[users@httpd] Two Apache questions for reading passwd file and .htaccess

[Eric Wagar <ew...@yahoo.com>]

I am seeing my 1.3.27/php 4.3.1 server doing this:
read(3, " G E T   / ~ c a m 1 / f".., 4096)     = 456
sigaction(SIGUSR1, 0xFFBFD470, 0xFFBFD598)      = 0
time()                                          = 1060828954
open64("/var/run/name_service_door", O_RDONLY)  Err#2 ENOENT
open("/etc/passwd", O_RDONLY)                   = 4
fstat64(4, 0xFFBFEB88)                          = 0
fstat64(4, 0xFFBFEA30)                          = 0
ioctl(4, TCGETA, 0xFFBFEB14)                    Err#25 ENOTTY
read(4, " r o o t : x : 0 : 1 : S".., 8192)     = 1093
llseek(4, 0xFFFFFFFFFFFFFD7F, SEEK_CUR)         = 452
close(4)                                        = 0
and
stat("/usr/local/apache/sites/flyguylive.com/peanut/cam7.jpg", 0x00136F10) =
0
open("/.htaccess", O_RDONLY)                    Err#2 ENOENT
open("/usr/.htaccess", O_RDONLY)                Err#2 ENOENT
open("/usr/local/.htaccess", O_RDONLY)          Err#2 ENOENT
open("/usr/local/apache/.htaccess", O_RDONLY)   Err#2 ENOENT
open("/usr/local/apache/sites/.htaccess", O_RDONLY) Err#2 ENOENT
open("/usr/local/apache/sites/flyguylive.com/.htaccess",

My first question is if Apache should be reading the passwd file.  I have
done some major checking on the filesystem and don't see anything that says
the server was hacked.

The second question is:
Should Apache be searching from the root (/) of the filesystem for a
.htaccess?  I thought that Apache only searched from what the DocumentRoot
is specified as?

Thanks
eric



---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org