I run few PHP webpages with NGINX and PHP-FPM. Recently I hosted site for friend who had security issues with WordPress, did all upgrades, WP and Plugins.
But somehow I found out today that user under which his site is run in PHP-FPM is running system commands e.g.
I did not found any overwritten files, and running commands is disabled in
Is there any way to find how commands are run, are they run directly by PHP process, or there is some script on server that is executed?
Can I limit commands to which user have access?
Good books/articles on Linux server security where I can search for more info?
Server is running up to date Ubuntu LTS 14.04, with Ubuntu version of NGINX and PHP.