Normal user can kill lighttpd process
Added by loinor over 16 years ago
Hi, i found that a normal user can kill lighttpd process
also www-data user can kill lighttpd process.
if and user using a phpshell script to execute command in the server, he can type in 'ps'to see the current process.
Example:
server~# ps
PID TTY TIME CMD
3909 ? 00:00:00 lighttpd
3938 ? 00:00:00 ps
26494 ? 00:00:00 php5-cgi
26499 ? 00:00:00 php5-cgi
26501 ? 00:00:00 php5-cgi
26507 ? 00:00:00 php5-cgi
26538 ? 00:00:00 php5-cgi
26539 ? 00:00:00 php5-cgi
26540 ? 00:00:21 php5-cgi
26541 ? 00:00:00 php5-cgi
then
server~# kill -9 3909
and thst's it
lighttpd is down.
does anyone know how to deny this kind of attack?
Replies (4)
RE: Normal user can kill lighttpd process - Added by darix over 16 years ago
1. dont install phpshell
2. run php under a different uid with external spawning.
and i highly doubt that any other user can kill lighttpd. just any app that runs under www-data.
and btw: this is the same for apache or any other webserver.
RE: Normal user can kill lighttpd process - Added by loinor over 16 years ago
darix wrote:
1. dont install phpshell
2. run php under a different uid with external spawning.and i highly doubt that any other user can kill lighttpd. just any app that runs under www-data.
and btw: this is the same for apache or any other webserver
Thanks Darix
You are right about not all users can kill lighttpd.
im not install phpshell, but i cant stop users in my server to upload phpshell and kill the process
this happends recently.
i dont think apache has this problem cus i've tested it
just www-data can kill lighttpd
i dont know how to stop www-data to kill lighttpd
RE: Normal user can kill lighttpd process - Added by icy over 16 years ago
If php and lighty run as the same user, php will always be able to kill lighty and vice versa. This is normal (a user can kill his own processes).
Run php as a different user. And yes, this is the same with any other program including apache and there is absolutely nothing wrong with it.
RE: Normal user can kill lighttpd process - Added by loinor over 16 years ago
Thanks very much
i get it, i'll try to set php to run different UID