Server Software and Configuration Services
Changes: Modified regex.pm detection of iptables kernel log lines to cater for alternative formatting Restored the substitution of the NULL separator with spaces for the /proc/PID/cmdline in Process Tracking
Changes: Added code to Process Tracking to translate non-printable characters to especially help detect and report deleted executable file processes WARNING: Removed hard-coded exceptions for spamd, cpanellogd, cpdavd and awstats.pl from lfd.pl. If you want to ignore such processes for…
Changes: Disable ST_LOOKUP by default on new installations Modified lfd stats performance when ST_LOOKUP is enabled and added a warning for this setting to csf.conf for when DROP_IP_LOGGING is enabled
Changes: New Mailscanner v4.74.13:
Changes: Modified the su tracking regex to better trap RHE/CentOS v5 su login attempts Added a Server Check for “FTP Logins with Root Password” Added new WHM UI option to display Last X iptables Log Lines. Note that the report…
Rootkit Hunter announces release 1.3.4The change log lists 4 additions, 8 changes and 9 bugfixes.Naming a few:- Added IntoXonia-NG rootkit check.- Added Phalanx2 rootkit check.- Added support for TCB shadow files.- The ‘–propupd’ option can now take an optional file,…
Changes: Added warning for those that enable PT_USERKILL in csf.conf – i.e. It is not a good idea to use that option Modified PT_USERKILL to not kill (deleted) processes (these should be restarted manually after investigation) as per the documentation
Changes: Fixed problem where the action for spam_action_deliver was being used by spamhigh_action_deliver instead of its own setting
Changes: If you add the text “do not delete” to the comments of an entry in csf.deny then DENY_IP_LIMIT will ignore those entries and not remove them. Updated csf.deny information text for new installations Made the (deleted) process text even…
Changes: Added Slackware support (tested on v12.2.0) Added Fedora v10 support Added new option GOOGLEBOT – Prevent *.googlebot.com from being blocked by lfd. See csf.conf for more information Modified .cpanel.net check to use the same host lookup procedure as GOOGLEBOT…