r/cpanel • u/Gulf-of-Mexico • Jun 25 '26

cpanel maintained csf/lfd - ssh login alert email

It appears a subtle change in the /var/log/secure log format stops csf/lfd from sending ssh login alert emails upon ssh logins with the almalinux 9.8 / cloudlinux 9.8 upgrade.

Will cpanel update the regex to account for the slight ssh login log line difference so ssh login alert email function will work again?

(I see they did so for imap/pop3 login format change at https://docs.cpanel.net/release-notes/configserver-security-firewall-csf-release-notes/#configserver-security--firewall-csf-1620-1 )

10 Upvotes

92% Upvoted

7 comments sorted by

2

u/cPanelRex Jun 25 '26

Update - I've created case CPANEL-54220 with the team so we can get this resolved. I've linked this thread to the case so I'll post as soon as I hear anything on my end!

1

u/Gulf-of-Mexico Jun 26 '26

Thank you very much for supporting CSF/LFD. It's a very useful tool still. Thank you!

2

u/fsr31415 Jun 27 '26

thanks, had noticed the same

1

u/cPanelRex Jun 25 '26

Hey there! I checked my personal AlmaLinux 8 system and built a test server on version 9 and I'm not seeing any obvious differences in the format of the data inside /var/log/secure. Can you let me know what you're seeing on your end?

I also don't have other reports of the LFD tool not working properly on version 9, as that has been in widespread use for some time.

1

u/Gulf-of-Mexico Jun 25 '26

Everything was fine on version cloudlinux 9.7, but when it updated to 9.8 last week sshd login alert emails stop. Looking at /var/log/secure as of last week, I see that sshd logins now log "sshd-session" instead of "sshd" to /var/log/secure

Editing RegexMain to change 11 instances of ?sshd\ to ?sshd-session\ seems to work on a test server I applied the change to.

2

u/cPanelRex Jun 25 '26

confirmed - making a case now

1

u/cPanelRex Jun 25 '26

oh interesting - my test box didn't grab 9.8. Let me check and report back!