0

Our system blocked an hacking attempt coming from a local process running under the apache system user.

Process not allowed.

{
"USER": "apache 16",
"PID": "617",
"%CPU": "0.0",
"%MEM": "0.0 80",
"VSZ": "556 3",
"RSS": "904",
"TTY": "?",
"STAT": "S",
"TIME": "0:00",
"COMMAND": "curl -v -u -d yyyy http://127.0.0.1:xxxx/"
}

How could the apache user run curl?

From the /etc/passwd file:

apache:x:48:48:Apache:/var/www:/sbin/nologin

Shouldn't this block apache from running any command?

We are running CentOS release 6.7 (Final) with SELinux enforced.

Improve this question
2
  • 1
    I think a buggy php site was hacked and php running as apache user. This is so common in webhosting business.
    – Ipor Sircer
    Aug 16, 2016 at 19:08
  • We are running on a dedicated server. The Apache access log don't show anything weird around the hacking time. Any suggestions?
    – Gotenks
    Aug 16, 2016 at 19:17

1 Answer 1

Reset to default
2

No, it just means that the user cannot log in and run a shell, he can execute commands though.

Just try the following, as root:

mkdir test
chown apache:apache test
sudo -u apache touch test/file

And now the user apache has used the command touch.

It is the very idea of a system user to execute commands/run progams/deamons etc. with their specific ID and the permissions following thereof.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .