After installing your csf-firewall, I am having problems

[psydrug]

Hello,

After installing your csf-firewall, I am having problems
Receiving a lot of emails about "lfd"

What am I doing wrong?

Thanks in advance

[psydrug]

Answer?

[Aetherinox]

This is part of the process monitoring for CSF which checks for abnormal actions performed by specific binaries.

CSF checks for certain actions performed by binaries and notifies you if they seem out of the norm. If you are absolutely and totally sure that these are all legitimate, you can whitelist the processes from being sent as notifications.

To whitelist processes, modify:

• /etc/csf/csf.pignore

You can add the process a few different ways:

# Ignore by executable path
exe:/usr/bin/myapp

# Ignore by command line (regex supported)
cmd:/usr/bin/myapp --port 8080.*

# Ignore all processes for a specific user
puser:yourusername

The comments inside the /etc/csf/csf.pignore file explain this in more detail.

This alert is triggered if:

1. Uptime exceeds PT_LIMIT; AND
2. Process is classified as "suspicious". This can occur if:
   • It has an active network connection on a non-HTTP port
   • Is running a binary that has been deleted from disk (with PT_DELETED on)

As for the excessive resource warnings, those again, are dependent on what you have set for the thresholds. Our out-of-box thresholds may be too low for these specific services.

Via the /etc/csf/csf.conf:

# # 
#   This User Process Tracking option sends an alert if any user process exceeds
#   the virtual memory usage set (MB). To ignore specific processes or users use
#   csf.pignore
#   
#   Set to 0 to disable this feature
# # 

PT_USERMEM = "512"

If you do not want that feature running, set the setting to 0.

You may need to adjust the other flags as well:

# # 
#   This User Process Tracking option sends an alert if any Linux user process
#   exceeds the time usage set (seconds). To ignore specific processes or users
#   use csf.pignore
#   
#   Set to 0 to disable this feature
# # 

PT_USERTIME = "1800"

The alert template is triggering /etc/csf/alerts/resalert.txt.

The settings in csf.conf are geared toward "average" use. But in your case, these may require certain commands and usage limits that are just higher than what we set. So in those instances, you can increase the limits, or whitelist those processes from triggering the alerts.