Background Process Killer

For WHM version 11.32

This feature allows you to pick programs that should automatically be terminated if they are found running. After a process is killed, you will receive an email notifying you that the process that has been killed.

The processes in the list commonly result in denial of service attacks (DoS or DDoS) launching from or against your server.

Many times, malicious users will rename the process so that it is difficult to find. However, this WHM feature will detect the process no matter what it has been renamed and automatically shut the program down when it is encountered.

Set up the process killer
Processes that can be killed

Set up the process killer

Select the process from the list by clicking the corresponding checkbox.
- We recommend that you select all of the processes.
- If you would like to allow specific users to run any of the processes you have selected, enter their names into the text field below.
  - Example: Adding ExUser to the list would allow a user known as ExUser to run the processes you have selected.
  - Users with a UID below 99 do not need to be added.
Click Save.

Processes that can be killed

Process	Description
BitchX	A popular command line IRC (Internet Relay Chat) client.
bnc	BNC is a common IRC bouncer. Bouncers allow users to hide the source of their connection and route traffic through secondary locations. They are commonly used during denial of service attacks.
eggdrop	A popular IRC bot. A bot is an automated system that will execute a set of commands. In this case, the bot executes sets of IRC commands to moderate IRC channels (chat rooms). This bot, however, can be used to create botnets that are often used in denial of service attacks.
generic-sniffers	Sniffers can be used by a 3rd party to collect and analyze packets of information as they are transmitted between computers. Often, sniffers will be used to analyze the data for encryption methods and gain access to networks that the third party should not have access to.
guardservices	An IRC bot. See the definition of `eggdrop` above.
ircd	The daemon that enables IRC. IRC is an attractive target for malicious users, as the server is typically up and running for a long period of time, making it easy for hackers to use packet sniffers to glean information and launch attacks.
psyBNC	`psyBNC` is a popular IRC network bouncer. See the definition for `bnc` above for more information.
ptlink	`ptlink` is an IRC server. See the definition of `ircd` above.
services	An IRC bot. See the definition of `eggdrop` above.

Topic revision: r3 - 17 Nov 2010 - 22:24:16 - Main.JustinSchaefer