Suspicious process running under user cpanelhorde

popeye

• May 13, 2014 11:11

Hi today for the first time i had this email from the firewall lfd below, does anyone know what it means please. Suspicious process running under user cpanelhorde Executable: /usr/local/cpanel/3rdparty/php/54/bin/php-cgi

• 

  cPanelMichael

  • May 13, 2014 16:21

  Hello :) It's likely a false positive, but did you run "ps aux" or a similar command to review the process? Note that the LFD support forums are a good resource for issues directly related to CSF or LFD: ConfigServer - Support Forums Thank you.

  0
• 

  popeye

  • May 13, 2014 16:32

  Hi no i never run any command, and i don't use CSF forums because no one ever answers.

  0
• 

  Infopro

  • May 13, 2014 17:41

  That's because most questions have been answered. Clearly chirpy is busier than others it seems and most likely dislikes replying to the same questions over and over. Server Administration takes more than just asking for help here on these forums, get a reply and go make a change. You need to actually read, and learn too.

  0
• 

  NixTree

  • May 17, 2014 14:53

  That is a false positive and safe to ignore. Now whitelist the particular executable to avoid future alerts. 1. open /etc/csf/csf.pignore using a file editor 2. Append the following line to that fine exe:/usr/local/cpanel/3rdparty/php/54/bin/php-cgi 3. Now restart LFD /etc/init.d/lfd restart

  0
• 

  popeye

  • May 17, 2014 15:09

  Thanks done this now from inside WHM

  0

Please sign in to leave a comment.