I have a LAMP server. Users log in and authenticate against the MySQL database. After successful authentication,
session_start() is called. At no point is
regenerate_session_id() called. I'm experiencing multiple empty PHP/apache sessions being created. About every second a blank session file is created. In
php.ini I have:
session.gc_probability = 1 session.gc_divisor = 1 session.gc_maxlifetime = 1440
I realize this has nothing to do with session creation, but the settings for the GC. We set it to full throttle so it would handle all expired sessions, and hopefully clean up all the empty sessions. I do not know if blank sessions are expected, or if it's really a problem. My concern is with there being so many, it increases the likelihood of a successful session hijack. There is a duplicate machine that's used for testing and development, and it does not have this behavior. I was under the impression that a session file is only created by httpd when a user is authenticated, and the
session_start() is called. I do not know what is causing the blank session files, if it's a legitimate problem, or if anyone else has experienced this behavior.
auditctl rule to watch that directory, it's definitely apache creating them. Which checks out since apache is the owner:group of all of the empty files. This box is currently running apache 2.2.15.
find . -type f | wc -l shows the file count steadily increasing. i caught it at over 640 after a couple of minutes, and I'm sure it gets worse even with GC processing what it can.