Project

General

Profile

Normal user can kill lighttpd process

Added by loinor over 16 years ago

Hi, i found that a normal user can kill lighttpd process
also www-data user can kill lighttpd process.

if and user using a phpshell script to execute command in the server, he can type in 'ps'to see the current process.
Example:

server~# ps
PID TTY TIME CMD
3909 ? 00:00:00 lighttpd
3938 ? 00:00:00 ps
26494 ? 00:00:00 php5-cgi
26499 ? 00:00:00 php5-cgi
26501 ? 00:00:00 php5-cgi
26507 ? 00:00:00 php5-cgi
26538 ? 00:00:00 php5-cgi
26539 ? 00:00:00 php5-cgi
26540 ? 00:00:21 php5-cgi
26541 ? 00:00:00 php5-cgi

then
server~# kill -9 3909

and thst's it
lighttpd is down.

does anyone know how to deny this kind of attack?


Replies (4)

RE: Normal user can kill lighttpd process - Added by darix over 16 years ago

1. dont install phpshell
2. run php under a different uid with external spawning.

and i highly doubt that any other user can kill lighttpd. just any app that runs under www-data.
and btw: this is the same for apache or any other webserver.

RE: Normal user can kill lighttpd process - Added by loinor over 16 years ago

darix wrote:

1. dont install phpshell
2. run php under a different uid with external spawning.

and i highly doubt that any other user can kill lighttpd. just any app that runs under www-data.
and btw: this is the same for apache or any other webserver

Thanks Darix
You are right about not all users can kill lighttpd.

im not install phpshell, but i cant stop users in my server to upload phpshell and kill the process
this happends recently.

i dont think apache has this problem cus i've tested it

just www-data can kill lighttpd

i dont know how to stop www-data to kill lighttpd

RE: Normal user can kill lighttpd process - Added by icy over 16 years ago

If php and lighty run as the same user, php will always be able to kill lighty and vice versa. This is normal (a user can kill his own processes).
Run php as a different user. And yes, this is the same with any other program including apache and there is absolutely nothing wrong with it.

RE: Normal user can kill lighttpd process - Added by loinor over 16 years ago

Thanks very much
i get it, i'll try to set php to run different UID

    (1-4/4)