Score:1

How can I locate the php script that issues outbound connections?

sa flag

I have a server running httpd for several websites. Using the top command, I found many httpd processes exhaust memory. Using the netstat command, I found the httpd processes are connecting to an external ip address. Is it possible to locate the (php) script(s)/functions that issue the connections?

in flag
When you restrict outgoing connections via the firewall you should get errors in the server log.
peter avatar
sa flag
@GeraldSchneider I added a proxy virtual host to httpd.conf and added http_proxy=http://localhost:3128/ to /etc/environment to try to catch the outbound connection made by file_get_contents of php, but it does not work. See my another question:https://serverfault.com/questions/1115758/how-to-configure-a-system-wide-proxy-for-php-file-get-contents-on-centos
in flag
Whats wrong with iptables denying `--uid-owner` or `--cmd-owner`?
Score:1
in flag

Restrict outgoing connection from the webserver via the system firewall:

iptables -A OUTPUT -p tcp -m owner --uid-owner apache -j REJECT
ip6tables -A OUTPUT -p tcp -m owner --uid-owner www-data -j REJECT

(This is for CentOS, for Ubuntu the default username for Apache2 is www-data instead of apache)

Example error message from the error log file:

PHP Warning: file_get_contents(https://icanhazip.com): failed to open stream: Connection timed out in /var/www/html/test/index.php on line 3

You get the script name and the line with the function call.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.