Security :: 100's Of "apache-init-server" - Keeps Running Out Of Memory
Sep 25, 2010
I have a VPS that has 512MB of ram. I'm using it as a mail/web server. It keeps running out of memory. I know amavis/clamav are memory hogs, but I checked my ps aux and found 100's of instances of "apache-init-server" running. I killed them all, and they keep spawning back. What could be causing this. I've never seen this on a webserver before. OS: CentOS 5.5
I'm trying to modify an existing user so that any files they create can be at least read (although writing and execution would be nice) by any other user. The reason is because I need the daemon running my Apache server to be able to access files created by a daemon running under this user, files which will be created and accessed in real-time.
We are trying to define an appliance based on Suse for an application server and Web server Apache, so we would like to know configuration best practices for network and security, is there any paper/doc about best practices?
I have a web server with the specs below and my apache server is being a hog using all my RAM 7gigs or 8gigs of ram. When there is a rush of traffic at once my whole server crashes and I have to reboot apache. The way my site is set up I have a tube script and I use the tube script to host videos on my forum I have 1000 videos on the tube script. I brought a bigger server and more ram because of the down time I been having . I am really trying to figure out why its crashing and using so much ram. I installed eAccelerator didn't seem to help with the apache server.
Intel Quad Core Xeon X3430 (4 x 2.40 GHz, 8MB Cache) > 2-bay Supermicro Chassis and Motherboard > 8 GB REG ECC DDR3 (twice your current setup) > 250 GB Enterprise Grade SATA II > 10 TB Bandwidth 1gig Uplink Port > CentOS 64 Bit (Latest Stable)
TOP Command and free -m command screenshots are attached this is with only 160 people online at once
Ok, so I have a few web apps that need to run shell commands. Heres a great example of one:
Code:
This is a PHP script getting my system volume. Herein lies the problem... www-data doesn't have permission to do this!
I changed my apache config to use MY account as the web user, and it does in fact work the way I want it to.
Obviously, I dont want to leave apache running as me, and want it to keep using www-data.... heres my question... how can I give permission for www-data to execute certain programs?
I have a VPS running a web application served using Apache, that on average deals with 20-50 requests per second. It's usually above this point (50 requests per second) that the amount of memory that Apache uses is too high for the VPS and errors start occuring - web pages crash and VPS falls over for a minute or two before going back to normal levels.
I believe that MaxClients is the best way to reduce the amount of RAM that Apache uses and I am planning to reduce MaxClients from 256 (default value) to around 100. Each Apache process uses ~15MB and the server has 1900MB of ram in total - the server does nothing else other than run Apache and a few crons.
Current setting are:
Code: KeepAlive On MaxKeepAliveRequests 100 KeepAliveTimeout 3 # prefork MPM # StartServers: number of server processes to start
[Code].....
I tried reducing MaxClients before which lead to massive slowness, so I need some other options as well.
Does my suggestion of reducing MaxClients to ~100 seems sensible? What are my options if the server experiences slowness again - optimise the application? What's the best way to reduce memory usage - move images to another web server?
Top only show the memory usage for individual processes. Apache often runs hundreds of processes, each of which may use only a small amount of memory, however the total memory consumed by all apache processes can be fairly large.Is there a way to see the total memory usage for all apache processes?
I'm about to have a web server at home for the first time. I've always missed having full control and not having to contact my hosting company when I need to do some specific changes - and some changes they won't do for you at all.I've chosen the non-GUI Ubuntu Server with LAMP, and nothing more is installed really except for a couple of command line tools from the repository. The LAMP software has been locked down as good as I can by following some guides on the net and using common sense. Like Apache 2 don't have access to the file system except for the www folder, and setting the headers to Prod. MySQL has skip-networking and I've commented out the listen string to localhost. PHP has a truckload of functions that I've disabled in the php.ini, also by following some guides on the net, among some other security enhancing php.ini editing.
The only thing the server will serve is a well known PHP forum and some html docs, and that's all. Nothing advanced or complicated stuff, and I'm definitely not programming PHP myself or letting anyone do it for me.But I do want to sleep well at night knowing that my server is always on and sitting on the edge of my home network! And can I do that? I've heard that you don't need to be worried about getting your Linux server box hacked, but you should be worried about anyone getting root access to it. But is it really that simple? Ubuntu is shipped without root account and you must have the sudo password, right? What's the odds for anyone to get full access to my system?An issue: I've heard that Apache never must run as root. When I do a ps -ef, I see that there are several www-data processes running apache, but there's one root process running apache too. Is this normal and is it safe?An issue: I've heard that PHP can fail pretty easily. But isn't PHP running under apache 2 and limited by the www-data filesystem access?An issue: MySQL is running as a MySQL user, and I guess that's an unprivileged user right?
I just opened an (unmanaged) VPS account and and have been encountering nothing but problems with trying to get Apache up and running (its something I've done many times before).Basically the inital error was with LDAP not having enough space, so I disabled the related extensions and Apache still would not run. Looking at the log, it contains: (28)No space left on device: Unable to create scoreboard (anonymous shared memory failure)
Due to a ton of research I believe I now understand the output of ps, top, and free better than ever, and also have a relatively decent grasp on memory management (virtual address space, etc.) than I ever did before. With that being said, my server is super low on available memory and I can't make 1+1=2 on why it is. I suspect it's Tomcat/JVM (which I admittedly know precious little about). I am rebuilding this server (for a number of reasons) and plan to install 8GB but solving this mystery is key to supporting/promoting my design plans.
Relevant info So, I have very little memory left, I am swapping pretty hardcore, and even though I suspect it's the Tomcat/JVM stuff, it sure doesn't look like it from the memory tools. For that matter though it looks like "nothing" is using memory, or certainly not enough to cause such a low memory problem. The server was rebooted 24 days or so ago because it actually ran out of all virtual memory. How do I solve this mystery? Am I using the wrong tools? Am I misunderstanding my tools? What can I do to track down the processes depleting my memory?
I have a single CentOS server with two separate NIC's. I was asked to install an internal Wiki on Apache but have that dedicated to one NIC so it's internal only. Then have just a site running on Apache on the 2nd NIC which is externally accessible. I have never done anything like this and would like tonow how difficult this would be on a single stand alone server that I have above?
When I do " ps aux | grep apache " I can see that apache2 is running. But when I do the same thing for http or httpd there is nothing. I looked for this question in the forums but couldn't find it. I probably don't know just what to look for.I'm using the new Debian Squeeze, and was fooling around heavily with new software installations and modifications, and just noticed all of a sudden that I couldn't get on the internet - so I know I did something but don't know what.I can plug in a thumb drive with a bitnami joomla stack on it and run, " ~/tmp/joomla-1.6.0-0/./ctlscript.sh start "and that gets things going for the joomla stuff (apache, http, mysql, php), but that stuff is pretty self contained and does not effect the browser's attempt to reach the web.
I just did a fresh install of ubuntu 9.10 and install apache2 webserver with php5 and mysql, but for some reason I have no idea why but when upload files to the computer running apache2 webserver
http://69.242.228.170/ is the link to the ubuntu system It's not displaying the website correctly and it's not working on any pc on my network either, but it looks fine in dreamweaver when I was designing it on my laptop. list of all the files and folders in the /var/www path
i have apache and mysql running, i can access my web server by visiting localhost on port 80 but for some reason when it doesnt work when i try using my ISP provided IP address... (it used to work).. i have my router setup with a DMZ on my LAN IP (my computers IP, this is the computer in my home network that serving with apache).. i also cant seem to shut down my mysql server (theres an update ive been trying to get) even when i use sudo...
I set up my first web server and it works flawlessly -when accessed from external network or from other computers on my lan. However, I cannot access it from the computer where the server is run on. I have found numerous people with similar problems but the flavour I am experiencing is somewhat different and no solutions I have found apply to it.
I have two network interfaces on my server, eth0 (public static IP connected to internet directly) and eth1 connected to LAN 192.168.1.0/24 range. The server is 192.168.1.1. It is connected directly to the internet and serves as a SNAT for other comps on the lan.I added "192.168.1.1 www_server_com" to the /etc/hosts on the server and also on the other machines on the LAN. All the other machines can open website without any problem.HOwever, the server itself only opens website if the address islhost. Internal IP, i.e. 192.168.1.1. gets a time out and so does www_server_com ( I cant use dots as I do not have more than 15 posts on the forum )Here is the firewall script I am using.
I am running Apache 2.2.3 on a CentOS release 5.3 (Final) with 100 Sites. I've notice that Apache is making my server Swap around 200 MBs. "http://www.xxx.yyy.zzz/server-status" doesn't show me too much to, so I am looking the behavior of specific httpd process. ProcessID "18753" is the one for "http://www.xxx.yyy.zzz/server-status" in my browser.
This command show me (In KBs) how much virtual memory is that specific process using: # /etc/init.d/httpd start # grep Private_Dirty /proc/18753/smaps | awk '{ print $2 }' | xargs ruby -e 'puts ARGV.inject { |i, j| i.to_i + j.to_i }' 3012 ... Running this command a lot of times it gives me the same output, but suddenly... # grep Private_Dirty /proc/18753/smaps | awk '{ print $2 }' | xargs ruby -e 'puts ARGV.inject { |i, j| i.to_i + j.to_i }' 21708
Something make that process (and all the others httpd process too) to use a lot more memory!
Part of my httpd.conf: # Timeout 120 KeepAlive On MaxKeepAliveRequests 100 KeepAliveTimeout 3
My server is running Mysql 5.1.34, vsftpd 2.0.5, BIND 9.3.4-P1 (as slave). I couldn't found anything running in the specific time that httpd processes start to use that much memory.
I trashed my Karmic Ubuntu install and installed Lucid (I had heard that the boot times were much reduced and I didn't see any improvement in my normal upgrade). I reinstalled Drupal but find that my installation of Apache does not run the scripts, but rather passes the php text file to the browser. IIRC when I installed it apt configured Apache correctly without me having to edit .htaccess or /etc/apache2/httpd.conf which makes me think that I am missing a key dependency.
Does anyone know of a check list to which I can refer to make sure that I've installed everything? My installation has Postgres instead of MySQL. Failing which, in the event that my memory is faulty, where can I find which changes need to be applied to the configuration files above?
OS: Ubuntu Server x64 10.04 Apache: 2.2.14-5ubuntu8.4 I have a virtual server which has been running for months with no problems then one day I saw that it crashed and I had to power cycle it. Since then I have been unable to start Apache as it segfaults no matter options I give it. Before I try to reinstall Apache, why is this segfaulting?
Code: execve("/usr/sbin/apache2", ["/usr/sbin/apache2"], [/* 21 vars */]) = 0 brk(0) = 0x7f9f48f8d000 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9f47e0d000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3
I'm trying to get Apache to run in a user's home directory. I changed the conf file so that Apache runs under the user and group "kiosk" and changed the DocumentRoot and Directory from the default to "/home/kiosk". Then I set Apache to start at boot (chkconfig --level 235 httpd on) and rebooted. When I checked, httpd is running as kiosk like it should (ps aux | grep httpd). However, when I try wget localhost, I get a 403 response back. If as root I call "httpd -k stop" and then "httpd -k start", then everything works exactly as it should (curiously, if I try using "-k restart", it still doesn't work). After this, httpd still shows as running as kiosk and if I check before calling start, it shows no httpd processes running as expected.
This only happens when I use httpd to stop and then start the web server. If I try to restart using apachectl I still get a 403 error. As an interesting aside, after I've used httpd, if I try using "apachectl restart" I get a "(13)Permission denied: Error retrieving pid file run/httpd.pid" error. This is all on a freshly installed CentOS 5.5 server. Why I'm seeing this very different behaviour from what I thought were just equivalent ways of starting Apache? And then what I could do to get it to start up and run properly on boot? One last item to mention is this isn't a permissions problem. I set the permissions to 777 to both the home and kiosk directories (and 666 to the web files) just to be sure that's not the problem.
I am having a problem.I use Ubuntu 10.04 server edition.Two computers on LAN one with Public Ip A other with local (Class C IP)say it BWith a third computer in same subnet I can access a TomCat application running on B as http://Ip of B:8080/applicationI want to use A as a Reverse Proxy for this application to be reachable from internet.So on Googling I came across some thing known as mod_ajp I enabled that on my Server A asa2enmod proxya2enmod proxy_ajpa2enmod headersbut after that I am not able to understand as how do I define vhost to be able to forward HTTP request which come on A as www.myserver.com/appto B which I can see internally as http://Ip of B:8080/application so Tomcat on B handles this.
I am a newbie to linux of 4 weeks. I set up my first web server and it works flawlessly - when accessed from external network or from other computers on my lan. However, I cannot access it from the computer where the server is run on. I have found numerous people with similar problems but the flavour I am experiencing is somewhat different and no solutions I have found apply to it.I have two network interfaces on my server, eth0 (public static IP connected to internet) and eth1 connected to LAN 192.168.1.0/24 range. The server is 192.168.1.1
I added "192.168.1.1 www.server.com" to the /etc/hosts on the server and also on the other machines on the LAN. All the other machines can open website without any problem.
HOwever, the server itself only opens website if the address is localhost. Internal IP, i.e. 192.168.1.1. gets a time out and so does www.server.com.I do not understand why the record in etc/hosts doesn't point it in the right direction. It seems that when I open address 192.168.1.1 it still gets routed to the external network. I have seen using DNAT to deal with the problem but it didn't work in my case (maybe I didn't do it correctly). I have spent whole evening/night trying to sort it out, it's 4AM now, going to bed frustrated and angry (at myself hahaha). Still like linux very much, won't be going to windows anymore. Please help
I installed LAMPP a couple of weeks ago and was working fine. Today when I try to start lampp, it will only start MySql and ProFTPD. It says "XAMPP: Another web server daemon is already running." How can I find out where this other server is located and stop it?
On my server I provide OCR file conversion service but the problem is when a user uploads a file and it's being converted then if you open another tab and try to load the site it won't respond until that conversion is completed. In other words until the PHP script finishes execution apace doesn't serve any other request to the same browser.
Here is my apache configuration:
Code:
ServerTokens OS ServerRoot "/etc/httpd" PidFile run/httpd.pid
[code]....
You can check what I mean if you try to upload and convert a file and while the file is converting try opening the site in another tab.
I am running Ubuntu 10.04 on my laptop. I have an Apache web server running that I can access at 192.168.1.102 ("It works! This is the default web page for this server. ...").
Are there any security risks in leaving this running? Is the web server available to anyone outside my network?
I'm trying to send files from a Unix server using http/curl to a Linux webserver running Apache. I get the following PUT error message when and the file does not send:
<title>405 Method Not Allowed</title> </head><body> <h1>Method Not Allowed</h1> <p>The requested method PUT is not allowed for the URL
I've set up a server for the first time today and I'm reading up on how to secure it. But I was wondering if anyone here would give me some tips from personal experience on what to do before going online with my website for the whole world to see. I'm running Ubuntu Server edition and Apache. Am I good to go with default settings or is there anything recommended that I should first do?