CWP Security Audit - Unknown file

Getting this alert

Code: [Select]

CWP Security Audit - Unknown file

Unknown file: /opt/php-build-deps/lib64/libzip.so.5.5
Should I be concerned?

Also getting

Code: [Select]

CWP Security Audit - Ghost files

Ghost files found for apache

No concern on the first, a false positive. Does it show any additional information on the "ghost files"? Did you get your casino SEO problem taken care of? Did you find that malicious Apache module that was producing the output for the bots?

I was watching this vid (https://www.youtube.com/watch?v=ksmWCWw5Vd4), logged into CWP admin and have the same two errors and others.

I would double check to make sure you don't have any fake kernel threads running or deleted processes running out of memory. tuned is legitimate, as long as it's not another process trying to disguise itself as tuned.

I asked Sandeep about:



He said that error was a false positive from php-manager.

--

The rest looks like you have another or several other problems with the server, and some things that aren't configured correctly.

Thanks for the responses!

Currently 229 processes running. How do you know if any/which ones are illegitimate?

Since recent server updates were installed, the Server health and performance counters no longer auto-refresh, either.

I also noticed that I now get a 403 when accessing any info.php, for any user. If I exclude INFO_MODULES, the other php data displays.

You can try this short one-liner, or I have a longer script if you're interested.

Code: [Select]

find /proc/[0-9]*/exe -lname '*deleted*' -ls 2>/dev/null

Thank you!

I ran the one-liner:

Code: [Select]

[root@cwp8 ~]# find /proc/[0-9]*/exe -lname '*deleted*' -ls 2>/dev/null
   993687      0 lrwxrwxrwx   1  root     root            0 Oct 27 10:30 /proc/229839/exe -> /usr/local/cwp/php71/sbin/php-fpm\ (deleted)
   997452      0 lrwxrwxrwx   1  root     root            0 Oct 27 10:35 /proc/230497/exe -> /usr/local/cwp/php71/sbin/php-fpm\ (deleted)
  1007333      0 lrwxrwxrwx   1  root     root            0 Oct 27 10:48 /proc/232923/exe -> /usr/local/cwp/php71/sbin/php-fpm\ (deleted)
    24299      0 lrwxrwxrwx   1  root     root            0 Oct 26 22:33 /proc/910/exe -> /usr/local/cwp/php71/sbin/php-fpm\ (deleted)
    24339      0 lrwxrwxrwx   1  root     root            0 Oct 26 22:33 /proc/931/exe -> /usr/local/cwp/php71/sbin/php-fpm\ (deleted)

So what does that one-liner tell us?

I used the stand alone PHP updater (https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions)

I also noticed that the bin directory does not exist:

Code: [Select]

[root@cwp8 ~]# ls /usr/local/cwp/php71
etc  lib  php.d  tmp  var


I ended up restoring a 5 day old backup of the VM. That seems to have solved some of the issues including the missing directories. Looks like I did get hit by the PHP2Shell vulnerability.

Since updates were applied after restoring the VM, I had to run the Quick fix listed here to regain access to the admin.

Now, the counters on the dashboard do not update every 5 seconds like they are supposed to. I asked how to fix in the thread I linked to in the previous sentence.