# ls -lh /var/www
total 8.0K
drwxrwxr-x 2 www-data www-data 4.0K Aug 28 02:23 hiawatha
drwxrwxr-x 8 www-data www-data 4.0K Aug 28 02:37 random
# ls -lh /var/www/random
total 788K
-snip-
-rwxrwxr-x 1 www-data www-data 11K Aug 9 16:07 index.php
-rwxrwxr-x 1 www-data www-data 20 Aug 28 02:38 phpinfo.php
-snip-
# ps auxf
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 1980 688 ? Ss Aug27 0:00 init [2]
root 18335 0.0 0.0 1692 616 ? Ss Aug27 0:00 /sbin/syslogd
root 19720 0.0 0.0 2036 876 ? Ss Aug27 0:00 /usr/sbin/cron
root 24497 0.0 0.0 2352 868 ? Ss Aug27 0:00 /usr/sbin/xinetd -pidfile /var/run/xinetd.pid -stayalive -inetd_compat -inetd_ipv6
root 16200 0.0 0.0 2040 468 ? Ss 00:56 0:00 /usr/sbin/dropbear -d /etc/dropbear/dropbear_dss_host_key -r /etc/dropbear/dropbear_rsa_host_key -p 1363 -W 65536
root 20458 0.0 0.1 2352 1088 ? Ss 18:17 0:00 \_ /usr/sbin/dropbear -d /etc/dropbear/dropbear_dss_host_key -r /etc/dropbear/dropbear_rsa_host_key -p 1363 -W 65536
root 20464 0.0 0.0 1800 600 pts/0 Ss 18:17 0:00 \_ -pdksh
root 9505 0.0 0.0 2292 840 pts/0 R+ 18:24 0:00 \_ ps auxf
root 5587 0.0 0.0 1704 516 ? S 01:42 0:00 /bin/sh /usr/bin/mysqld_safe
mysql 5781 0.0 6.9 848280 73164 ? SNl 01:42 0:01 \_ /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/run/mysqld/mysqld
root 5782 0.0 0.0 1628 536 ? S 01:42 0:00 \_ logger -t mysqld -p daemon.error
www-data 9782 0.0 1.8 83612 19104 ? Ss 02:15 0:00 /usr/bin/php5-cgi -b 127.0.0.1:3947
www-data 20329 0.0 0.8 83612 9188 ? S 18:16 0:00 \_ /usr/bin/php5-cgi -b 127.0.0.1:3947
www-data 31938 0.0 0.8 83612 9188 ? S 18:20 0:00 \_ /usr/bin/php5-cgi -b 127.0.0.1:3947
www-data 7292 0.0 0.8 83612 9188 ? S 18:22 0:00 \_ /usr/bin/php5-cgi -b 127.0.0.1:3947
nobody 9859 0.0 0.1 7532 1260 ? Ssl 02:15 0:00 /usr/sbin/hiawatha