CSF ignore list skips some ignore exclusions

[InteractM]

I have try to prevent sending Suspicious File Alert emails which contain:

Code: Select all

File:   /tmp/netatop-0.5/netatop.init
Reason: Script, starts with #!

Code: Select all

File:   /tmp/netatop-0.5/mkversion
Reason: Script, starts with #!

by adding

Code: Select all

exe:/tmp/netatop-0.5/netatop.init
exe:/tmp/netatop-0.5/mkversion

to the csf.pignore file but somehow those two lines are not getting excluded from the alert emails.

Any clue what is going on?

Thanks

[tfmfg]

Add the files to /etc/csf/csf.signore instead (just the file, no exe:)

[InteractM]

I have added those two lines to csf.signore

Code: Select all

/tmp/netatop-0.5/netatop.init
/tmp/netatop-0.5/mkversion

and still I'm receiving suspicious file alerts.

[hostess]

I think this is a bug with the current version of CSF. I have the latest version installed and still this problem is happening. The LFD doesn't take into account the csf.signore file, and keeps sending alerts even if the sending script is white listed in the signore file.

I understand that the LFD scans the mail log for the sending directory and can't know which script exactly in that directory is sending mails, so it raises alert with all possible mail sending scripts in that directory. However the solution is simple: if all mail sending scripts in that directory are white listed then no alert is warranted, and if at least one mail sending script in that directory is not in the signore white list then an alert should be raised.

When can we expect a fix of this issue to be released?

[willdashwood]

I've just noticed the same issue. I want to exclude an installation of PHPList from notifications. I've tried adding the following as I'm not sure of the correct syntax.

/home/username/public_html/PHPList/
/home/username/public_html/PHPList/admin/
/home/username/public_html/PHPList/*
/home/username/public_html/PHPList/admin/*

Are wildcard required? If I list "PHPList/" should that cover all sub-folders too?

I still get alerts even with the above.