Listing running processes (ps) and revealing the hiding ones (unhide)

You can list all the processes on a system simply by running the ps command with the following syntax

ps ax

This will result a table, with those headers:
PID TTY STAT TIME COMMAND

PID - a number representing the process id.
TTY - the terminal the command started from
STAT - the status of the process (google "PROCESS STATE CODES")

The most common are:
R Running or runnable (on run queue)
S Interruptible sleep (waiting for an event to complete)
Z Defunct ("zombie") process, terminated but not reaped by its parent.
s is a session leader
l is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)
+ is in the foreground process group

COMMAND - the path of the process.

If you add the "u" flag like

ps aux

you will get more detailed info about the process like the owner of the process, CPU and memory usage and more.

There are some malicious processes that can hide themselves from listing at the ps command.
You can reveal them by executing the unhide command. The unhide command can discover a hiding process by searching in three ways: proc, sys and brute.

The proc technique consists of comparing /proc with the output of /bin/ps.

The sys technique consists of comparing information gathered from /bin/ps with information gathered from system calls.

The brute technique consists of bruteforcing the all process IDs. This technique is only available on Linux 2.6 kernels.

unhide proc

unhide sys

unhide unhide brute

It is a good practice to

limit proccess cpu ussage

http://cpulimit.sourceforge.net/
/etc/security/limits.conf

Understanding /etc/security/limits.conf file

Each line describes a limit for a user in the form:

Where:

* can be:
o an user name
o a group name, with @group syntax
o the wildcard *, for default entry
o the wildcard %, can be also used with %group syntax, for maxlogin limit
* can have the two values:
o “soft” for enforcing the soft limits
o “hard” for enforcing hard limits
* can be one of the following:
o core - limits the core file size (KB)
* can be one of the following:
o core - limits the core file size (KB)
o data - max data size (KB)
o fsize - maximum filesize (KB)
o memlock - max locked-in-memory address space (KB)
o nofile - max number of open files
o rss - max resident set size (KB)
o stack - max stack size (KB)
o cpu - max CPU time (MIN)
o nproc - max number of processes
o as - address space limit
o maxlogins - max number of logins for this user
o maxsyslogins - max number of logins on the system
o priority - the priority to run user process with
o locks - max number of file locks the user can hold
o sigpending - max number of pending signals
o msgqueue - max memory used by POSIX message queues (bytes)
o nice - max nice priority allowed to raise to
o rtprio - max realtime priority
o chroot - change root to directory (Debian-specific)

Login as the root and open configuration file:
# vi /etc/security/limits.conf
Following will prevent a “fork bomb”:
vivek hard nproc 300
@student hard nproc 50
@faculty soft nproc 100
@pusers hard nproc 200

Above will prevent anyone in the student group from having more than 50 processes, faculty and pusers group limit is set to 100 and 200. Vivek can create only 300 process. Please note that KDE and Gnome desktop system can launch many process.

Save and close the file. Test your new system by dropping a form bomb:
$ :(){ :|:& };: