The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

"Suspicious process running under user memcached"

Discussion in 'Security' started by webservers, Apr 13, 2015.

  1. webservers

    webservers Active Member

    Joined:
    Nov 3, 2014
    Messages:
    26
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    Do I need to be concerned?
    p.s. I do have memcached installed.

    Code:
    Time:    Sat Apr 11
    PID:     2238 (Parent PID:2238)
    Account: memcached
    Uptime:  214041 seconds
    
    
    Executable:
    
    /usr/bin/memcached
    
    
    Command Line (often faked in exploits):
    
    memcached -d -p 11211 -u memcached -m 64 -c 1024 -P /var/run/memcached/memcached.pid
    
    
    Network connections by the process (if any):
    
    tcp: 0.0.0.0:11211 -> 0.0.0.0:0
    tcp6: 0.0.0.0:11211 -> 0.0.0.0:0
    udp: 0.0.0.0:11211 -> 0.0.0.0:0
    udp6: 0.0.0.0:11211 -> 0.0.0.0:0
    
    
    Files open by the process (if any):
    
    /dev/null
    /dev/null
    /dev/null
    [eventpoll]
    [eventpoll]
    [eventpoll]
    [eventpoll]
    [eventpoll]
    
    
    Memory maps by the process (if any):
    
    00400000-00414000 r-xp 00000000 fd:00 44571291                           /usr/bin/memcached
    00614000-00615000 rw-p 00014000 fd:00 44571291                           /usr/bin/memcached
    00615000-0061b000 rw-p 00000000 00:00 0
    00814000-00816000 rw-p 00014000 fd:00 44571291                           /usr/bin/memcached
    015db000-015fc000 rw-p 00000000 00:00 0                                  [heap]
    3074000000-3074019000 r-xp 00000000 fd:00 44568433                       /usr/lib64/libevent-1.4.so.2.1.3
    3074019000-3074219000 ---p 00019000 fd:00 44568433                       /usr/lib64/libevent-1.4.so.2.1.3
    3074219000-307421a000 rw-p 00019000 fd:00 44568433                       /usr/lib64/libevent-1.4.so.2.1.3
    307421a000-307421b000 rw-p 00000000 00:00 0
    388d800000-388d820000 r-xp 00000000 fd:00 39583787                       /lib64/ld-2.12.so
    388da1f000-388da20000 r--p 0001f000 fd:00 39583787                       /lib64/ld-2.12.so
    388da20000-388da21000 rw-p 00020000 fd:00 39583787                       /lib64/ld-2.12.so
    388da21000-388da22000 rw-p 00000000 00:00 0
    388dc00000-388dd8a000 r-xp 00000000 fd:00 39583882                       /lib64/libc-2.12.so
    388dd8a000-388df8a000 ---p 0018a000 fd:00 39583882                       /lib64/libc-2.12.so
    388df8a000-388df8e000 r--p 0018a000 fd:00 39583882                       /lib64/libc-2.12.so
    388df8e000-388df8f000 rw-p 0018e000 fd:00 39583882                       /lib64/libc-2.12.so
    388df8f000-388df94000 rw-p 00000000 00:00 0
    388e000000-388e017000 r-xp 00000000 fd:00 39584155                       /lib64/libpthread-2.12.so
    388e017000-388e217000 ---p 00017000 fd:00 39584155                       /lib64/libpthread-2.12.so
    388e217000-388e218000 r--p 00017000 fd:00 39584155                       /lib64/libpthread-2.12.so
    388e218000-388e219000 rw-p 00018000 fd:00 39584155                       /lib64/libpthread-2.12.so
    388e219000-388e21d000 rw-p 00000000 00:00 0
    388e800000-388e807000 r-xp 00000000 fd:00 39584158                       /lib64/librt-2.12.so
    388e807000-388ea06000 ---p 00007000 fd:00 39584158                       /lib64/librt-2.12.so
    388ea06000-388ea07000 r--p 00006000 fd:00 39584158                       /lib64/librt-2.12.so
    388ea07000-388ea08000 rw-p 00007000 fd:00 39584158                       /lib64/librt-2.12.so
    388fc00000-388fc16000 r-xp 00000000 fd:00 39584205                       /lib64/libresolv-2.12.so
    388fc16000-388fe16000 ---p 00016000 fd:00 39584205                       /lib64/libresolv-2.12.so
    388fe16000-388fe17000 r--p 00016000 fd:00 39584205                       /lib64/libresolv-2.12.so
    388fe17000-388fe18000 rw-p 00017000 fd:00 39584205                       /lib64/libresolv-2.12.so
    388fe18000-388fe1a000 rw-p 00000000 00:00 0
    3892800000-3892816000 r-xp 00000000 fd:00 39584198                       /lib64/libnsl-2.12.so
    3892816000-3892a15000 ---p 00016000 fd:00 39584198                       /lib64/libnsl-2.12.so
    3892a15000-3892a16000 r--p 00015000 fd:00 39584198                       /lib64/libnsl-2.12.so
    3892a16000-3892a17000 rw-p 00016000 fd:00 39584198                       /lib64/libnsl-2.12.so
    3892a17000-3892a19000 rw-p 00000000 00:00 0
    7fabf8000000-7fabf8027000 rw-p 00000000 00:00 0
    7fabf8027000-7fabfc000000 ---p 00000000 00:00 0
    7fac00000000-7fac00027000 rw-p 00000000 00:00 0
    7fac00027000-7fac04000000 ---p 00000000 00:00 0
    7fac08000000-7fac08027000 rw-p 00000000 00:00 0
    7fac08027000-7fac0c000000 ---p 00000000 00:00 0
    7fac10000000-7fac10027000 rw-p 00000000 00:00 0
    7fac10027000-7fac14000000 ---p 00000000 00:00 0
    7fac1567c000-7fac1567d000 ---p 00000000 00:00 0
    7fac1567d000-7fac1607d000 rw-p 00000000 00:00 0
    7fac1607d000-7fac1607e000 ---p 00000000 00:00 0
    7fac1607e000-7fac16a7e000 rw-p 00000000 00:00 0
    7fac16a7e000-7fac16a7f000 ---p 00000000 00:00 0
    7fac16a7f000-7fac1747f000 rw-p 00000000 00:00 0
    7fac1747f000-7fac17480000 ---p 00000000 00:00 0
    7fac17480000-7fac17e80000 rw-p 00000000 00:00 0
    7fac17e80000-7fac17e81000 ---p 00000000 00:00 0
    7fac17e81000-7fac18902000 rw-p 00000000 00:00 0
    7fac18902000-7fac1890e000 r-xp 00000000 fd:00 39583913                   /lib64/libnss_files-2.12.so
    7fac1890e000-7fac18b0e000 ---p 0000c000 fd:00 39583913                   /lib64/libnss_files-2.12.so
    7fac18b0e000-7fac18b0f000 r--p 0000c000 fd:00 39583913                   /lib64/libnss_files-2.12.so
    7fac18b0f000-7fac18b10000 rw-p 0000d000 fd:00 39583913                   /lib64/libnss_files-2.12.so
    7fac18b10000-7fac18b15000 rw-p 00000000 00:00 0
    7fac18b1e000-7fac18b1f000 rw-p 00000000 00:00 0
    7fff1b121000-7fff1b136000 rw-p 00000000 00:00 0                          [stack]
    7fff1b141000-7fff1b142000 r-xp 00000000 00:00 0                          [vdso]
    ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
     
  2. team_dale

    team_dale Member

    Joined:
    Jul 9, 2014
    Messages:
    12
    Likes Received:
    1
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    What do you get when you run:

    lsof -p 2238
     
  3. 24x7server

    24x7server Well-Known Member

    Joined:
    Apr 17, 2013
    Messages:
    1,146
    Likes Received:
    34
    Trophy Points:
    48
    Location:
    India
    cPanel Access Level:
    Root Administrator
    Hello,

    You are getting this Alert from CSF. LFD sent you warning because memcached process was running from past 214041 seconds. You can ignore it. You should white-list the process by adding the below lines to /etc/csf/csf.pignore and restart LFD.
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
Loading...

Share This Page