[Resolved] Suspicious process running under user

Status
Not open for further replies.

cornish

Well-Known Member
#1
Hi anyone know how i can stop these alerts please we get 100s a day
Code:
Time:  Sat Apr  5 16:10:22 2014 +0100
PID:  6239 (Parent PID:6003)
Account: poho
Uptime:  89 seconds


Executable:

/usr/local/lsws/fcgi-bin/lsphp-5.3.27
 
Last edited by a moderator:

cornish

Well-Known Member
#3
Hi i have <railsDefaults> mentioned twice in this file which one do i remove ?

Also if i have to remove both will i need to remove everything in between <railsDefaults>
 
Last edited:

NiteWave

Administrator
#4
the warning is not relating to railsDefaults at all

please focus on this one:
have you installed lfd on the server and how to configure it ?
 
#6
In ConfigServer Security & Firewall plugins page,
scroll down until you see"lfd - Login Failure Daemon" section,
just below "lfd restart" button,
there is a dropdown menu
select "csf.pignore, Process Tracking" & click edit,
at the end of the file add
Code:
exe:/usr/local/lsws/fcgi-bin/lsphp-5.3.27
Save & Restart lfd :)
 
Last edited by a moderator:

cornish

Well-Known Member
#7
In ConfigServer Security & Firewall plugins page,
scroll down until you see"lfd - Login Failure Daemon" section,
just below "lfd restart" button,
there is a dropdown menu
select "csf.pignore, Process Tracking" & click edit,
at the eend of the file add
exe:/usr/local/lsws/fcgi-bin/lsphp-5.3.27

Save & Restart lfd :)

Thanks very much that works great :)
 
Status
Not open for further replies.
Top