lots of php commands involving sendmail

Invader Zim

Invader Zim

Verified User
Joined
Sep 4, 2004
Messages
184
On a specific server of ours we see a lot of processes like this:

Code: 
/usr/local/php71/bin/php-cgi71 -d sendmail_path=/usr/sbin/sendmail -t -i -f <USER>@<DOMAIN> -d sendmail_from="<USER>@<DOMAIN>" -d mail.log="/home/<USER>/.php/php-mail.log"

Left unchecked it floods the server sometimes getting a load of 200. There were some similar processes but those were related to open_base_dir, which I've deactivated for all domains (it is a customer's server, I don't know why he turned it on). So I had hoped to have seen the last of these, but alas, this particular one keeps going. It's not isolated to a single user, although it is often the same ones. Any idea what triggers these? I've checked the crontabs, it's not that.

--

EDIT:
These processes are spawned by 2 scripts
/usr/local/safe-bin/fcgid71.sh and /usr/local/safe-bin/fcgid56.sh

and they seem to trigger
mod_fcgid: error reading data from FastCGI server
in the respective error logs.

I don't see a setting for fcgid in custombuild's options.conf though. Both php1 and php2 are set to fast-cgi mode.

EDIT2:
I rewrote the configs and rebuilt php (./build php n). Issues remain. :/
 
Last edited:
Hello,

fcgid = Fast CGI daemon, see https://httpd.apache.org/mod_fcgid/

It's not the processes flooding your server, it's somebody from outside sending numerous request over HTTP/HTTPs to sites on your server: http spam, http brute-force, malware. Those /usr/local/php71/bin/php-cgi71 processes are legal processes created by Apache upon requests it's processing.

Check apache's server-status page and/or apache's logs to see what is going in details.

p.s. Apache + fascgi works this way. Switch to PHP-FPM if you don't like to see them, or they confuse you.
 
That doesn't explain the "-d sendmail_path=/usr/sbin/sendmail -t -i -f " bit of the command line options of the running processes, as spawned by /usr/local/safe-bin/fcgid71.sh and /usr/local/safe-bin/fcgid56.sh.
 
You must log in or register to reply here.
Back
Top