Parallels Technology Network

www.parallels.com

Partner Network

Blogs

PTN Account

About PTN

Home

Documentation

Knowledgebase

Download

Solutions

Community Discussions

Parallels Forums

> More Products Discussion

> Parallels Pro Control Panel

> Parallels Pro Control Panel X for Linux

> General issues and troubleshooting

/usr/bin/php /tmp/sess_014d9cebe5b03c39b87128152d2ee749e4c6a04

Register

FAQ

Calendar

Search

Today's Posts

Mark Forums Read

/usr/bin/php /tmp/sess_014d9cebe5b03c39b87128152d2ee749e4c6a04

May 14, 2010, 02:18 PM

#1

rsleventhal

Member

Join: Jun 2008

Posts: 84

/usr/bin/php /tmp/sess_014d9cebe5b03c39b87128152d2ee749e4c6a04
Strange subject, but that's the crux of it. Yesterday I noticed many such processes:

Quote:

/usr/bin/php /tmp/sess_014d9cebe5b03c39b87128152d2ee749e4c6a04

the string after sess_ differs, but there are lots of them running, all around 2p local time (GMT -4).

I'm not sure what kicked these off, but I've not noticed them before and so I'm hoping the server hasn't been compromised.

CentOS 5.4, PPCP 10.3.4

There are no unusually large bursts of traffic, no unusually large logs for httpd or other services and the load averages have been < 1.0 consistently, other than when these are running. I should mention that the owner of the /usr/bin/php processes are the virtual sites, as if they're being traversed in pseudo - numerical order. Also, the sess_* files in /tmp are of varying size.

I've run rootkithunter, without any issues (against a recent, known baseline for this server).

Any ideas for what to look for here would be greatly appreciated.

Thanks,

-Ray

May 17, 2010, 07:17 AM

#2

rsleventhal

Member

Join: Jun 2008

Posts: 84

*gentle bump*...anyone?

May 18, 2010, 05:50 AM

#3

bewilderbeast@

Member

Join: Nov 2007

Posts: 83

Begs the question, what's the contents of /tmp/sess_014d9cebe5b03c39b87128152d2ee749e4c6a04? Don't post it, just check to see if it's script.

What is the ownership of the file?

Are all you sites in high security mode?

May 18, 2010, 06:27 AM

#4

Tim1stEasy

Junior Member

Join: Nov 2007

Posts: 25

You've had a site compromised I'm afraid. We had a very similar crack running over the weekend via old AWstats versions.

That file that's running is likely scanning other web servers looking for vulnerabilities. The php processes that are running are kicked off by web requests, so search through your access logs for strange POST requests:

Code:

grep POST /home/virtual/site*/fst/var/log/httpd/access_log

What we found was requests to PHP files that had been injected into AWstats image directories. Nasty!

__________________

http://tjl2.com/scripts/quotawatch - improved email notifications about Parallels Pro disk quotas (stop your customers being confused)

http://tjl2.com/sysadmin/vim-cheat-sheet - Vim cheat sheet - printable PDF of useful vi/vim commands

http://wardrobedilemma.com - my Ruby on Rails side project (send your wives/girlfriends!)

May 25, 2010, 10:03 AM

#5

bewilderbeast@

Member

Join: Nov 2007

Posts: 83

What awstats RPM are you using? DAGs? Guess it needs a FST update.

May 26, 2010, 10:35 AM

#6

Tim1stEasy

Junior Member

Join: Nov 2007

Posts: 25

If you're using the latest versions of Parallels, then I think the provided version of awstats is OK. Failing that, just make sure the awstats directories in the HTML and cgi-bin directories are password-protected.

From what we've seen, they get in by hitting the awstats.pl file in the cgi-bin with a special request, so password-protecting will stop them getting in that way.

If you have been infected, you might want to run this script we've written to find the uploaded files:

Code:

#!/bin/bash
DELETE_FILES=0
if [[ $# == 1 ]]; then
if [[ $1 == "-h" ]]; then
echo "Use this script with no arguments to find/remove potential c99 shell PHP scripts."
echo "Without any arguments, this script will just output a list of the files."
echo "You can provide the '-d' switch to then delete these files. Only files that are seen as 'very suspicious' will be deleted."
exit
elif [[ $1 == "-d" ]]; then
DELETE_FILES=1
fi
fi

# We need to update the built-in IFS variable to catch files in our loop with spaces in the name.
OLDIFS=$IFS
IFS=$(echo -en "\n\b")
for X in `find /home/virtual/site*/fst/var/www/html/ -name '*.php'`
do if grep '^<?php $_[a-zA-Z0-9]*[^ ]=' $X -q; then
if [ `wc -l $X | awk '{print $1}'` == 0 ]; then
if [ $DELETE_FILES == 1 ]; then
echo "Deleting $X ..."
rm -f $X
else
echo "$X looks very suspicious."
fi
else
echo "$X matches the regex, but not the line count. Investigate."
fi
fi
done
# Reset the $IFS variable to prevent any weirdness...
IFS=$OLDIFS

Good luck!

Tim

__________________

http://tjl2.com/scripts/quotawatch - improved email notifications about Parallels Pro disk quotas (stop your customers being confused)

http://tjl2.com/sysadmin/vim-cheat-sheet - Vim cheat sheet - printable PDF of useful vi/vim commands

http://wardrobedilemma.com - my Ruby on Rails side project (send your wives/girlfriends!)

May 27, 2010, 07:33 AM

#7

rsleventhal

Member

Join: Jun 2008

Posts: 84

Yes it was absolutely the awstats vulnerability which was causing the issue. As most of these sites have been with me through upgrades from Ensim Pro 3.x, the older version of awstats carried forward.

All better now, thanks for the replies and my apologies for the lateness of my reply, but the way the folks at P moderate this forum makes it difficult to use.

Best regards,

-R

PS a HUGE thank you to the folks at penguin-uk.com

May 28, 2010, 06:08 AM

#8

bewilderbeast@

Member

Join: Nov 2007

Posts: 83

Glad Penguin got you fixed up.

Just for other peoples information, I have tested the very latest version of AWStats and it works fine. You can grab the RPM at http://prdownloads.sourceforge.net/a...5-1.noarch.rpm.

I reckon it would be a good idea to have a thread listing all the possible updates that work well. So that we can better maintain the software without risk of any issues.

Post Reply

« Previous Thread | Next Thread »

Search this thread

Forum jump

Advanced Search

User Control Panel
Private Messages
Subscriptions
Who's Online
Search Forums
Forums Home

General Discussion
Announcements
Feature Suggestions
Parallels Website and Forum
Desktop Virtualization Products Discussion
Parallels Desktop for Mac
Installation and Configuration in Mac OS
Windows Guest OS Discussion
Mac OS X Guest OS Discussion
Linux Guest OS Discussion
Other Guest OS Types Discussion
General Questions
Parallels Desktop for Windows and Linux
Installation and Configuration in Windows and Linux
Windows Guest OS Discussion
Linux Guest OS Discussion
Other Guest OS Types Discussion
General Questions
Parallels Desktop Upgrade to Windows 7 Edition
Installation and Configuration
Third-party Applications Discussion
General Questions
Parallels Workstation Extreme
Installation and Configuration in Windows and Linux
Windows Guest OS Discussion
Linux Guest OS Discussion
Other Guest OS Types Discussion
General Questions
Parallels Workstation for Windows and Linux
Installation and Configuration in Windows and Linux
Windows Guest OS Discussion
Linux Guest OS Discussion
Other Guest OS Types Discussion
General Questions
Parallels Virtual Tools
Parallels Transporter
Parallels Explorer
Parallels Image Tool
Parallels Compressor
Server Virtualization Products Discussion
Parallels Server
Installation and Configuration
Windows Guest OS Discussion
Mac OS X Guest OS Discussion
Linux Guest OS Discussion
Other Guest OS Types Discussion
General Questions
Parallels Virtuozzo Containers for Linux
General Discussion
Parallels Virtuozzo Containers for Windows
General Discussion
Plesk Products Discussion
Parallels Small Business Panel
Installation and "How do I" Questions
Troubleshooting Issues
Suggestions and Feedback
General Questions
Parallels Plesk Panel for Linux/Unix
Parallels Plesk Panel 9.5 for Linux/UNIX
Parallels Plesk Panel 9.5 for Linux/UNIX Suggestions and Feedback
Parallels Plesk Panel 9.5 for Linux/UNIX Backup and Migration Manager
Parallels Plesk Panel 9.5 for Linux/UNIX 3rd Party Software
Parallels Plesk Panel 9.5 for Linux/UNIX Installation and "How do I" Questions
Parallels Plesk Panel 9.5 for Linux/UNIX Troubleshooting Issues
Parallels Plesk Panel 9.5 for Linux/UNIX Votes
Parallels Plesk Panel 9.3 for Linux/UNIX
Parallels Plesk Panel 9.3 for Linux/UNIX Suggestions and Feedback
Parallels Plesk Panel 9.3 for Linux/UNIX Backup and Migration Manager
Parallels Plesk Panel 9.3 for Linux/UNIX 3rd Party Software
Parallels Plesk Panel 9.3 for Linux/UNIX Installation and "How do I" Questions
Parallels Plesk Panel 9.3 for Linux/UNIX Troubleshooting Issues
Parallels Plesk Panel 9.2 for Linux/UNIX
Parallels Plesk Panel 9.2 for Linux/UNIX Announcements
Parallels Plesk Panel 9.2 for Linux/UNIX Suggestions and Feedback
Parallels Plesk Panel 9.2 for Linux/UNIX Backup and Migration Manager
Parallels Plesk Panel 9.2 for Linux/UNIX 3rd Party Software
Parallels Plesk Panel 9.2 for Linux/UNIX Installation and "How do I" Questions
Parallels Plesk Panel 9.2 for Linux/UNIX Troubleshooting Issues
Parallels Plesk Panel 9.0 for Linux/UNIX
Parallels Plesk Panel 9.0 for Linux/UNIX Announcements
Parallels Plesk Panel 9.0 for Linux/UNIX Suggestions and Feedback
Parallels Plesk Panel 9.0 for Linux/UNIX Backup and Migration Manager
Parallels Plesk Panel 9.0 for Linux/UNIX 3rd Party Software
Parallels Plesk Panel 9.0 for Linux/UNIX Installation and "How do I" Questions
Parallels Plesk Panel 9.0 for Linux/UNIX Troubleshooting Issues
Plesk 8.6 for Linux
Plesk 8.6 for Linux Announcements
Plesk 8.6 for Linux Migration Manager Utility
Plesk 8.6 for Linux 3rd Party Software
Plesk 8.6 for Linux Installation and "How do I" Questions
Plesk 8.6 for Linux Suggestions and Feedback
Plesk 8.6 for Linux Troubleshooting Issues
Plesk 8.4 for Linux
Plesk 8.4 for Linux Announcements
Plesk 8.4 for Linux Migration Manager Utility
Plesk 8.4 for Linux 3rd Party Software
Plesk 8.4 for Linux Installation and "How do I" Questions
Plesk 8.4 for Linux Suggestions and Feedback
Plesk 8.4 for Linux Troubleshooting Issues
Plesk 8.3 for Linux
Plesk 8.3 for Linux Announcements
Plesk 8.3 for Linux Migration Manager Utility
Plesk 8.3 for Linux 3rd Party Software
Plesk 8.3 for Linux Installation and "How do I" Questions
Plesk 8.3 for Linux Suggestions and Feedback
Plesk 8.3 for Linux Troubleshooting Issues
Plesk 8.2 for Linux
Plesk 8.2 for Linux Announcements
Plesk 8.2 for Linux Migration Manager Utility
Plesk 8.2 for Linux 3rd Party Software
Plesk 8.2 for Linux Installation and "How do I" Questions
Plesk 8.2 for Linux Suggestions and Feedback
Plesk 8.2 for Linux Troubleshooting Issues
Plesk 8.1 for Linux
Plesk 8.1 for Linux Announcements
Plesk 8.1 for Linux Migration Manager Utility
Plesk 8.1 for Linux 3rd Party Software
Plesk 8.1 for Linux Installation and 'How Do I' Questions
Plesk 8.1 for Linux Suggestions and Feedback
Plesk 8.1 Troubleshooting and Problems
Plesk 8.0 for Linux
Plesk 8.0 for Linux Announcements
Plesk 8.0 for Linux Suggestions and Feedback
Plesk 8.0 for Linux Installation and 'How Do I' Questions
Plesk 8.0 for Linux Troubleshooting and Problems
Plesk 8.0 for Linux 3rd Party Software
Plesk 7.5 Reloaded
Plesk 7.5 Reloaded Announcements
Plesk 7.5 Reloaded Suggestions and Feedback
Plesk 7.5 Reloaded Installation and 'How Do I' Questions
Plesk 7.5 Reloaded Troubleshooting and Problems
Plesk 7.5 Reloaded 3rd Party Software
Parallels Plesk Panel for Windows
Parallels Plesk Panel 9.5 for Windows
Parallels Plesk Panel 9.5 for Windows Installation and "How do I" Questions
Parallels Plesk Panel 9.5 for Windows Suggestions and Feedback
Parallels Plesk Panel 9.5 for Windows Backup and Migration Manager
Parallels Plesk Panel 9.5 for Windows 3rd Party Software
Parallels Plesk Panel 9.5 for Windows Troubleshooting Issues
Parallels Plesk Panel 9.5 for Windows Votes
Parallels Plesk Panel 9.3 for Windows
Parallels Plesk Panel 9.3 for Windows Installation and "How do I" Questions
Parallels Plesk Panel 9.3 for Windows Suggestions and Feedback
Parallels Plesk Panel 9.3 for Windows Backup and Migration Manager
Parallels Plesk Panel 9.3 for Windows 3rd Party Software
Parallels Plesk Panel 9.3 for Windows Troubleshooting Issues
Parallels Plesk Panel 9.2 for Windows
Parallels Plesk Panel 9.2 for Windows Announcements
Parallels Plesk Panel 9.2 for Windows Installation and "How do I" Questions
Parallels Plesk Panel 9.2 for Windows Suggestions and Feedback
Parallels Plesk Panel 9.2 for Windows Backup and Migration Manager
Parallels Plesk Panel 9.2 for Windows 3rd Party Software
Parallels Plesk Panel 9.2 for Windows Troubleshooting Issues
Parallels Plesk Panel 9.0 for Windows
Parallels Plesk Panel 9.0 for Windows Announcements
Parallels Plesk Panel 9.0 for Windows Installation and "How do I" Questions
Parallels Plesk Panel 9.0 for Windows Suggestions and Feedback
Parallels Plesk Panel 9.0 for Windows Backup and Migration Manager
Parallels Plesk Panel 9.0 for Windows 3rd Party Software
Parallels Plesk Panel 9.0 for Windows Troubleshooting Issues
Plesk 8.6 for Windows
Plesk 8.6 for Windows Announcements
Plesk 8.6 for Windows Installation and "How do I" Questions
Plesk 8.6 for Windows Migration Manager Utility
Plesk 8.6 for Windows Suggestions and Feedback
Plesk 8.6 for Windows 3rd Party Software
Plesk 8.6 for Windows Troubleshooting Issues
Plesk 8.4 for Windows
Plesk 8.4 for Windows Announcements
Plesk 8.4 for Windows Installation and "How do I" Questions
Plesk 8.4 for Windows Migration Manager Utility
Plesk 8.4 for Windows Suggestions and Feedback
Plesk 8.4 for Windows 3rd Party Software
Plesk 8.4 for Windows Troubleshooting Issues
Plesk 8.3 for Windows
Plesk 8.3 for Windows Announcements
Plesk 8.3 for Windows Installation and "How do I" Questions
Plesk 8.3 for Windows Migration Manager Utility
Plesk 8.3 for Windows Suggestions and Feedback
Plesk 8.3 for Windows 3rd Party Software
Plesk 8.3 for Windows Troubleshooting Issues
Plesk 8.2 for Windows
Plesk 8.2 for Windows Announcements
Plesk 8.2 for Windows Installation and "How do I" Questions
Plesk 8.2 for Windows Migration Manager Utility
Plesk 8.2 for Windows Suggestions and Feedback
Plesk 8.2 for Windows 3rd Party Software
Plesk 8.2 for Windows Troubleshooting Issues
Plesk 8.1 for Windows
Plesk 8.1 for Windows Announcements
Plesk 8.1 for Windows Installation and "How do I" Questions
Plesk 8.1 for Windows and 3rd Party Software
Plesk 8.1 for Windows Troubleshooting Issues
Plesk 8.1 for Windows Migration Manager Utility
Plesk 7.6 for Windows
Plesk 7.6 for Windows Announcements
Plesk 7.6 for Windows Installation and "How do I" Questions
Plesk 7.6 for Windows Troubleshooting Issues
Plesk 7.6 for Windows and 3rd Party Software
Plesk 7.6 for Windows Migration Manager Utility
Plesk 7.5 Reloaded for Windows
Plesk 7.5 Reloaded for Windows Announcements
Plesk 7.5 Reloaded for Windows Installation and 'How Do I' Questions
Plesk 7.5 Reloaded for Windows Troubleshooting and Problems
Plesk 7.5 Reloaded for Windows 3rd Party Software
Plesk 7.5 for Windows Migration Manager
Plesk 7 for Windows
Plesk 7 for Windows Announcements
Plesk 7 for Windows Suggestions and Feedback
Plesk 7 for Windows Installation and 'How Do I' Questions
Plesk 7 for Windows Troubleshooting and Problems
Plesk 7 for Windows 3rd Party Software
Plesk 6.5 for Windows
Plesk 6.5 for Windows Suggestions and Feedback
Plesk 6.5 for Windows Installation and 'How Do I' Questions
Plesk 6.5 for Windows Troubleshooting and Problems
Plesk 6.5 for Windows and 3rd Party Software
Parallels Plesk Expand
Plesk Expand 2.3
Plesk Expand 2.3 General Discussion
Plesk Expand 2.3 Troubleshooting Issues
Plesk Expand 2.3 New Feature Requests
Plesk Expand 2.3 Distributed Services Topics (Mail, DNS, Databases)
Plesk Expand 2.2
Plesk Expand 2.2 General Discussion
Plesk Expand 2.2 Troubleshooting Issues
Plesk Expand 2.2 New Feature Requests
Plesk Expand 2.2 Distributed Services Topics (Mail, DNS, Databases)
Plesk Expand 2.1
Plesk Expand 2.1 General Discussion
Plesk Expand 2.1 Troubleshooting Issues
Plesk Expand 2.1 New Feature Requests
Plesk Expand Distributed Services Topics (Mail, DNS, Databases)
Plesk Expand 2.0 and Legacy General Discussion
Parallels Plesk Sitebuilder for Linux
Sitebuilder 4.5 for Linux
Sitebuilder 4.5 for Linux Announcements
Sitebuilder 4.5 for Linux Installation
Sitebuilder 4.5 for Linux Troubleshooting
Sitebuilder 4.5 for Linux Suggestions and Feedback
Sitebuilder 4.2 for Linux
Sitebuilder 4.2 for Linux Announcements
Sitebuilder 4.2 for Linux Installation
Sitebuilder 4.2 for Linux Troubleshooting
Sitebuilder 4.2 for Linux Suggestions and Feedback
Sitebuilder 4.0 for Linux
Sitebuilder 4.0 for Linux Installation
Sitebuilder 4.0 for Linux Troubleshooting
Sitebuilder 4.0 for Linux Suggestions and Feedback
Sitebuilder 4.1 for Linux
Sitebuilder 4.1 for Linux Installation
Sitebuilder 4.1 for Linux Troubleshooting
Sitebuilder 4.1 for Linux Suggestions and Feedback
Sitebuilder 3.0 for Linux
Sitebuilder 3.0 for Linux Installation
Sitebuilder 3.0 for Linux Troubleshooting Issues
Sitebuilder 3.0 for Linux Suggestions and Feedback
Legacy Sitebuilder Software
Sitebuilder Legacy Forum for Plesk Publishing Only!
Sitebuilder Legacy Forum for General Publishing
Parallels Plesk Sitebuilder for Windows
Sitebuilder 4.5 for Windows
Sitebuilder 4.5 for Windows Announcements
Sitebuilder 4.5 for Windows Installation
Sitebuilder 4.5 for Windows Troubleshooting Issues
Sitebuilder 4.5 for Windows Suggestions and Feedback
Sitebuilder 4.2 for Windows
Sitebuilder 4.2 for Windows Announcements
Sitebuilder 4.2 for Windows Installation
Sitebuilder 4.2 for Windows Troubleshooting Issues
Sitebuilder 4.2 for Windows Suggestions and Feedback
Sitebuilder 4.1 for Windows
Sitebuilder 4.1 for Windows Installation
Sitebuilder 4.1 for Windows Troubleshooting Issues
Sitebuilder 4.1 for Windows Suggestions and Feedback
Sitebuilder 4.0 for Windows
Sitebuilder 4.0 for Windows Installation
Sitebuilder 4.0 for Windows Troubleshooting Issues
Sitebuilder 4.0 for Windows Suggestions and Feedback
Sitebuilder 3.2 for Windows
Sitebuilder 3.2 for Windows Installation
Sitebuilder 3.2 for Windows Troubleshooting Issues
Sitebuilder 3.2 for Windows Suggestions and Feedback
Parallels Plesk Billing
Installation and "How do I" Questions
Troubleshooting Issues
Suggestions and Feedback
General Questions
MyPlesk.com
MyPlesk.com Suggestions and Feedback
Automation Products Discussion
Parallels Operations Automation
POA Suggestions and Feedback
Parallels Business Automation
General Discussion
Suggestions and Feedback
Installation and 'How Do I' Questions
Troubleshooting and Problems
Parallels Virtual Automation
General Discussions
Suggestions and Feedback
Installation and 'How Do I' Questions
Troubleshooting and Problems
More Products Discussion
Parallels Confixx
Confixx General Discussion
Parallels Pro Control Panel
Parallels Pro Control Panel X for Linux
Announcements
Language Translation Announcements
Installation and setup issues
General issues and troubleshooting
Services configuration
Add-ons and 3rd party applications
Parallels Pro Control Panel for Linux legacy versions
Announcements
Language Translation Announcements
Installation and setup issues
General issues and troubleshooting
Services configuration
Add-ons and 3rd party applications
Parallels Pro Control Panel for Windows
Announcements
Language Translation Announcements
Installation and setup issues
General issues and troubleshooting
Services configuration
Add-ons and 3rd party applications
Parallels Pro Control Panel for Windows legacy versions
Announcements
Language Translation Announcements
Installation and setup issues
General issues and troubleshooting
Services configuration
Add-ons and 3rd party applications
Development Discussion
APS Standard
Parallels Virtual Appliances
Localization
Parallels Plesk Panel
Parallels Plesk Expand
Parallels Plesk Sitebuilder
Parallels Operations Automation
Parallels Business Automation
Development
Parallels Plesk Panel for Linux/Unix
Plesk API RPC
Extensions and Modules
Parallels Plesk Panel for Windows
Plesk API RPC
Extensions and Modules
Parallels Plesk Expand
Integration
Parallels Plesk Sitebuilder for Linux/Unix
Integration
Templates
Custom Skins
Extensions and Modules
Parallels Plesk Sitebuilder for Windows
Integration
Templates
Custom Skins
Extensions and Modules
Parallels Business Automation
Integration
Extensions and Modules
Parallels Virtuozzo Containers
Integration
Extensions and Modules
Parallels Pro Control Panel
Mail API
Web Services API
General
Documentation
Parallels Plesk Panel Documentation
Parallels Plesk Sitebuilder Documentation
Parallels Virtuozzo Containers Documentation
Parallels Server Documentation
Parallels Operations Automation Documentation
Parallels Business Automation Documentation
Parallels Virtual Automation Documentation
User Solutions and Workarounds
Beta Program
Parallels Server 3.0 Public Beta
Links
Parallels H-Sphere/Sitestudio
Parallels Helm
Forums Archive

Thread tools

Display modes

Printable Version

Email this Page

Linear Mode

Hybrid Mode

Threaded Mode

Mobile View

Top

Powered by vBulletin
Copyright © 2000 - 2010, Jelsoft Enterprises Ltd.

Supplemental License Agreement

Terms of Use

Privacy Policy

© 1999-2010 Parallels. Virtualization and Automation Software. All Rights Reserved.

Parallels Server

Parallels Virtuozzo Containers

Parallels Plesk Control Panel

Parallels Plesk Sitebuilder

More Documents

Development Licenses

SDKs

Localization Kits

Virtual Appliances

Virtuozzo Templates

APS Packages

Virtual Appliances

Virtuozzo Templates

APS Standard

General

Desktop Virtualization Products

Server Virtualization Products

Plesk Products

Automation Products

Development

Beta Program