Page 1 of 1

CSF ignore list skips some ignore exclusions

Posted: 23 Apr 2015, 17:17
by InteractM
I have try to prevent sending Suspicious File Alert emails which contain:

Code: Select all

File:   /tmp/netatop-0.5/netatop.init
Reason: Script, starts with #!

Code: Select all

File:   /tmp/netatop-0.5/mkversion
Reason: Script, starts with #!
by adding

Code: Select all

exe:/tmp/netatop-0.5/netatop.init
exe:/tmp/netatop-0.5/mkversion
to the csf.pignore file but somehow those two lines are not getting excluded from the alert emails.

Any clue what is going on?

Thanks

Re: CSF ignore list skips some ignore exclusions

Posted: 04 Jun 2015, 21:19
by tfmfg
Add the files to /etc/csf/csf.signore instead (just the file, no exe:)

Re: CSF ignore list skips some ignore exclusions

Posted: 05 Jun 2015, 15:44
by InteractM
I have added those two lines to csf.signore

Code: Select all

/tmp/netatop-0.5/netatop.init
/tmp/netatop-0.5/mkversion
and still I'm receiving suspicious file alerts.

Re: CSF ignore list skips some ignore exclusions

Posted: 03 Jul 2015, 17:53
by hostess
I think this is a bug with the current version of CSF. I have the latest version installed and still this problem is happening. The LFD doesn't take into account the csf.signore file, and keeps sending alerts even if the sending script is white listed in the signore file.

I understand that the LFD scans the mail log for the sending directory and can't know which script exactly in that directory is sending mails, so it raises alert with all possible mail sending scripts in that directory. However the solution is simple: if all mail sending scripts in that directory are white listed then no alert is warranted, and if at least one mail sending script in that directory is not in the signore white list then an alert should be raised.

When can we expect a fix of this issue to be released?

Re: CSF ignore list skips some ignore exclusions

Posted: 11 Dec 2015, 12:42
by willdashwood
I've just noticed the same issue. I want to exclude an installation of PHPList from notifications. I've tried adding the following as I'm not sure of the correct syntax.

/home/username/public_html/PHPList/
/home/username/public_html/PHPList/admin/
/home/username/public_html/PHPList/*
/home/username/public_html/PHPList/admin/*

Are wildcard required? If I list "PHPList/" should that cover all sub-folders too?

I still get alerts even with the above.