RK Hunter Warns about /usr/lib/apache2/mpm-event/apache2 uses deleted files, how to further investigate the matter and how shall I treat it?

Question

I have a cloud server that I am preparing for a small E-Commerce website deployment.
I've used a RSA-2048 keys right before booting the newly purchased server, with the help of the Provider's Control Panel. I've quickly secured SSH Server before doing my first reboot.

I've installed Ubuntu 12.04 64-bit Server Edition, updated and upgraded.
I've installed LAMP Stack using a provisioning script, I've chose to use the script since I don't know yet how to configure Varnish-Cache, the script includes options to install Varnish-Cache automatically for me.
Varnish-Cache is installed but not enabled yet.

I am in the process of applying some basic server security measures, and that includes the installation of RKHunter. I've cleared and white listed the known false positives warnings.

After the RKhunter's initial setup and initial run, it throw warning about apache2 process using deleted files.

Warning: The following processes are using deleted files:
Process: /usr/lib/apache2/mpm-event/apache2    PID: 1315    File: /run/apache2/ssl_mutex
Process: /usr/lib/apache2/mpm-event/apache2    PID: 1338    File: /run/apache2/ssl_mutex
Process: /usr/lib/apache2/mpm-event/apache2    PID: 1339    File: /run/apache2/ssl_mutex
Process: /usr/lib/apache2/mpm-event/apache2    PID: 1340    File: /run/apache2/ssl_mutex

I don't have a clue about this warning, and how to check and confirm if it's dangerous or not. If not dangerous, then I shall proceed and whitelist/allow the process.

I did some research about the process and the file, and I can't find enough details on how to further inspect the warning and how to deal with it. The processes involved in the warning are;

usr/sbin/apache2 -k start
www-data  1262  0.0  0.5  85172  2816 ?        S    23:05   0:00 /usr/sbin/apache2 -k start
www-data  1263  0.0  0.5  85164  2620 ?        S    23:05   0:00 /usr/sbin/fcgi-pm -k start
www-data  1278  0.0  0.6 333736  3240 ?        Sl   23:05   0:00 /usr/sbin/apache2 -k start

Some links I've read are below, but not that helpful with regard to the help I am seeking;
http://www.howtoforge.com/forums/archive/index.php/t-56463.html

http://sourceforge.net/mailarchive/forum.php?thread_name=1285681228.2694.51.camel%40localhost.localdomain&forum_name=rkhunter-users

http://ubuntuforums.org/showthread.php?t=1711303

http://permalink.gmane.org/gmane.comp.security.rkhunter.user/2012

I need some help and advise on how to deal with the warning. Or Before I allow it to pass RKHunter's settings. I am thinking about the script I've used, but It's cloned from a Github Repo. And it also has a separate Home Page that has the download link for the script. The script is called TuxLite.

Answer 1

This does not come from the scripts you have used (tuxlite). Although it is a bad practice, you can frequently find linux processes using deleted files (Apache in your case). RKhunter doesn't like that too much, as basically those files are invisible to other processes and this could be seen as malicious behaviour.

However, in your case and given that this is a clean box you just installed, I would consider this as a false positive and if needed you can add a whitelist rule in your RKhunter configuration, or even disable the deleted file module completely.

If you want to further investigate it, here are a couple things you can do:

lsof | grep /run/apache2/ssl_mutex

will give you the process ID and the file number. Then you can go and check for the file descriptor:

cd /proc/[PROCESS_ID]/fd
ls -Filah [FILE_NUMBER]

You can use usual commands to play with this file (read it, write to it). Also,

tail [FILE NUMBER]

will show you what is written into that file.

In any case, don't try to remove it because the process is still using it.