0

Our system blocked an hacking attempt coming from a local process running under the apache system user.

Process not allowed.

{
"USER": "apache 16",
"PID": "617",
"%CPU": "0.0",
"%MEM": "0.0 80",
"VSZ": "556 3",
"RSS": "904",
"TTY": "?",
"STAT": "S",
"TIME": "0:00",
"COMMAND": "curl -v -u -d yyyy http://127.0.0.1:xxxx/"
}

How could the apache user run curl?

From the /etc/passwd file:

apache:x:48:48:Apache:/var/www:/sbin/nologin

Shouldn't this block apache from running any command?

We are running CentOS release 6.7 (Final) with SELinux enforced.

2
  • 1
    I think a buggy php site was hacked and php running as apache user. This is so common in webhosting business. Aug 16, 2016 at 19:08
  • We are running on a dedicated server. The Apache access log don't show anything weird around the hacking time. Any suggestions?
    – Gotenks
    Aug 16, 2016 at 19:17

1 Answer 1

2

No, it just means that the user cannot log in and run a shell, he can execute commands though.

Just try the following, as root:

mkdir test
chown apache:apache test
sudo -u apache touch test/file

And now the user apache has used the command touch.

It is the very idea of a system user to execute commands/run progams/deamons etc. with their specific ID and the permissions following thereof.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.