The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
7 views

CSF/LFD does not recognize mod_security-Log-entries

unfortunately my CSF/LFD login failure daemon and firewall does not recognize the entries which are added to /var/log/modsec_audit.log. I enabled the mod_security-feature in /etc/csf/csf.conf: # [*]...
0
votes
0answers
38 views

Config Server LFD sends reports on /usr/bin/php but does not list a process

So I am running a cPanel VPS (Virtuozzo based), I have nginx as a proxy to apache, and am running php 5.6 with FCGI as the handler. I am getting loads of email alerts each day such as the 2 below: ...
0
votes
1answer
34 views

Why is lfd prematurely removing blocks?

As you can see in the excerpted log file below (from /var/log/lfd.log), lfd is prematurely removing temporary blocks that it imposes on IPs: Apr 7 13:07:59 host lfd[32117]: (wordpressxmlrpc) Request ...
0
votes
0answers
58 views

How to stop specific LFD emails

I am running CSF and LFD on a number of Centos servers - whilst it is a great product, I am getting frustrated with controlling the flow of (unnecessary) emails. For example, I use rsync to replicate ...
1
vote
0answers
469 views

CSF+LFD not blocking brute force on xmlrpc.php on Wordpress site

I have just installed csf+lfd on my rackspace cloud server (a vanilla LAMP stack running centos 6.7). I only tweaked a couple of settings in the default csf.conf file: the ports allowed in TCP_IN and ...
1
vote
0answers
80 views

VPS Unknown Read/Write [closed]

I had an lfd email alert - I have installed CSF - today revealing that my server (Centos 6.6) has been using a lot of server resources for 5 minutes. I checked my VPS graphs and noticed that my server'...
0
votes
1answer
588 views

lfd[ ]: SYSLOG check [closed]

Checking the messages log of my VPS, I get the following among other lines: Aug 10 11:50:15 mail lfd[4894]: SYSLOG check [some capital and small letters here] What does the alert say? Is it just ...
1
vote
0answers
2k views

CSF LFD suspicious process under user apache

I think my server got DOS'ed via HTTP(port 80). When I checked apache access log, it showed that specific IPs requested /GET/HTTP1.1 more than 150 times in a minute. And I've been trying to limit ...
3
votes
1answer
2k views

How to white-list specific PHP script process in CSF?

I repeatedly receive a "Suspicious Process" notice from lfd. I'm 100% positive that the PHP script triggering this warning is safe. I wrote it myself and it makes some cross server calls that must ...
0
votes
1answer
586 views

Does LFD check for failed HTTP Digest login attempts?

I am sure that LFD (Login Failure Daemon) checks Apache's error log for failed HTTP authentication attempts ie. log entries like: [Mon Feb 25 10:12:45 2013] [error] [client 10.0.0.1] user FAKEUSER ...
-1
votes
1answer
5k views

cPanel server - Dovecot logins failing on specific IP address

I'm having a strange issue with one of our cPanel/WHM servers where it appears to be failing dovecot (IMAP/POP3) logins only from a specific IP address. The client was setting up a new workstation and ...
1
vote
1answer
612 views

csf/lfd parameter that prevent smtp attacks?

I have a 4~5MB logwatch like this every day! someone like to hack my smtp: .... --------------------- sasl auth daemon Begin ------------------------ SASL Authentications failed 3965 Time(s) ...
2
votes
3answers
4k views

How to completely remove New Relic application

My server is running Centos 5.8 64 bit and I installed New Relic a short while ago to try and solve a few performance issues - as the server is not especially high spec I found it used too much system ...
2
votes
1answer
3k views

CSF/LFD - Suspicious processes when running nginx+php5-fpm+ Mysql

I am running LFD/CSF on three servers and on all servers I have the same problem since the first day when I set-up the server and installed LFD/CSF. I have nginx + php5-fpm + MySQL installed and lfd....
0
votes
1answer
1k views

Malicious activity on EXE:/usr/bin/php CMD:/usr/bin/php [duplicate]

Possible Duplicate: How do I deal with a compromised server? Checking the lfd.log and noticed a block log for a script: Jan 10 22:01:36 xxx lfd[871]: *User Processing* PID:27023 Kill:0 User:...
1
vote
1answer
373 views

LFD always stops working after ~30 days, until I give /etc/csf/csf.pl -r

When I give /etc/csf/csf.pl -r , I see lots of lines flushing, then I begin to get the notification emails again, (several emails per day), for example: Time: Wed Sep 12 08:39:47 2012 +0800 IP: ...
0
votes
3answers
12k views

lfd: how to disable notifications?

My host mailbox is filled up with 1 GB of lfd notifications like: excessive resource usage notifications Suspicious process running under user XXXX How can I disable these? There was no lfd tag ...