Our system blocked an hacking attempt coming from a local process running under the apache system user.
Process not allowed.
{
"USER": "apache 16",
"PID": "617",
"%CPU": "0.0",
"%MEM": "0.0 80",
"VSZ": "556 3",
"RSS": "904",
"TTY": "?",
"STAT": "S",
"TIME": "0:00",
"COMMAND": "curl -v -u -d yyyy http://127.0.0.1:xxxx/"
}
How could the apache user run curl?
From the /etc/passwd file:
apache:x:48:48:Apache:/var/www:/sbin/nologin
Shouldn't this block apache from running any command?
We are running CentOS release 6.7 (Final) with SELinux enforced.