ConfigServer Community Forum

In the CSF configuration under Log Scanner you can disable it

Try whitelisting the IPs shown here:

https://support.authorize.net/s/article ... -Addresses

Other possibility is to confirm with authorize.net if any specific ports need to be opened.

Check the FAQ for some additional info: http://chkrootkit.org/faq/

Both rkhunter and chkrootkit are prone to false positives.

Running either or both on a known good system would you give you a baseline.

False positive files and directories can be ignored but not generally considered good practice.

Those look to be false positives from the chkrootkit script.

One possible solution.

https://stackoverflow.com/questions/544 ... are-not-es

Are the entries in filename.rules.conf separated by "tabs" and not just spaces?

Did you reload MS after making rule changes?

Generally if it is one IP (or IPs) to a specific port we remove that port from csf.conf. That assumes it is not required for broader access - like port 25. The guide you mention along with the readme.txt for CSF (https://download.configserver.com/csf/readme.txt) section 10 should provide enough info...

10. Advanced Allow/Deny Filters ############################### In /etc/csf/csf.allow and /etc/csf/csf.deny you can add more complex port and ip filters using the following format (you must specify a port AND an IP address): tcp/udp|in/out|s/d=port|s/d=ip|u=uid Broken down: tcp/udp : EITHER tcp OR u...

Check section 10 of the readme.

https://download.configserver.com/csf/readme.txt