Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have csf installed on Debian server which uses nginx+php5-fpm and see a lot of these

lfd[23293]: Suspicious Process PID:16998 PPID:16122 User:www-data Uptime:824 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www
lfd[23293]: Suspicious Process PID:17053 PPID:16122 User:www-data Uptime:822 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www
lfd[23293]: Suspicious Process PID:17113 PPID:16122 User:www-data Uptime:818 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www
lfd[23293]: Suspicious Process PID:17114 PPID:16122 User:www-data Uptime:818 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www

in /var/log/lfd.log While the server load is strangely high (+100) and ldf frequently bounce top on cpu usage list. I am wondering whether this signals some attack vector and if so how to counter it?

share|improve this question

migrated from security.stackexchange.com Nov 18 '13 at 12:26

This question came from our site for Information security professionals.

1 Answer 1

While your suspicion can be legitimately addressed on this site, the solution to your problem is more suited for SuperUser, or, better, ServerFault.

Usually, this is nothing to worry about, nobody is attacking you. This is a typical ConfigServer Security Firewall LDF false-positive. With each connection, a new php5-fpm instance is spawned, that's why you're seeing so many entries.

To solve this, just add exe:/usr/sbin/php5-fpm to your /etc/cfs/cfs.pignore

.

share|improve this answer
    
Well, I wish I could be as certain as you. But the unusually high load indicates that the server is under attack, even though you might be right about the ldf showing false positive. –  alfish Oct 17 '13 at 23:15
    
@alfish Then you're showing us the wrong logs. –  Adnan Oct 17 '13 at 23:16
    
What logs do you need to see Adnan? –  alfish Oct 17 '13 at 23:18
    
If your web server is consuming the resources, then it is better to check the access logs. It could be D/DoS or something else. –  Stanimir Stoyanov Oct 25 at 16:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.