{"id":8765,"date":"2023-03-29T22:23:29","date_gmt":"2023-03-29T22:23:29","guid":{"rendered":"https:\/\/www.geekdecoder.com\/?p=8765"},"modified":"2023-03-29T22:23:29","modified_gmt":"2023-03-29T22:23:29","slug":"lfd-on-srv1-domain-net-suspicious-process-running-under-user-nobody","status":"publish","type":"post","link":"https:\/\/www.qbytes.cloud\/index.php\/2023\/03\/29\/lfd-on-srv1-domain-net-suspicious-process-running-under-user-nobody\/","title":{"rendered":"lfd on srv1.domain.net: Suspicious process running under user nobody"},"content":{"rendered":"\n<p>The cPanel server has bene installed and NGINX is installed and started. Soon, the suspicious process notifications comes from CSF\/LFD. <\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n...Executable:\n\n\/usr\/sbin\/nginx\n\n\nCommand Line (often faked in exploits):\n\nnginx: worker process\n...\n<\/pre><\/div>\n\n\n<p>So, the process needs to be whitelisted. Lets edit the following:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nnano \/etc\/csf\/csf.pignore\n<\/pre><\/div>\n\n\n<p>Add the following:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\nexe:\/usr\/sbin\/nginx\n<\/pre><\/div>\n\n\n<p>Restart CDF\/LDF<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\ncsf -r\n<\/pre><\/div>\n\n\n<p>We can also add this in cPanel at &#8220;Home&#8221; > &#8220;Plugins&#8221; : ConfigServer Security and Firewall<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/qbytes.cloud\/wp-content\/uploads\/2023\/03\/2023-03-29-17-40-28.png\"><img loading=\"lazy\" decoding=\"async\" width=\"790\" height=\"733\" src=\"https:\/\/qbytes.cloud\/wp-content\/uploads\/2023\/03\/2023-03-29-17-40-28.png\" alt=\"\" class=\"wp-image-8767\" srcset=\"https:\/\/www.qbytes.cloud\/wp-content\/uploads\/2023\/03\/2023-03-29-17-40-28.png 790w, https:\/\/www.qbytes.cloud\/wp-content\/uploads\/2023\/03\/2023-03-29-17-40-28-300x278.png 300w, https:\/\/www.qbytes.cloud\/wp-content\/uploads\/2023\/03\/2023-03-29-17-40-28-768x713.png 768w\" sizes=\"auto, (max-width: 790px) 100vw, 790px\" \/><\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>The cPanel server has bene installed and NGINX is installed and started. Soon, the suspicious process notifications comes from CSF\/LFD. So, the process needs to be whitelisted. Lets edit the following: Add the following: Restart CDF\/LDF We can also add this in cPanel at &#8220;Home&#8221; > &#8220;Plugins&#8221; : ConfigServer Security and Firewall<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[150],"tags":[],"class_list":["post-8765","post","type-post","status-publish","format-standard","hentry","category-unkategorisiert"],"_links":{"self":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts\/8765","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=8765"}],"version-history":[{"count":0,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts\/8765\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=8765"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=8765"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=8765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}