4 ms·

Does your web crawler run as a non-root user and not in sudoers? Does sudoers allow passwordless sudo? Could it be the crawler hit a malicious URL designed to

Does your web crawler run as a non-root user and not in sudoers? Does sudoers allow passwordless sudo? Could it be the crawler hit a malicious URL designed to trick crawlers into executing commands or code using a parsing bug? Or by chance does your crawler or some other package have a web UI that utilizes Apache as a dependency but you perhaps have always used the CLI? By default apache should not be running as root. There should be an suexec in the configuration file and the child processes should be running as a non-root service account. Are there any comments possibly left by a script in the config? Do you have package installation logs in /var/log somewhere? I dont use the Ubuntu variants so not sure which log this would be. Maybe /var/log/apt/? or /var/log/dpkg.log or maybe there are entries in /var/log/messages? Packages installed just prior to or just after apache2 may give some clues as to what pulled it in as a dependency.

toast0 4y ago
> By default apache should not be running as root. Everywhere I've run apache, it runs the control process as root, and the serving processes as (nobody|www|something); that way it can open new sockets when reloading the config, if required, before forking new serving processes. There's ways you can avoid a root control process, but that's going to be the default, as it's the easiest way to achieve the results people usually want.
golgo_13 4y ago
will poke around the logs a bit though... thanks!
golgo_13 4y ago
Hmmm it's just a Python/selenium bot... I think selenium runs on a given local-loopback:port, but I don't think it uses apache though?
- LinuxBender 4y ago
  Your bot would not intentionally by design, but if it were tricked into parsing a malicious URL then the remote site could potentially trick your bot into executing code or commands but this is hypothetical and less likely than some application you installed pulling apache in as a dependency. I would first check all the logs. Also look in /var/log/audit/audit.log if you have auditd enabled.
golgo_13 4y ago
actually could it have in included when installing build-essential from apt repo?
- LinuxBender 4y ago
  If this was done through apt then I would expect it to be in your logs unless they rotated out. Older logs may be .gz or .bz2 compressed. Oldest logs may be gone.

toast0 4y ago

> By default apache should not be running as root. Everywhere I've run apache, it runs the control process as root, and the serving processes as (nobody|www|something); that way it can open new sockets when reloading the config, if required, before forking new serving processes. There's ways you can avoid a root control process, but that's going to be the default, as it's the easiest way to achieve the results people usually want.

golgo_13 4y ago

will poke around the logs a bit though... thanks!

golgo_13 4y ago

Hmmm it's just a Python/selenium bot... I think selenium runs on a given local-loopback:port, but I don't think it uses apache though?

LinuxBender 4y ago
Your bot would not intentionally by design, but if it were tricked into parsing a malicious URL then the remote site could potentially trick your bot into executing code or commands but this is hypothetical and less likely than some application you installed pulling apache in as a dependency. I would first check all the logs. Also look in /var/log/audit/audit.log if you have auditd enabled.

golgo_13 4y ago

actually could it have in included when installing build-essential from apt repo?

LinuxBender 4y ago
If this was done through apt then I would expect it to be in your logs unless they rotated out. Older logs may be .gz or .bz2 compressed. Oldest logs may be gone.