Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am constantly receiving mail like so on my VPS:

>N  1 root@server9987       Thu Jan 24 18:39 341/30060 "lfd on server9987: Suspicious process running under user apache"
 N  2 root@server9987       Thu Jan 24 18:40 340/30018 "lfd on server9987: Suspicious process running under user apache"
 N  3 root@server9987       Thu Jan 24 18:40  19/842   "lfd on server9987: SSH login alert for user oliver from 86.8.79.197 (GB/United Kingdom/cpc2-seac22-2-0-cust964.7-2.cabl"
 N  4 root@server9987       Thu Jan 24 18:40  19/842   "lfd on server9987: SSH login alert for user oliver from 86.8.79.197 (GB/United Kingdom/cpc2-seac22-2-0-cust964.7-2.cabl"
&  

This is happening for all sorts of users – apache is just one of them.

How should I go about telling the VPS that this process is okay (I think?)?

share|improve this question

1 Answer 1

edit /etc/csf/csf.pignore and add

 pcmd:/path/to/command/you/want/to/ignore/blah.sh.*

and then restart lfd

for ssh alerts, edit /etc/csf/csf.conf and change

LF_SSH_EMAIL_ALERT = "1"

to

LF_SSH_EMAIL_ALERT = "0"

and then restart lfd

share|improve this answer
    
What does changing the email alert setting do? –  Oliver Joseph Ash Jan 24 '13 at 23:16
    
it will stop emailing you the "SSH login alert for user" messages, but will log them (if it's setup to log) –  kormoc Jan 24 '13 at 23:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.