Suspicious Process*User:www-data EXE:/usr/sbin/php5-fpm

Question

I have csf installed on Debian server which uses nginx+php5-fpm and see a lot of these

lfd[23293]: Suspicious Process PID:16998 PPID:16122 User:www-data Uptime:824 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www
lfd[23293]: Suspicious Process PID:17053 PPID:16122 User:www-data Uptime:822 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www
lfd[23293]: Suspicious Process PID:17113 PPID:16122 User:www-data Uptime:818 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www
lfd[23293]: Suspicious Process PID:17114 PPID:16122 User:www-data Uptime:818 secs EXE:/usr/sbin/php5-fpm CMD:php-fpm: pool www

in /var/log/lfd.log While the server load is strangely high (+100) and ldf frequently bounce top on cpu usage list. I am wondering whether this signals some attack vector and if so how to counter it?

score 1 · Answer 1 · edited Apr 13 '17 at 12:14

1

While your suspicion can be legitimately addressed on this site, the solution to your problem is more suited for SuperUser, or, better, ServerFault.

Usually, this is nothing to worry about, nobody is attacking you. This is a typical ConfigServer Security Firewall LDF false-positive. With each connection, a new php5-fpm instance is spawned, that's why you're seeing so many entries.

To solve this, just add exe:/usr/sbin/php5-fpm to your /etc/cfs/cfs.pignore

.

edited Apr 13 '17 at 12:14

Community

1

answered Oct 17 '13 at 23:00

Adi

130
1
10

Well, I wish I could be as certain as you. But the unusually high load indicates that the server is under attack, even though you might be right about the ldf showing false positive. – alfish Oct 17 '13 at 23:15
@alfish Then you're showing us the wrong logs. – Adi Oct 17 '13 at 23:16
What logs do you need to see Adnan? – alfish Oct 17 '13 at 23:18
If your web server is consuming the resources, then it is better to check the access logs. It could be D/DoS or something else. – Stanimir Stoyanov Oct 25 '14 at 16:18

score 0 · Answer 2 · answered Oct 20 '16 at 15:10

0

I traditionally add these lines to every /etc/csf/csf.pignore file of server I setup:

# sineld
exe:/usr/sbin/php5-fpm
exe:/usr/sbin/nginx
exe:/usr/sbin/mysqld
exe:/usr/bin/redis-server
exe:/sbin/rpcbind
exe:/usr/sbin/dnsmasq
exe:/sbin/rpc.statd

answered Oct 20 '16 at 15:10

Sinan Eldem

101
2

Suspicious Process*User:www-data EXE:/usr/sbin/php5-fpm

2 Answers2