I am running a web server (apache, mysql, php, cpanel) and I faced with an issue that some users start the httpd server from their accounts. This causes huge overload.

Part of the `ps auxf` command:

```
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND    
infor8 30135  0.0  0.0  28996  3372 ?        SN   08:42   0:00 /usr/sbin/httpd
infor8 30136  0.0  0.0  28996  3440 ?        SN   08:42   0:00 /usr/sbin/httpd
infor8 30137  0.0  0.0  28996  3364 ?        SN   08:42   0:00 /usr/sbin/httpd

```

There are actually hundreds of such processes from the `infor8` user. I am searching from which directory the process was started in the following way:

```
lsof -p 30135

perl    25631 infor8  cwd    DIR      8,3    4096 76735848 /home/infor8/public_html
perl    25631 infor8  rtd    DIR      8,3    4096        2 /
perl    25631 infor8  txt    REG      8,3 1184862 42976810 /usr/local/bin/perl
perl    25631 infor8  mem    REG      8,3   23736 63414584 /lib64/libnss_dns-2.5.so

```

Using the 'maldet' malware scanner I have found (and removed) a lot of files like:

```
{HEX}php.sessmasq.renata.519 : ./images/a96b6.php
{HEX}php.sessmasq.renata.519 : ./images/7fec3.php
{HEX}php.sessmasq.renata.519 : ./images/b1d10.php

```

Could someone please assist of how to block running apache locally from the customers' accounts on the web server?

Thank you for any assistance.

---

Update:

Permissions for httpd:

```
root@server [~]# which /usr/sbin/httpd
/usr/sbin/httpd
root@server [~]# ll /usr/sbin/httpd
lrwxrwxrwx 1 root root 31 Jul 15  2008 /usr/sbin/httpd -> /usr/local/apache/bin/apachectl*
root@server [~]# ll /usr/local/apache/bin/apachectl
-rwxr-xr-x 1 root root 2971 Sep  9  2009 /usr/local/apache/bin/apachectl*
root@server [~]# 

```