[solved] Suspicious process running under user

Discussion in 'Install/Configuration' started by cornish, Apr 5, 2014.

  1. cornish

    cornish Member

    Hi anyone know how i can stop these alerts please we get 100s a day

    Time: Sat Apr 5 16:10:22 2014 +0100
    PID: 6239 (Parent PID:6003)
    Account: poho
    Uptime: 89 seconds


    Executable:

    /usr/local/lsws/fcgi-bin/lsphp-5.3.27
  2. NiteWave

    NiteWave Administrator

  3. cornish

    cornish Member

    Hi i have <railsDefaults> mentioned twice in this file which one do i remove ?

    Also if i have to remove both will i need to remove everything in between <railsDefaults>
    Last edited: Apr 6, 2014
  4. NiteWave

    NiteWave Administrator

    the warning is not relating to railsDefaults at all

    please focus on this one:
    have you installed lfd on the server and how to configure it ?
  5. cornish

    cornish Member

    The link you sent told me to remove <railsDefaults> ?

    Yes i have got csf installed and setup
  6. milliondollar

    milliondollar New Member

    In ConfigServer Security & Firewall plugins page,
    scroll down until you see"lfd - Login Failure Daemon" section,
    just below "lfd restart" button,
    there is a dropdown menu
    select "csf.pignore, Process Tracking" & click edit,
    at the eend of the file add
    exe:/usr/local/lsws/fcgi-bin/lsphp-5.3.27

    Save & Restart lfd :)
    Michael likes this.
  7. cornish

    cornish Member


    Thanks very much that works great :)

Share This Page