floyd
Verified User
- Joined
- Mar 29, 2005
- Messages
- 6,248
Edit: I am back to maintaining this script again since the one at webhostgear is dead now. It cannot even be downloaded anymore.
Here is a perl script that will detect illegal or unknown apache processes. It
will kill them and send you an email letting you know it killed them and what
they were. It gives you the line from "ps aux" and the information from
"ls -l /proc/$pid" This should help you in quickly identifying problems.
Comments are welcome good or bad. It would be especially useful if anybody
has any ideas on how to improve the script. I know it has been very useful
to me. Because of it I detected the recent roundcube exploit very quickly
and was relatively unaffected by it. Not all of my servers were running this so
I was affected but not nearly as bad as it could have been.
Anyway here is the script:
EDIT I am just going to start giving a date as to when this script is updated.
The date will be in the script itself that way you always know which one you have.
Here is a perl script that will detect illegal or unknown apache processes. It
will kill them and send you an email letting you know it killed them and what
they were. It gives you the line from "ps aux" and the information from
"ls -l /proc/$pid" This should help you in quickly identifying problems.
Comments are welcome good or bad. It would be especially useful if anybody
has any ideas on how to improve the script. I know it has been very useful
to me. Because of it I detected the recent roundcube exploit very quickly
and was relatively unaffected by it. Not all of my servers were running this so
I was affected but not nearly as bad as it could have been.
Anyway here is the script:
EDIT I am just going to start giving a date as to when this script is updated.
The date will be in the script itself that way you always know which one you have.
Code:
#!/usr/bin/perl
# Last updated January, 26 2009 1232972865
# This script will check the processes running as apache every so many
# seconds
# It has been trested on RedHat based systems.
# Create a file and copy and paste these contents and put it wherever you
# want it
# chmod 755 the script
# So that the script will start on boot add to /etc/rc.d/rc.local the command
# "/path/to/script/ &"
# Start the script from the command line use "/path/to/script/ &"
# To stop the script "ps aux | grep apache.pl" and then kill the process id.
# I will not be held responsible for use of this script.
# Everybody who wants to use it should read through it so they know what
# its doing.
# Configure variables
# The ip address of the server. This
# identifies which of your servers has a problem
$ip = "xxx.xxx.xxx.xxx";
# Your email. Make sure you have a \ before the @
# Make sure mailx is installed.
$email = "email\@example.com";
# Subject of the email sent to you
$subject = "script running";
# $test on will email you all the processes currently running
# as apache and check to make sure you will get the email
$test = "off"; # or "on"
# You want it to kill the process
$kill = "yes"; # or "no" If "no" it will just notify you the script is running
# Checks every so many seconds
$time = 10;
# Include processes you want to be ignored. One per line between the ( );
# The are some others that you might want to put here.
# When you get the email you can decide at that point if the process needs
# to be added here.
@exclude = qw(
defunct
/usr/sbin/httpd
/usr/bin/sendmail
/usr/sbin/sendmail
);
foreach $exclude(@exclude){
$exclude2 .= " | grep -v \"$exclude\"";
}
# Edit anything after here at your own risk
chomp(@exclude);
# Test if OS is FreeBSD
if (`uname -s` eq "FreeBSD") {
print "Sorry this program is not compatible with FreeBSD!\n";
exit;
}
while(){
$bodyofemail = "";
if ($test eq "off"){
@grep = `ps aux | grep ^apache $exclude2`;
}
if ($test eq "on"){
@grep = `ps aux | grep ^apache`;
}
chomp(@grep);
foreach $grep(@grep){
($user,$pid) = split(/\s+/, $grep);
if ($grep ne ""){
print "$grep\n";
@ls = `ls -l /proc/$pid`;
$bodyofemail .= "$grep\n\n@ls\n\n\n";
}
if (($test eq "off")&&($kill eq "yes")){
`kill -9 $pid`;
}
}
if($bodyofemail){
`echo "$date\n\n$ip\n\n$bodyofemail" | mail -s "$subject" $email`;
}
sleep($time);
}
Last edited:
).