Just got email from csf that httpd got deleted ?

April 21, 2022 02:08

Time: Wed Apr 20 17:59:07 2022 -0500 PID: 2381 (Parent PID:2371) Account: nobody Uptime: 3133 seconds Executable: /usr/sbin/httpd (deleted) The file system shows this process is running an executable file that has been deleted. This typically happens when the original file has been replaced by a new file when the application is updated. To prevent this being reported again, restart the process that runs this excecutable file. See csf.conf and the PT_DELETED text for more information about the security implications of processes running deleted executable files. Command Line (often faked in exploits): /usr/sbin/httpd -k start I could not use my iPhone to copy and past the message because of the cookies issue in this forum so that is why I did this in 2 parts.

0

cPRex Jurassic Moderator

April 21, 2022 15:55

Hey hey! That sounds right - there was an update last night and I got this from CSF on my box:

The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/bin/ab: FAILED
/usr/bin/ea-php73: FAILED
/usr/bin/ea-php74: FAILED
/usr/bin/ea-php80: FAILED
/usr/bin/ea-php81: FAILED
/usr/bin/htdbm: FAILED
/usr/bin/htdigest: FAILED
/usr/bin/htpasswd: FAILED
/usr/bin/httxt2dbm: FAILED
/usr/bin/logresolve: FAILED
/usr/sbin/fcgistarter: FAILED
/usr/sbin/htcacheclean: FAILED
/usr/sbin/httpd: FAILED
/usr/sbin/nginx: FAILED
/usr/sbin/nginx-debug: FAILED
/usr/sbin/rotatelogs: FAILED
/usr/sbin/suexec: FAILED
/bin/ab: FAILED
/bin/ea-php73: FAILED
/bin/ea-php74: FAILED
/bin/ea-php80: FAILED
/bin/ea-php81: FAILED
/bin/htdbm: FAILED
/bin/htdigest: FAILED
/bin/htpasswd: FAILED
/bin/httxt2dbm: FAILED
/bin/logresolve: FAILED
/sbin/fcgistarter: FAILED
/sbin/htcacheclean: FAILED
/sbin/httpd: FAILED
/sbin/nginx: FAILED
/sbin/nginx-debug: FAILED
/sbin/rotatelogs: FAILED
/sbin/suexec: FAILED
/usr/local/bin/ea-php73: FAILED
/usr/local/bin/ea-php74: FAILED
/usr/local/bin/ea-php80: FAILED
/usr/local/bin/ea-php81: FAILED

0

Spirogg

April 21, 2022 17:16

Hey hey! That sounds right - there was an update last night and I got this from CSF on my box: The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated: /usr/bin/ab: FAILED /usr/bin/ea-php73: FAILED /usr/bin/ea-php74: FAILED /usr/bin/ea-php80: FAILED /usr/bin/ea-php81: FAILED /usr/bin/htdbm: FAILED /usr/bin/htdigest: FAILED /usr/bin/htpasswd: FAILED /usr/bin/httxt2dbm: FAILED /usr/bin/logresolve: FAILED /usr/sbin/fcgistarter: FAILED /usr/sbin/htcacheclean: FAILED /usr/sbin/httpd: FAILED /usr/sbin/nginx: FAILED /usr/sbin/nginx-debug: FAILED /usr/sbin/rotatelogs: FAILED /usr/sbin/suexec: FAILED /bin/ab: FAILED /bin/ea-php73: FAILED /bin/ea-php74: FAILED /bin/ea-php80: FAILED /bin/ea-php81: FAILED /bin/htdbm: FAILED /bin/htdigest: FAILED /bin/htpasswd: FAILED /bin/httxt2dbm: FAILED /bin/logresolve: FAILED /sbin/fcgistarter: FAILED /sbin/htcacheclean: FAILED /sbin/httpd: FAILED /sbin/nginx: FAILED /sbin/nginx-debug: FAILED /sbin/rotatelogs: FAILED /sbin/suexec: FAILED /usr/local/bin/ea-php73: FAILED /usr/local/bin/ea-php74: FAILED /usr/local/bin/ea-php80: FAILED /usr/local/bin/ea-php81: FAILED

Ok thanks this is solved. Was just making sure :)

0

Just got email from csf that httpd got deleted ?

Comments

Didn't find what you were looking for?