Page 1 of 1

Turn off root compromise email for one account

Posted: 05 Feb 2015, 04:38
by felixr
Hi.
Our VPS provider has its own account on our servers with UID 0.
LFD is alerting me to a possible root compromise on this account constantly.
Is there a way to turn off the alerting for a single account?
eg tell lfd to ignore account with name "VPS-provider".

I know how to turn off the system exploit checking completely but for security reasons i dont want to do that.


Thanks

Re: Turn off root compromise email for one account

Posted: 05 Feb 2015, 08:13
by ForumAdmin
Modify /etc/csf/csf.suignore and list the account in there and then restart lfd.