I have a cloud server that I am preparing for a small E-Commerce website deployment.
I've used a RSA-2048 keys right before booting the newly purchased server, with the help of the Provider's Control Panel.
I've quickly secured SSH Server before doing my first reboot.
I've installed Ubuntu 12.04 64-bit Server Edition, updated and upgraded.
I've installed LAMP Stack using a provisioning script, I've chose to use the script since I don't know yet how to configure Varnish-Cache
, the script includes options to install Varnish-Cache automatically for me.
Varnish-Cache is installed but not enabled yet.
I am in the process of applying some basic server security measures, and that includes the installation of RKHunter. I've cleared and white listed the known false positives warnings.
After the RKhunter's initial setup and initial run, it throw warning about apache2 process using deleted files.
Warning: The following processes are using deleted files:
Process: /usr/lib/apache2/mpm-event/apache2 PID: 1315 File: /run/apache2/ssl_mutex
Process: /usr/lib/apache2/mpm-event/apache2 PID: 1338 File: /run/apache2/ssl_mutex
Process: /usr/lib/apache2/mpm-event/apache2 PID: 1339 File: /run/apache2/ssl_mutex
Process: /usr/lib/apache2/mpm-event/apache2 PID: 1340 File: /run/apache2/ssl_mutex
I don't have a clue about this warning, and how to check and confirm if it's dangerous or not. If not dangerous, then I shall proceed and whitelist/allow the process.
I did some research about the process and the file, and I can't find enough details on how to further inspect the warning and how to deal with it. The processes involved in the warning are;
usr/sbin/apache2 -k start
www-data 1262 0.0 0.5 85172 2816 ? S 23:05 0:00 /usr/sbin/apache2 -k start
www-data 1263 0.0 0.5 85164 2620 ? S 23:05 0:00 /usr/sbin/fcgi-pm -k start
www-data 1278 0.0 0.6 333736 3240 ? Sl 23:05 0:00 /usr/sbin/apache2 -k start
Some links I've read are below, but not that helpful with regard to the help I am seeking;
http://www.howtoforge.com/forums/archive/index.php/t-56463.html
http://sourceforge.net/mailarchive/forum.php?thread_name=1285681228.2694.51.camel%40localhost.localdomain&forum_name=rkhunter-users
http://ubuntuforums.org/showthread.php?t=1711303
http://permalink.gmane.org/gmane.comp.security.rkhunter.user/2012
I need some help and advise on how to deal with the warning. Or Before I allow it to pass RKHunter's settings. I am thinking about the script I've used, but It's cloned from a Github Repo. And it also has a separate Home Page that has the download link for the script. The script is called TuxLite
.