Re: Apache under attack and eating resources?

From: Philip Paeps (philip+freebsd_at_paeps.cx)
Date: 09/29/03

  • Next message: Devon H. O'Dell: "Re: Apache under attack and eating resources?" 
    Date: Mon, 29 Sep 2003 09:05:42 +0200
To: security@freebsd.org

    On 2003-09-29 08:35:20 (+0200), Devon H. O'Dell <dodell@sitetronics.com> wrote:
    > > I forgot to mention I was running mod_php4 from the ports. I don't think
    > > any scripts changed in the last few weeks, but I'll have a look into it.
    > > Any idea what kind of script bugs could cause PHP to tear things down like
    > > this, other than the classic loop from hell?
    >
    > PHP does a pretty good job from protecting against this.

    That's what I thought too, and I've never had this sort of issues before even
    on development systems where wasteful and dangerous coding is a rule rather
    than an exception.

    > Installing mod_php4 from ports will also turn on the --enable-memory-limit
    > switch, which causes PHP to terminate if more than x MB RAM are taken (this
    > shouldn't segfault Apache).

    In case I was misinterpreted: it's only a child or a number of children which
    segfault, not the parent process. Grepping the massive logfile some more,
    shows that it's not always a segfault either. Last night, one child also died
    with an 'abort trap' and two days ago there was a 'bus error'. Curiouser and
    curiouser...

    > The "classic loop from hell" should also be undoable, since PHP has a 60
    > second execution time limit.

    I set it slightly higher for some scripts (none of which run at the times
    Apache goes nuts). I've stresstested those like a madman though, and they
    just won't damage anything.

    > You might want to run your httpd process in gdb to see what's going on when
    > stuff segfaults. If this is indeed a problem with PHP, I'm sure the
    > developers would like to hear about it ASAP!

    I'll look into that, thanks. Problem is that it's a production server and
    debugging symbols and debuggers might be a bit of a hard sell. I'll see what
    I can do though.

    First there's finding out if it's really PHP causing problems and not
    something like the phase of the moon or the relative proximities of Mars and
    Venus to the Earth...

    Thanks!

     - Philip 

    -- 
Philip Paeps                                          Please don't CC me, I am
                                                       subscribed to the list.
  History repeats itself.
  that's one of the things wrong with history.
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Devon H. O'Dell: "Re: Apache under attack and eating resources?"

    Relevant Pages

    • Re: Web Server Botnets and Server Farms as Attack Platforms
      ... insecure web application written in PHP, although attacks for other ... The main reason for this is that many different PHP applications are ... and you've found your way to execute shell code on the remote web server. ... those scripts were put in place. ...
      (Bugtraq)
    • Re: [Full-disclosure] Web Server Botnets and Server Farms as Attack Platforms
      ... insecure web application written in PHP, although attacks for other ... The main reason for this is that many different PHP applications are ... and you've found your way to execute shell code on the remote web server. ... those scripts were put in place. ...
      (Full-Disclosure)
    • Re: Post with redirect?
      ... redirection...and how to do a post from php (which you said was ... I said it was impossible to redirect from PHP. ... my claim is NOT that you can redirect post data. ... And all you do is post scripts you've collected off the internet. ...
      (comp.lang.php)
    • php mail() sendmail hanging
      ... When hitting php pages that use the mailfunction, I get a 5 second hang ... dnl Uncomment to allow relaying based on your MX records. ... This can allow sites to use your server as a backup MX without ... You can redirect all of the output of your scripts to a function. ...
      (freebsd-questions)
    • Trouble with system() function
      ... PHP manual and have tried everything there, ... tried it on 2003 Server, ... You can redirect all of the output of your scripts to a function. ... A warning appears if the specified function is not defined, ...
      (comp.lang.php)