Home / server / Questions

Questions[nobody](server)

Martin Hope
Fraktar
Asked: 2020-04-25 01:12:35 +0800 CST
  • 0

At startup I noticed my machine was under heavy load.

Opened up a terminal and top to find a process running the command find under user nobody that was using 90%+ of my memory.

I killed it immediately.

Has my machine been compromised? How can I tell?

Could this be related to this cron job?

$ grep nobody /etc/cron.daily/*

/etc/cron.daily/locate:LOCALUSER="nobody"

linux security cron process nobody
Martin Hope
jalal
Asked: 2012-04-16 07:14:13 +0800 CST
  • 4

If i try to run the following:

<?php echo file_get_contents("http://www.yahoo.com/index.html"); ?>

through the web server I get a an "php_network_getaddresses: getaddrinfo" error.

If I run the same file from the shell with:

php test.php

then I get the expected file output.

This indicates to me that the 'nobody' user, which the webserver runs as, is not able to resolve the domain name, but the shell user can.

Any ideas on how to fix this?

Further info: CentOS 6, cPanel install, Apache, PHP running as dso.

BTW, I've tried disabling the firewall to no effect.

[SOLVED] - when I found that gethostbyname() was working, I realised that it was some internal caching problem. A server restart seems to have sorted out the problem.

domain-name-system php centos6 nobody
Martin Hope
Alexander
Asked: 2011-07-06 01:50:32 +0800 CST
  • 2

I believe I had set everything up correctly when I had built the server (maybe it was a pre-configured LAMP that the VPS host Linode supplied that set things up)

It seems that every Apache process runs under the user nobody which is what I had intended in the configuration, however the lower PID (longest running Apache process) is still running under root, an my PHP scripts seem to report the current user as root through asking in phpinfo().

is this due to the fact root may be spawning Apache, and its children are spawning correctly under the defined nobody user as per its configuration? Do any of the actual pages get processed through that root Apache process or is it just there to be a parent?

I am a little concerned, however have no problem with starting a new Apache with a fresh mind to fix this if it is a little more than a configuration mishap.

Minor extra info edit: It appears $_SERVER['user'] is root even though $_SERVER['apache_run_user'] (similar to that) shows www-data (even though not nobody), I am unsure if this is PHP's fault, maybe I will try editing a root file in PHP and see..

edit 2: nope, PHP cannot edit root files. Guess $_SERVER['user'] (and a hacky audit script) is wrong to assume PHP is root then. still wondering about the Apache process though,.

apache-2.2 security root nobody
Martin Hope
John R.
Asked: 2010-12-06 15:58:42 +0800 CST
  • 2

I created a new user named bob, and gave it its own /home/ folder on my server so I can SSH into that instead of root.

I had added bob into the nogroup group as I had read somewhere (or poorly interpreted it) as allowing me to edit nobody's files, but I get permission denied when I try.

How do I edit nobody's files without running sudo every time, how do I grant permission for bob to edit them?

user-permissions nobody
Martin Hope
Chris Bunch
Asked: 2010-02-07 18:32:03 +0800 CST
  • 2

I have a daemon sitting in my root directory that currently is being run as root. However, since this program can read the file system, this is clearly a security problem. How can I run it as nobody so that I can resolve this problem?

Doing "su - nobody -c /root/myscript" doesn't work, returning a permission denied error. The only ways I can seem to get around this are:

  1. Chmod -R 777 /root, which I don't want to do on my root dir and also messes up ssh.
  2. Move the script to /opt or /var and then do (1)

Of course, there may be an easy solution that I'm missing. I can chown it to nobody but that doesn't fix the problem either. Any ideas?

linux permissions daemon nobody