Linux Intrusion Detection System FAQ
PrevChapter 5. Configuring LIDSNext

5.22. Some of my file systems won't unmount at shutdown because I have hidden processes running. How can I kill them?

A hidden process can still be killed if you know it's process id (pid). Many systems store the pid of all the processes started at boot time somewhere under /var (/var/run is commonly used). Your shutdown scripts can be modified to read the pids from these files and send them the appropriate signals.

For example, if your system stores the pids in /var/run/<process_name>.pid, then you can add the following lines to your shutdown scripts: 
for p in `ls /var/run/*.pid`
do
   kill -15 `cat $p`
done
sleep 5
sync;sync;sync

for p in `ls /var/run/*.pid`
do
   kill -9 `cat $p`
done
sleep 5
sync;sync;sync
The CAP_KILL and CAP_INIT_KILL capabilities must be granted to the shutdown script containing these lines. It is probably a good idea to hide the /var/run directory from everything but the init scripts too.

Another option would be to just send every process the TERM and KILL signals. 
MAX_PROC=65535
trap : 1 2 15
I=1;while (( $I < $MAX_PROC ));do
        I=$(($I+1));
        if (( $$ != $I ));then
                kill -15 $I;
        fi;
done
sleep 5
sync;sync;sync;
I=1;
while (( $I < $MAX_PROC ));do
        I=$(($I+1));
        if (( $$ != $I ));then
                kill -9 $I;
        fi;
done
sync;sync;sync

Nenad Micic wrote his own C program to kill hidden processes at shutdown.

PrevHomeNext
Open-SSH won't start at boot time. LIDS reports that bash tried to access a hidden file. How can I fix this?UpI just want to start with a basic configuration. Can you recommend a setup that will provide additional protection and still leave most of my system functioning as normal?