1

Running PHP, Apache2... Our login stopped working and anything trying to grab session data. It all stopped working randomly at 7pm last night. I found out the sessions directory is being filled with tons of sessions per second. If I remove all the sessions it fills up quickly again. Access logs for some reason have stopped working. Does this sound like an attack... If so what can I do to stop it?

4
  • Define "tons of sessions per second."
    – ThoriumBR
    Commented Aug 27, 2014 at 16:56
  • Tons is about 20- 30 by the time I am able to type ls after I type rm sess_*
    – user974407
    Commented Aug 27, 2014 at 16:58
  • Update you application to store sessions in you database.
    – Zoredache
    Commented Aug 27, 2014 at 18:00
  • @Zoredache When do they get removed from the database?
    – user974407
    Commented Aug 27, 2014 at 18:06

3 Answers 3

2

It sounds like the code you are using to close a session is not working, or does not exist. You need to destroy the sessions using the following:

To destroy all sessions:

<?php
session_destroy();
?>

or use this to destroy individual pieces:

<?php
if(isset($_SESSION['views']))
  unset($_SESSION['views']);
?>

Taken from here: W3Schools PHP Sessions

1
  • If session gc is set correctly, sessions should be deleted after a time. If you do session_destroy(), that's will log users out. I'm not sure that's the desired behavior.
    – VladFr
    Commented Aug 29, 2014 at 7:42
1

If your logs aren't working as well, then you seem to be running out of disk space. Nothing in the error logs?

http://php.net/manual/en/session.configuration.php

Check your session lifetime - if it's too high, maybe the server keeps the files until the disk fills up.

Also, check gc settings, probability, divisor and lifetime, and try to set them at default values and see if that improves the situation. The GC - garbage collector, runs at 1% of the requests, and cleans up old unused sessions. If it doesn't work, or turned off, then your disk will fill up at some point.

Another cause for many files might be session.auto_start set to 1; in this case, you may be initializing sessions when you don't really need them - however they won't take too much space. Or you might be doing session_start at every request, regardless if you don't need it.

1

I would look into 3 issues:

-Session start: are you using sessions only when needed? Maybe you are starting sessions on parts that don't need them. It will waste resources and slow down your site.

-Session lifetime: if the lifetime is too large or is 0, the stale sessions will fill up all disk space you have, given enough time. Take a look on session.gc-maxlifetime to tips on how to set this.

-Session termination: Try to destroy the session with session_destroy() when the session is not needed anymore.

If you are out of disk space, no session file will be written and no log will be updated. It will disable your login system, and your users will keep trying to get in, worsening the effect.

Try to free some disk space and see the logs. Lots of requests to uncommon resources can indicate that you are under attack. If you clean space and thigs gets normal, you found the problem. If the number of sessions keeps increasing, you could be under attack.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .