1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

plesk kernel: application bug: perl

Discussion in 'Plesk for Linux - 8.x and Older' started by PixyPumpkin, May 29, 2005.

  1. PixyPumpkin

    PixyPumpkin Guest

    0
     
    Hi, last night i received an error from Plesk:

    May 29 01:48:04 plesk kernel: application bug: perl(2669) has SIGCHLD set to SIG_IGN but calls wait().
    May 29 01:48:04 plesk kernel: (see the NOTES section of 'man 2 wait'). Workaround activated.
    May 29 02:00:25 plesk kernel: application bug: perl(2669) has SIGCHLD set to SIG_IGN but calls wait().

    This error generated 50GB of traffic within a couple of hours.
    Does anybody know how to solve this problem?

    After a reboor all seemed fine, but will it come back?

    Thx!
     
  2. Griffith

    Griffith Guest

    0
     
    There can be more than one thing that causes this, but last time I got it, it was a hacker who were running a perl wget program... it ran as perl, but said "/usr/bin/httpd -DSSL" when I used ps -aux, and you could also see it while running "netsat -nlp"

    Check /tmp if there is suspicous files...
     
  3. PixyPumpkin

    PixyPumpkin Guest

    0
     
    Wow, this is exactly what happened, the file wget.pl was indead in the /tmp Thx! :)
     
  4. Griffith

    Griffith Guest

    0
     
    But, you should do something with it.. if you search every httpd error_log after admin_styles.php I think it was.. you will probably find wich site this hack came from.. will guess it is a phpBB exploit..

    grep -lir "admin_styles.php" /path/to/sites/httpd_logs/error_log


    Another thing... you said it genreated 50GB transfer... do you have any clue what it was getting and where it was stored?
     
  5. PixyPumpkin

    PixyPumpkin Guest

    0
     
    I had only one phpBB running, I deleted it.
     
  6. PixyPumpkin

    PixyPumpkin Guest

    0
     
    Not a cleu, the disk space did not change?
     
Loading...