Limit max number of php or apache processes per user

[mathx]

Amazed this isnt a topic I could find at all with 10 google searches on the forums.

Everyone knows xmlrpc.php is being hammered by botnets looking for ways into wordpress. Even with the file removed, we were getting heavily loaded by 404s being returned to the hacker. Luckily they were coming from one IP so we could firewall this time. Not so lucky if we get hit by a botnet with only one hit per IP.

Ulimit doesnt seem to work for users' limits on # of processes total in the system, I figure because suexec is used by apache to execute as the user and isnt inheriting the ulimits.

Is there a way to limit the # of php/apache processes per user?

 

[cPanelMichael]

Hello,

You may want to consider an alternative to protecting your server against this type of attack. Here's a thread you may find helpful:

SOLVED - Distributed wordpress attacks/scans

Thank you.

 

[mathx]

I worded my query wrong -- there is a general problem with any php that is being run that requires a username and password - even custom code. Botnets or hackers just keep hitting the login.php or equivalent in WP, Joomla, etc as well as custom code --

We'd prefer to just limit the # of apache processes per user so the load doesnt climb beyond when email is delivered and the system is sluggish. 10 should be more than enough to serve many requests.

So we need the generic solution, not the specific one for wordpress.

 

[cPanelMichael]

Hello,

You'd need to utilize third-party software such as CloudLinux to limit processes on a per-user basis. Here are some links that explain how to configure this on CloudLinux:

CloudLinux Documentation
CloudLinux Documentation
Mod_lsapi, number of processes and EP explained – CloudLinux KnowledgeBase

Thank you.

 

[mathx]

or just use the darn hack of checking every 15 seconds to make sure there arent too many processes for a user, and killing the most recent/oldest/most cpu/some criteria. a short script works. kinda not elegant though.

but easier than a whole OS reinstall.

 

[Infopro]

You can convert an existing CentOS installation to CloudLinux, no need for a complete reinstall.

CloudLinux Documentation

 

[mathx]

aha! thanks. will investigate.

 

[Anoop P Alias]

You can set an upper limit or max php process if you use PHP-FPM SAPI . But your idea is generally not good and when you are under attack,your entire website and real users will also get affected. The best way to deal with this is to use a nginx frontned and use config like Module ngx_http_limit_conn_module . You can limit the request to a particular URL like /xmlrpc.php for example with this without affecting other parts of your website.