling you, which of it are outdated? there was an ugly flaw recently, allowing for remote code execution

exploit-scanners WILL find your sites, esp. when telling which version they run on, so my guess: every outdated joomla-instance should be investigated.

share|improve this answer
About 2 weeks ago we updated every site to the latest version of Joomla at that time. So, they are probably ok, unless something new was discovered since. – titleistfour Oct 4 '13 at 15:44

Perhaps correlate the timestamps between the /tmp files and your Apache access logs? Depending on your timestamp resolution and how busy your sites are, you might be able to identify which requests are creating the files.

If you are using ext4, you could turn off atime on ext4 so that file access times mimics file creation times, and use logger to send access logs from apache to rsyslog, and together these measures would give you fairly precise timestamps, not necessarily 100% accurate but quite possibly good enough to track things down.

For adjusting ext4 options, see:

man 8 mount
man 5 fstab

For adjusting Apache logs, see:

Something like:

CustomLog "|/usr/bin/logger -p" vhost_combined

For adjusting syslog settings, see:

man 8 rsyslogd
share|improve this answer
Unfortunately, the box filesystems are all formatted ext3. – titleistfour Oct 4 '13 at 15:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.