[Resolved] Suspicious process running under user

[cornish]

Hi anyone know how i can stop these alerts please we get 100s a day

Time:  Sat Apr  5 16:10:22 2014 +0100
PID:  6239 (Parent PID:6003)
Account: poho
Uptime:  89 seconds


Executable:

/usr/local/lsws/fcgi-bin/lsphp-5.3.27

 

[NiteWave]

refer:
http://www.litespeedtech.com/support/forum/threads/upgrade-with-problems-in-ruby-rails-warn.6517/

the warning is false alarm from lfd, please configure lfd to whitelist lsphp

 

[cornish]

Hi i have <railsDefaults> mentioned twice in this file which one do i remove ?

Also if i have to remove both will i need to remove everything in between <railsDefaults>

 

[NiteWave]

the warning is not relating to railsDefaults at all

please focus on this one:
have you installed lfd on the server and how to configure it ?

 

[cornish]

The link you sent told me to remove <railsDefaults> ?

Yes i have got csf installed and setup

 

[milliondollar]

In ConfigServer Security & Firewall plugins page,
scroll down until you see"lfd - Login Failure Daemon" section,
just below "lfd restart" button,
there is a dropdown menu
select "csf.pignore, Process Tracking" & click edit,
at the end of the file add

exe:/usr/local/lsws/fcgi-bin/lsphp-5.3.27

Save & Restart lfd

 

[cornish]

In ConfigServer Security & Firewall plugins page,
scroll down until you see"lfd - Login Failure Daemon" section,
just below "lfd restart" button,
there is a dropdown menu
select "csf.pignore, Process Tracking" & click edit,
at the eend of the file add
exe:/usr/local/lsws/fcgi-bin/lsphp-5.3.27

Save & Restart lfd

Thanks very much that works great