Tagged Questions

The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
65 views

lfd[ ]: SYSLOG check [closed]

Checking the messages log of my VPS, I get the following among other lines: Aug 10 11:50:15 mail lfd[4894]: SYSLOG check [some capital and small letters here] What does the alert say? Is it just ...
0
votes
1answer
299 views

csf lfd denied by desktop because of mod_security

I have a WHM/Cpanel server with CSF/LFD installed and mod_security enabled. I used to login to WHM/cpanel from one of my local windows box through a linux (Centos 5)NAT gateway(with a public IP ...
0
votes
0answers
416 views

CSF LFD suspicious process under user apache

I think my server got DOS'ed via HTTP(port 80). When I checked apache access log, it showed that specific IPs requested /GET/HTTP1.1 more than 150 times in a minute. And I've been trying to limit ...
1
vote
1answer
578 views

How to white-list specific PHP script process in CSF?

I repeatedly receive a "Suspicious Process" notice from lfd. I'm 100% positive that the PHP script triggering this warning is safe. I wrote it myself and it makes some cross server calls that must ...
0
votes
1answer
379 views

Does LFD check for failed HTTP Digest login attempts?

I am sure that LFD (Login Failure Daemon) checks Apache's error log for failed HTTP authentication attempts ie. log entries like: [Mon Feb 25 10:12:45 2013] [error] [client 10.0.0.1] user FAKEUSER ...
0
votes
1answer
2k views

cPanel server - Dovecot logins failing on specific IP address

I'm having a strange issue with one of our cPanel/WHM servers where it appears to be failing dovecot (IMAP/POP3) logins only from a specific IP address. The client was setting up a new workstation and ...
1
vote
1answer
372 views

csf/lfd parameter that prevent smtp attacks?

I have a 4~5MB logwatch like this every day! someone like to hack my smtp: .... --------------------- sasl auth daemon Begin ------------------------ SASL Authentications failed 3965 Time(s) ...
1
vote
3answers
2k views

How to completely remove New Relic application

My server is running Centos 5.8 64 bit and I installed New Relic a short while ago to try and solve a few performance issues - as the server is not especially high spec I found it used too much system ...
1
vote
1answer
1k views

CSF/LFD - Suspicious processes when running nginx+php5-fpm+ Mysql

I am running LFD/CSF on three servers and on all servers I have the same problem since the first day when I set-up the server and installed LFD/CSF. I have nginx + php5-fpm + MySQL installed and ...
0
votes
1answer
857 views

Malicious activity on EXE:/usr/bin/php CMD:/usr/bin/php [duplicate]

Possible Duplicate: How do I deal with a compromised server? Checking the lfd.log and noticed a block log for a script: Jan 10 22:01:36 xxx lfd[871]: *User Processing* PID:27023 Kill:0 ...
1
vote
1answer
207 views

LFD always stops working after ~30 days, until I give /etc/csf/csf.pl -r

When I give /etc/csf/csf.pl -r , I see lots of lines flushing, then I begin to get the notification emails again, (several emails per day), for example: Time: Wed Sep 12 08:39:47 2012 +0800 IP: ...
0
votes
2answers
4k views

lfd: how to disable notifications?

My host mailbox is filled up with 1 GB of lfd notifications like: excessive resource usage notifications Suspicious process running under user XXXX How can I disable these? There was no lfd tag ...