Knowledgebase

TESTING = 

TESTING_INTERVAL =  Default: 5 [1-60]

AUTO_UPDATES =  Default: 1 [0-1]

TCP_IN = 

TCP_OUT = 20,21,22,25,43,53,80,106,110,113,143,443,465,587,873,990,993,995,3310,5224,5353,8443,8447,8880,9080,

UDP_IN = 

UDP_OUT = 

ICMP_IN_RATE = 

ICMP_OUT =  Default: 1 [0-1]

ICMP_OUT_RATE = 

ETH_DEVICE = 

# SECTION:Logging Settings
###############################################################################

LOGFLOOD_ALERT =  Default: 0 [0-1]

# SECTION:Reporting Settings
###############################################################################
# By default, lfd will send alert emails using the relevant alert template to
# the To: address configured within that template. Setting the following
# option will override the configured To: field in all lfd alert emails
#
#Leave this option empty to use the To: field setting in each alert template

# By default, lfd will send alert emails using the relevant alert template from
# the From: address configured within that template. Setting the following
# option will override the configured From: field in all lfd alert emails
#
# Leave this option empty to use the From: field setting in each alert template

# By default, lfd will send all alerts using the SENDMAIL binary. To send using
# SMTP directly, you can set the following to a relaying SMTP server, e.g.
# “127.0.0.1”. Leave this setting blank to use SENDMAIL

IF YOU STILL CAN’T GET EMAIL FROM CSF LFD THAN TRY USING SMTP DIRECTLY BY CHANGING LF_ALERT_SMTP = “” to LF_ALERT_SMTP = “127.0.0.1” OR WHERE YOUR EMAIL SERVER IS LOCATED.

 

Important! Make sure to Setup Login Failure Blocking for Specific Services

###############################################################################
# SECTION:Login Failure Blocking and Alerts
###############################################################################
# The following[*] triggers are application specific. If you set #LF_TRIGGER to
# “0” the value of each trigger is the number of failures against that
# application that will trigger lfd to block the IP address
#
# If you set LF_TRIGGER to a value greater than “0” then the following[*]
# application triggers are simply on or off (“0″ or “1”) and the value of
# LF_TRIGGER is the total cumulative number of failures that will #trigger lfd
# to block the IP address
#
# Setting the application trigger to “0” disables it

# If LF_TRIGGER is > “0” then LF_TRIGGER_PERM can be set to “1” to #permanently
# block the IP address, or LF_TRIGGER_PERM can be set to a value #greater than
# “1” and the IP address will be blocked temporarily for that value in #seconds.
# For example:
# LF_TRIGGER_PERM = “1” => the IP is blocked permanently
# LF_TRIGGER_PERM = “3600” => the IP is blocked temporarily for 1 hour
#
# If LF_TRIGGER is “0”, then the application LF_[application]_PERM value #works
# in the same way as above and LF_TRIGGER_PERM serves no function

 

# To only block access to the failed application instead of a complete #block
# for an ip address, you can set the following to “1”, but LF_TRIGGER #must be
# set to “0” with specific application[*] trigger levels also set #appropriately
#
# The ports that are blocked can be configured by changing the #PORTS_* options

LF_SELECT = “0”

# Send an email alert if an IP address is blocked by one of the [*] #triggers

LF_EMAIL_ALERT = “1”

# [*]Enable login failure detection of sshd connections
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:

LF_SSHD = “8”
LF_SSHD_PERM = “1”

# [*]Enable login failure detection of ftp connections
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_FTPD = “14”
LF_FTPD_PERM = “1”

# [*]Enable login failure detection of SMTP AUTH connections
LF_SMTPAUTH = “15”
LF_SMTPAUTH_PERM = “1”# [*]Enable syntax failure detection of Exim connections
LF_EXIMSYNTAX = “2”
LF_EXIMSYNTAX_PERM = “1”# [*]Enable login failure detection of pop3 connections
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_POP3D = “20”
LF_POP3D_PERM = “1”# [*]Enable login failure detection of imap connections
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_IMAPD = “20”
LF_IMAPD_PERM = “1”# [*]Enable login failure detection of Apache .htpasswd connections
# Due to the often high logging rate in the Apache error log, you might #want to
# enable this option only if you know you are suffering from attacks #against
# password protected directories
LF_HTACCESS = “”
LF_HTACCESS_PERM = “1”# [*]Enable failure detection of repeated Apache mod_security rule #triggers
LF_MODSEC = “3”
LF_MODSEC_PERM = “1”# [*]Enable detection of repeated BIND denied requests
# This option should be enabled with care as it will prevent blocked IPs #from
# resolving any domains on the server. You might want to set the #trigger value
# reasonably high to avoid this
# Example: LF_BIND = “100”
LF_BIND = “100”
LF_BIND_PERM = “1”# [*]Enable detection of repeated suhosin ALERTs
# Example: LF_SUHOSIN = “5”
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_SUHOSIN = “5”
LF_SUHOSIN_PERM = “1”# [*]Enable detection of repeated cxs ModSecurity mod_security rule #triggers
# This option will block IP addresses if cxs detects a hits from the
# ModSecurity rule associated with it
#
# Note: This option takes precedence over LF_MODSEC and removes #any hits
# counted towards LF_MODSEC for the cxs rule
#
# This setting should probably set very low, perhaps to 1, if you want #to
# effectively block IP addresses for this trigger option
LF_CXS = “1”

LF_CXS_PERM = “1”# [*]Enable detection of repeated Apache mod_qos rule triggers
LF_QOS = “2”
LF_QOS_PERM = “1”# [*]Enable detection of repeated Apache symlink race condition #triggers from
# the Apache patch provided by:
# http://www.mail-archive.com/dev@httpd.apache.org/msg55666.html
# This patch has also been included by cPanel via the easyapache #option:
# “Symlink Race Condition Protection”
LF_SYMLINK = “2”
LF_SYMLINK_PERM = “1”# [*]Enable login failure detection of webmin connections
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_WEBMIN = “1”
LF_WEBMIN_PERM = “1”# Send an email alert if anyone logs in successfully using SSH
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_SSH_EMAIL_ALERT = “1”# Send an email alert if anyone uses su to access another account. This #will
# send an email alert whether the attempt to use su was successful or #not
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_SU_EMAIL_ALERT = “1”# Send an email alert if anyone accesses webmin
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_WEBMIN_EMAIL_ALERT = “1”# Send an email alert if anyone logs in successfully to root on the #console
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_CONSOLE_EMAIL_ALERT = “1”

# System Exploit Checking. This option is designed to perform a series #of tests
# to send an alert in case a possible server compromise is detected
#
# To enable this feature set the following to the checking interval in #seconds
# (a value of 300 would seem sensible).
#
# To disable set to “0”
LF_EXPLOIT = “300”

###############################################################################
# SECTION:Distributed Attacks
###############################################################################
# Distributed Account Attack. This option will keep track of login #failures
# from distributed IP addresses to a specific application account. If the
# number of failures matches the trigger value above, ALL of the IP addresses
# involved in the attack will be blocked according to the temp/perm #rules above
#
# Tracking applies to LF_SSHD, LF_FTPD, LF_SMTPAUTH, LF_POP3D, #LF_IMAPD,
# LF_HTACCESS
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:

# Set the following to the minimum number of unique IP addresses #that trigger
# LF_DISTATTACK

 

# Distributed FTP Logins. This option will keep track of successful FTP logins.
# If the number of successful logins to an individual account is at least
# LF_DISTFTP in LF_DIST_INTERVAL from at least LF_DISTFTP_UNIQ IP #addresses,
# then all of the IP addresses will be blocked
#
# This option can help mitigate the common FTP account compromise #attacks that
# use a distributed network of zombies to deface websites
#
# A sensible setting for this might be 5, depending on how many #different
# IP addresses you expect to an individual FTP account within #LF_DIST_INTERVAL
#
# To disable set to “0”
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LF_DISTFTP = “8”

# Set the following to the minimum number of unique IP addresses #that trigger
# LF_DISTFTP. LF_DISTFTP_UNIQ must be <= LF_DISTFTP for this to #work
LF_DISTFTP_UNIQ = “5”

# If this option is set to 1 the blocks will be permanent
# If this option is > 1, the blocks will be temporary for the specified #number
# of seconds
LF_DISTFTP_PERM = “1”

# Distributed SMTP Logins. This option will keep track of successful #SMTP
# logins. If the number of successful logins to an individual account is #at
# least LF_DISTSMTP in LF_DIST_INTERVAL from at least #LF_DISTSMTP_UNIQ IP
# addresses, then all of the IP addresses will be blocked. These options #only
# apply to the exim MTA
#
# This option can help mitigate the common SMTP account #compromise attacks that
# use a distributed network of zombies to send spam
## A sensible setting for this might be 5, depending on how many #different
# IP addresses you expect to an individual SMTP account within #LF_DIST_INTERVAL
#
# To disable set to “0”
LF_DISTSMTP = “8”

# Set the following to the minimum number of unique IP addresses #that trigger
# LF_DISTSMTP. LF_DISTSMTP_UNIQ must be <= LF_DISTSMTP for this #to work
LF_DISTSMTP_UNIQ = “4”

# If this option is set to 1 the blocks will be permanent
# If this option is > 1, the blocks will be temporary for the specified #number
# of seconds
LF_DISTSMTP_PERM = “1”

# This is the interval during which a distributed FTP or SMTP attack is
# measured
LF_DIST_INTERVAL = “300”

###############################################################################
# SECTION:Login Tracking
###############################################################################
# Block POP3 logins if greater than LT_POP3D times per hour per #account per IP
# address (0=disabled)
#
# This is a temporary block for the rest of the hour, afterwhich the IP is
# unblocked
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LT_POP3D = “10”

# Block IMAP logins if greater than LT_IMAPD times per hour per #account per IP
# address (0=disabled) – not recommended for IMAP logins due to the #ethos
# within which IMAP works. If you want to use this, setting it quite high #is
# probably a good idea
#
# This is a temporary block for the rest of the hour, afterwhich the IP is
# unblocked
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:
LT_IMAPD = “30”

# Send an email alert if an account exceeds LT_POP3D/LT_IMAPD logins #per hour
# per IP
LT_EMAIL_ALERT = “1”

# If LF_PERMBLOCK is enabled but you do not want this to apply to
# LT_POP3D/LT_IMAPD, then enable this option
LT_SKIPPERMBLOCK = “0”

###############################################################################
# SECTION:Connection Tracking
###############################################################################
# Connection Tracking. This option enables tracking of all connections #from IP
# addresses to the server. If the total number of connections is greater #than
# this value then the offending IP address is blocked. This can be used #to help
# prevent some types of DOS attack.
#
# Care should be taken with this option. It’s entirely possible that you #will
# see false-positives. Some protocols can be connection hungry, e.g. #FTP, IMAPD
# and HTTP so it could be quite easy to trigger, especially with a lot of
# closed connections in TIME_WAIT. However, for a server that is prone #to DOS
# attacks this may be very useful. A reasonable setting for this option #might
# be around 300.
#
# To disable this feature, set this to 0

# Connection Tracking interval. Set this to the the number of seconds #between
# connection tracking scans

 

# Send an email alert if an IP address is blocked due to connection #tracking
CT_EMAIL_ALERT = “1”

# If you want to make IP blocks permanent then set this to 1, otherwise #blocks
# will be temporary and will be cleared after CT_BLOCK_TIME seconds
CT_PERMANENT = “1”

# If you opt for temporary IP blocks for CT, then the following is the #interval
# in seconds that the IP will remained blocked for (e.g. 1800 = 30 mins)
CT_BLOCK_TIME = “1800”

###############################################################################
# SECTION:Process Tracking
###############################################################################
# Process Tracking. This option enables tracking of user and nobody #processes
# and examines them for suspicious executables or open network #ports. Its
# purpose is to identify potential exploit processes that are running on #the
# server, even if they are obfuscated to appear as system services. If a
# suspicious process is found an alert email is sent with relevant #information.
# It is then the responsibility of the recipient to investigate the process
# further as the script takes no further action
#
# The following is the number of seconds a process has to be active #before it
# is inspected. If you set this time too low, then you will likely trigger
# false-positives with CGI or PHP scripts.
# Set the value to 0 to disable this feature

# How frequently processes are checked in seconds
PT_INTERVAL = “60”

# This User Process Tracking option sends an alert if any linux user #process
# exceeds the memory usage set (MB). To ignore specific processes or #users use
# csf.pignore
#
# Set to 0 to disable this feature

# Check the PT_LOAD_AVG minute Load Average (can be set to 1 5 or 15 #and
# defaults to 5 if set otherwise) on the server every PT_LOAD seconds. If #the
# load average is greater than or equal to PT_LOAD_LEVEL then an #email alert is
# sent. lfd then does not report subsequent high load until #PT_LOAD_SKIP
# seconds has passed to prevent email floods.
#
# Set PT_LOAD to “0” to disable this feature

# Fork Bomb Protection. This option checks the number of processes #with the
# same session id and if greater than the value set, the whole session #tree is
# terminated and an alert sent
#
# You can see an example of common session id processes on most #Linux systems
# using: “ps axf -O sid”
#
# On cPanel servers, PT_ALL_USERS should be enabled to use this #option
# effectively
#
# This option will check root owned processes. Session id 0 and 1 will #always
# be ignored as they represent kernel and init processes. csf.pignore #will be
# honoured, but bear in mind that a session tree can contain a variety #of users
# and executables
#
# Care needs to be taken to ensure that this option only detects #runaway fork
# bombs, so should be set higher than any session tree is likely to get 3(e.g.
# httpd could have 100s of legitimate children on very busy systems). A
# sensible starting point on most servers might be 250

###############################################################################
# SECTION:Port Scan Tracking
###############################################################################
# Port Scan Tracking. This feature tracks port blocks logged by #iptables to
# syslog. If an IP address generates a port block that is logged more #than
# PS_LIMIT within PS_INTERVAL seconds, the IP address will be blocked.
#
# This feature could, for example, be useful for blocking hackers #attempting
# to access the standard SSH port if you have moved it to a port other #than 22
# and have removed 22 from the TCP_IN list so that connection #attempts to the
# old port are being logged
#
# This feature blocks all iptables blocks from the iptables logs, #including
# repeated attempts to one port or SYN flood blocks, etc
#
# Note: This feature will only track iptables blocks from the log file set #in
# IPTABLES_LOG below and if you have DROP_LOGGING enabled. #However, it will
# cause redundant blocking with DROP_IP_LOGGING enabled
#
# Warning: It’s possible that an elaborate DDOS (i.e. from multiple IP’s)
# could very quickly fill the iptables rule chains and cause a DOS in #itself.
# The DENY_IP_LIMIT should help to mitigate such problems with #permanent blocks
# and the DENY_TEMP_IP_LIMIT with temporary blocks
#
# Set PS_INTERVAL to “0” to disable this feature. A value of between 60 #and 300
# would be sensible to enable this feature
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG #option. Read
# this file about RESTRICT_SYSLOG before enabling this option:

# You can specify the ports and/or port ranges that should be tracked #by the
# Port Scan Tracking feature. The following setting is a comma #separated list
# of those ports and uses the same format as TCP_IN. The default #setting of
# 0:65535,ICMP covers all ports

# To specify how many different ports qualifies as a Port Scan you can #increase

# the following from the default value of 1. The risk in doing so will #mean
# that persistent attempts to attack a specific closed port will not be
# detected and blocked
PS_DIVERSITY = “1”

# You can select whether IP blocks for Port Scan Tracking should be #temporary
# or permanent. Set PS_PERMANENT to “0” for temporary and “1” for #permanent
# blocking. If set to “0” PS_BLOCK_TIME is the amount of time in #seconds to
# temporarily block the IP address for

# Set the following to “1” to enable Port Scan Tracking email alerts, set #to
# “0” to disable them
PS_EMAIL_ALERT = “1”

###############################################################################
# SECTION:User ID Tracking
###############################################################################
# User ID Tracking. This feature tracks UID blocks logged by iptables to
# syslog. If a UID generates a port block that is logged more than UID_LIMIT
# times within UID_INTERVAL seconds, an alert will be sent
#
# Note: This feature will only track iptables blocks from the log file set in
# IPTABLES_LOG and if DROP_OUT_LOGGING and DROP_UID_LOGGING are enabled.
#
# To ignore specific UIDs list them in csf.uidignore and then restart lfd
#
# Set UID_INTERVAL to “0” to disable this feature. A value of between 60 and 300
# would be sensible to enable this feature
#
# SECURITY NOTE: This option is affected by the RESTRICT_SYSLOG option. Read
# this file about RESTRICT_SYSLOG before enabling this option:

###############################################################################
# SECTION:Account Tracking
###############################################################################
# Account Tracking. The following options enable the tracking of modifications
# to the accounts on a server. If any of the enabled options are triggered by
# a modifications to an account, an alert email is sent. Only the modification
# is reported. The cause of the modification will have to be investigated
# manually
#
# You can set AT_ALERT to the following:
# 0 = disable this feature
# 1 = enable this feature for all accounts
# 2 = enable this feature only for superuser accounts (UID = 0, e.g. root, etc)
# 3 = enable this feature only for the root account
AT_ALERT = “1”# This options is the interval between checks in seconds
AT_INTERVAL = “60”# Send alert if a new account is created
AT_NEW = “1”# Send alert if an existing account is deleted
AT_OLD = “1”# Send alert if an account password has changed
AT_PASSWD = “1”# Send alert if an account uid has changed
AT_UID = “1”# Send alert if an account gid has changed
AT_GID = “1”# Send alert if an account login directory has changed
AT_DIR = “1”# Send alert if an account login shell has changed
AT_SHELL = “1”

###############################################################################
# SECTION:Log Scanner
###############################################################################
# Log Scanner. This feature will send out an email summary of the log lines of
# each log listed in /etc/csf/csf.logfiles. All lines will be reported unless
# they match a regular expression in /etc/csf/csf.logignore
#
# File globbing is supported for logs listed in /etc/csf/csf.logfiles. However,
# be aware that the more files lfd has to track, the greater the performance
# hit. Note: File globs are only evaluated when lfd is started
#
# Note: lfd builds the report continuously from lines logged after lfd has
# started, so any lines logged when lfd is not running will not be reported
# (e.g. during reboot). If lfd is restarted, then the report will include any
# lines logged during the previous lfd logging period that weren’t reported
#
# 1 to enable, 0 to disable

# This is the interval each report will be sent based on the logalert.txt
# template
#
# The interval can be set to:
# “hourly” – sent on the hour
# “daily” – sent at midnight (00:00)
# “manual” – sent whenever “csf –logrun” is run. This allows for scheduling
# via cron job

# Report Style
# 1 = Separate chronological log lines per log file
# 2 = Simply chronological log of all lines
LOGSCANNER_STYLE = “1”

# Send the report email even if no log lines reported
# 1 to enable, 0 to disable
LOGSCANNER_EMPTY = “1”

# Maximum number of lines in the report before it is truncated. This is to
# prevent log lines flooding resulting in an excessively large report. This
# might need to be increased if you choose a daily report
LOGSCANNER_LINES = “3000”

HTACCESS_LOG = “/var/log/httpd/error_log”
MODSEC_LOG = “/var/log/httpd/error_log”
SSHD_LOG = “/var/log/secure”
SU_LOG = “/var/log/secure”
FTPD_LOG = “/var/log/secure”
SMTPAUTH_LOG = “/usr/local/psa/var/log/maillog”
POP3D_LOG = “/usr/local/psa/var/log/maillog”
IMAPD_LOG = “/usr/local/psa/var/log/maillog”
IPTABLES_LOG = “/var/log/messages”
SUHOSIN_LOG = “/var/log/messages”
BIND_LOG = “/var/log/messages”
SYSLOG_LOG = “/var/log/messages”
WEBMIN_LOG = “/var/log/secure”

Parallels Plesk Panel 12 Log File Locations:

/var/log/plesk/panel.log
/var/log/maillog
/var/log/psa-horde/psa-horde.log
/var/log/secure
/var/log/plesk-roundcube/errors

/usr/local/psa/admin/logs/sitebuilder.log

/var/log/httpd/error_log

/var/log/nginx/error.log

/var/log/sw-cp-server/error_log

/var/www/vhosts/*/logs/access_log

/var/www/vhosts/*/logs/access_log

#/var/log/nginx/access.log

Now you need to edit the /etc/csf/csf.logfiles and put in the correct logs.

################################################################################################

Tip: check the email address you set in the configuration to send logs you will need to check if you need to ignore anymore users or processes.

cmd:   for commands

exe:    for executables

user:   for users you get the point.

## Custom Added ##
exe:/opt/drweb/drwebd.real
cmd:drwebd.real
user:drweb
user:apache
exe:/usr/sbin/httpd
cmd:/usr/sbin/httpd
user:nginx
exe:/usr/sbin/nginx
cmd:/usr/sbin/nginx
cmd:nginx: worker process
user:postfix
exe:/usr/lib64/plesk-9.0/psa-pc-remote
cmd:/usr/lib64/plesk-9.0/psa-pc-remote -p inet:12768@localhost
exe:/usr/libexec/postfix/tlsmgr
cmd:tlsmgr -l -t unix -u
exe:/usr/libexec/postfix/qmgr
cmd:qmgr -l -t fifo -u
exe:/usr/bin/php-cgi
user:hspc
exe:/usr/bin/perl
cmd:/usr/bin/perl /usr/sbin/hspc-plugin-rpc.fcgi

# Plesk process/user template #
user:admin
exe:/var/qmail/bin/qmail-smtpd
exe:/usr/bin/imapd
exe:/var/qmail/bin/qmail-queue
exe:/usr/bin/pop3d
exe:/var/qmail/bin/qmail-send
cmd:qmail-send
cmd:/usr/bin/pop3d Maildir
cmd:/var/qmail/bin/qmail-queue
cmd:/var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true
cmd:/usr/bin/imapd Maildir
exe:/var/qmail/bin/qmail-rspawn
cmd:qmail-rspawn
exe:/var/qmail/bin/qmail-clean
cmd:qmail-clean
exe:/usr/sbin/clamd
cmd:clamd
exe:/var/qmail/bin/splogger
cmd:splogger qmail
exe:/var/qmail/bin/qmail-remote.moved
user:qmaill
user:popuser
user:qmaild
user:qmails
user:qmailr
user:qmailq
user:qscand
exe:/usr/sbin/avahi-daemon
user:avahi
exe:/usr/local/sbin/zabbix_agentd
cmd:/usr/local/sbin/zabbix_agentd
user:zabbix
exe:/usr/bin/sw-engine-cgi
cmd:/usr/bin/sw-engine-cgi
user:sso
exe:/usr/sbin/sw-cp-serverd
cmd:/usr/sbin/sw-cp-serverd -f /etc/sw-cp-server/config
user:sw-cp-server
exe:/usr/bin/sw-engine-cgi
cmd:/usr/bin/sw-engine-cgi -c /usr/local/psa/admin/conf/php.ini -d auto_prepend_file=auth.php3 -u psaadm
user:psaadm
exe:/usr/libexec/mysqld
cmd:/usr/libexec/mysqld -basedir=/usr -datadir=/var/lib/mysql -user=mysql -pid-file=/var/run/mysqld/mysqld.pid -skip-external-locking -socket=/var/lib/mysql/m$
user:mysql
exe:/usr/libexec/hald-addon-acpi
exe:/usr/sbin/hald
cmd:hald
user:haldaemon
exe:/usr/bin/postgres
user:postgres
exe:/sbin/portmap
cmd:portmap
user:rpc
exe:/usr/bin/xfs
cmd:xfs -droppriv -daemon
user:xfs
exe:/usr/bin/python
cmd:/usr/bin/python /usr/lib/mailman/bin/qrunner -runner=VirginRunner:0:1 -s
user:mailman
exe:/usr/java/jdk1.6.0_20/bin/java
user:tomcat

CTRL+X to exit and Y to save changes.

Enable CSF
csf –e

Disable CSF
csf -x

Starting CSF
csf -s

Ban IP:
csf -d 1.2.3.4

Stop CSF
csf –stop

Flush CSF
csf -f

Stop LFD
service lfd stop

Start LFD
service lfd star