ConfigServer Community Forum

Hi there,

We are trying to SCP a large file from one of our servers, however CSF appears to be killing the SCP process after around 55 minutes.

In /var/log/lfd.log we see the following messages:
------------------------------------------------------------------------------------------------------------------------------------------------------------------ ------------------------------------------------------------------------------------------------------------------------------------------------------------------

In /etc/csf/csf.pignore we already have all SSH binaries listed:

exe:/usr/sbin/sshd
exe:/usr/sbin/ssh
exe:/usr/bin/ssh

And we have restarted CSF, but the process is still killed after the same amount of time.

Does anyone know how we can ensure that the SCP process is *not* killed by CSF?

csf is not killing that process:

/var/log/lfd.log-20141214:Dec 12 12:20:20 hostname lfd[653099]: *User Processing* PID:517054 Kill:0 User:<username> Time:1843 EXE:/usr/local/cpanel/3rdparty/perl/514/bin/perl CMD:sshcontrol child: <ip address> - waiting on pid 517051

You'll need to look elsewhere as to why the process is terminating.

Thanks but are you sure it's not CSF (or LFD)?

Based on this log entry, and the fact it says "suspicious process", it seems like it's definitely being killed:

Dec 12 12:21:19 hostname lfd[664824]: *Suspicious Process* PID:652751 PPID:652750 User:ataorgau Uptime:95 secs EXE:/usr/bin/ssh CMD:ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ServerAliveInterval=10 -x2MN -o NumberOfPasswordPrompts=1 -o PreferredAuthentications=keyboard-interactive,password -S /home/ataorgau/.libnet-openssh-perl/atabackups-0.0.0-652750-484994 -l atabackups -p 22 <IP address> --

Would you happen to have any suggestions on where to look for what is killing this process?

You can see in the log you originally posted:

"Kill:0" meaning it was not killed by LFD

You can always completely disable CSF to ensure its not killing it until the transfer completes.

# csf -x

Did you check /var/log/messages as there may be an indication in here as to what is happening to the process