# #
#   @app                ConfigServer Firewall & Security (CSF)
#                       Login Failure Daemon (LFD)
#   @website            https://configserver.dev
#   @docs               https://docs.configserver.dev
#   @download           https://download.configserver.dev
#   @repo               https://github.com/Aetherinox/csf-firewall
#   @copyright          Copyright (C) 2025-2026 Aetherinox
#                       Copyright (C) 2006-2025 Jonathan Michaelson
#                       Copyright (C) 2006-2025 Way to the Web Ltd.
#   @license            GPLv3
#   @updated            09.26.2025
#   
#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 3 of the License, or (at
#   your option) any later version.
#   
#   This program is distributed in the hope that it will be useful, but
#   WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
#   General Public License for more details.
#   
#   You should have received a copy of the GNU General Public License
#   along with this program; if not, see <https://www.gnu.org/licenses>.
# #

# #
#   The following is a list of executables (exe), command lines (cmd), and
#   usernames (user) that lfd process tracking will ignore.
#   
#   You must use the following format:
#       exe:/full/path/to/file
#       user:username
#       cmd:command line
#   
#   Or, perl regular expression matching (regex):
#       pexe:/full/path/to/file as a perl regex[*]
#       puser:username as a perl regex[*]
#       pcmd:command line as a perl regex[*]
#   
#   [*] You must remember to escape characters correctly when using regex's, e.g.:
#       pexe:/home/.*/public_html/cgi-bin/script\.cgi
#       puser:bob\d.*
#       pcmd:/home/.*/command\s\to\smatch\s\.pl\s.*
#   
#   It is strongly recommended that you use command line ignores very carefully
#   as any process can change what is reported to the OS.
#   
#   For more information see readme.txt
# #

exe:/bin/dbus-daemon
exe:/sbin/ntpd
exe:/usr/bin/dbus-daemon
exe:/usr/bin/lsmd
exe:/usr/lib/courier-imap/bin/imapd
exe:/usr/lib/courier-imap/bin/pop3d
exe:/usr/lib/polkit-1/polkitd
exe:/usr/libexec/dovecot/imap
exe:/usr/libexec/dovecot/imap
exe:/usr/libexec/dovecot/pop3
exe:/usr/libexec/dovecot/pop3
exe:/usr/libexec/dovecot/stats
exe:/usr/libexec/dovecot/auth
exe:/usr/libexec/mysqld
exe:/usr/local/apache/bin/httpd
exe:/usr/local/libexec/dovecot/imap
exe:/usr/local/libexec/dovecot/imap-login
exe:/usr/local/libexec/dovecot/pop3
exe:/usr/local/libexec/dovecot/pop3-login
exe:/usr/local/libexec/dovecot/stats
exe:/usr/sbin/chronyd
exe:/usr/sbin/exim
exe:/usr/sbin/exim4
exe:/usr/sbin/named
exe:/usr/sbin/nscd
exe:/usr/sbin/ntpd
exe:/usr/sbin/ntpd
exe:/usr/sbin/proftpd
exe:/usr/sbin/pure-ftpd
exe:/usr/sbin/sshd
exe:/usr/sbin/apache2
exe:/usr/sbin/mysqld
exe:/lib/systemd/systemd-timesyncd
exe:/sbin/rngd
exe:/usr/bin/dbus-broker-launch
exe:/usr/bin/dbus-broker

exe:/usr/local/interworx/mysql/usr/sbin/mysqld
exe:/usr/bin/tcpserver
exe:/usr/bin/multilog
exe:/usr/sbin/clamd
exe:/usr/bin/freshclam
exe:/usr/sbin/httpd
exe:/usr/libexec/dovecot/anvil
exe:/var/qmail/bin/qmail-rspawn
exe:/var/qmail/bin/qmail-send
exe:/var/qmail/bin/qmail-clean
exe:/usr/bin/tinydns
exe:/usr/local/interworx/bin/httpd/httpd
exe:/usr/bin/dnscache
exe:/usr/sbin/mariadbd

# #
#   Some additional entries that you might want to ignore on cPanel servers.
#   However, be aware of the security implications under "Process Tracking" in
#   the csf readme.txt when using these:
# #

#   cmd:spamd child
#   cmd:/bin/sh /usr/bin/mysqld_safe --basedir=/usr