Our system blocked an hacking attempt coming from a local process running under the apache system user.

Process not allowed.

"USER": "apache 16",
"PID": "617",
"%CPU": "0.0",
"%MEM": "0.0 80",
"VSZ": "556 3",
"RSS": "904",
"TTY": "?",
"STAT": "S",
"TIME": "0:00",
"COMMAND": "curl -v -u -d yyyy"

How could the apache user run curl?

From the /etc/passwd file:


Shouldn't this block apache from running any command?

We are running CentOS release 6.7 (Final) with SELinux enforced.

  • 1
    I think a buggy php site was hacked and php running as apache user. This is so common in webhosting business. Commented Aug 16, 2016 at 19:08
  • We are running on a dedicated server. The Apache access log don't show anything weird around the hacking time. Any suggestions?
    – Gotenks
    Commented Aug 16, 2016 at 19:17

1 Answer 1


No, it just means that the user cannot log in and run a shell, he can execute commands though.

Just try the following, as root:

mkdir test
chown apache:apache test
sudo -u apache touch test/file

And now the user apache has used the command touch.

It is the very idea of a system user to execute commands/run progams/deamons etc. with their specific ID and the permissions following thereof.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .