2

I have gotten my hands on this server running cpanel/whm which is still in production for another six months or so until we migrate over to AWS. One thing that is vexing me about it is that when I ssh in I use the root account, but once I authenticate I am sometimes logged in as apache_user. In taking a look at /etc/passwd I find these two lines in the file.

root:x:0:0:root:/root:/bin/bash
*...stuff...*
apache_user:x:0:0::/home/apache_user:/bin/bash

"hmmm well that's no good and rather odd," I say to myself.

Can I just go ahead and change the user and group ID of apache_user to something else?

  • 5
    It can be a sloppy sysadmin workaround, or it can be a backdoor created in a previous attack. – Rui F Ribeiro Jul 28 '17 at 21:39
2

The point is that Apache user was changed to run as root. That setup is dangerous, and allows trivial hacks to escalate to root easily.

I would talk with previous sysadmins to at least have a minimum peace of mind this is not a backdoor left from a previous attack and is just a mistake.

I would also peruse old backups to investigate how long the Apache user has had that id.

Mistake or not, the odds are fairly high the machine was already compromised. (several times?)

It is also fairly common a rogue sysadmin or an attacker leaving behind a user with id 0. The id 0 gives any user the privileges of root.

I would not wait for any migration; at this point of the game, the question is not about changing the user id.

I would change the id, password of apache_user (if any), and the bash shell of that user for /bin/nologin as an immediate measure. However a possible hacker might have alternative entries by now.

Do an image/backup of that, and reinstall that server ASAP.

If you can recover the data files from a trusted backup even the better. Reinstalling might rid if of a root compromise for now, but is is possible to have rogue web shells left behind. As a begginer tip, search also for suspicious root setuid files out of place.

Consider hiring the services of a seasoned consultant to evaluate all of your systems. This server might be a point of entry on your infrat-structure.

There is also a remote possibily this was done as a sloppy way to not manage user permissions. Be prepared for your sites or some obscure funcionality failing in misterious ways after taking out root privileges from the apache user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.