diff --git a/csf/csf.deny b/csf/csf.deny
index 60ade64..cc34266 100644
--- a/csf/csf.deny
+++ b/csf/csf.deny
@@ -859,3 +859,8 @@
 85.143.173.211 # lfd: (PERMBLOCK) 85.143.173.211 (RU/Russia/-/-/-) has had more than 2 temp blocks in the last 86400 secs - Thu May 25 13:11:43 2023
 164.92.170.186 # lfd: (PERMBLOCK) 164.92.170.186 (DE/Germany/Hesse/Frankfurt am Main/-) has had more than 2 temp blocks in the last 86400 secs - Thu May 25 13:15:47 2023
 96.78.175.41 # lfd: (PERMBLOCK) 96.78.175.41 (US/United States/California/Hayward/96-78-175-41-static.hfc.comcastbusiness.net) has had more than 2 temp blocks in the last 86400 secs - Thu May 25 13:15:48 2023
+8.219.64.126 # lfd: (PERMBLOCK) 8.219.64.126 (SG/Singapore/-/-/-) has had more than 2 temp blocks in the last 86400 secs - Thu May 25 13:46:41 2023
+191.44.51.237 # lfd: (PERMBLOCK) 191.44.51.237 (BR/Brazil/Bahia/Vitória da Conquista/191-44-51-237.user3p.veloxzone.com.br.51.44.191.in-addr.arpa) has had more than 2 temp blocks in the last 86400 secs - Thu May 25 13:46:42 2023
+206.189.88.242 # lfd: (PERMBLOCK) 206.189.88.242 (SG/Singapore/-/-/-) has had more than 2 temp blocks in the last 86400 secs - Thu May 25 13:52:42 2023
+125.209.73.250 # lfd: (PERMBLOCK) 125.209.73.250 (PK/Pakistan/Punjab/Lahore/125-209-73-250.multi.net.pk) has had more than 2 temp blocks in the last 86400 secs - Thu May 25 13:52:42 2023
+14.63.217.28 # lfd: (PERMBLOCK) 14.63.217.28 (KR/South Korea/-/-/-) has had more than 2 temp blocks in the last 86400 secs - Thu May 25 13:52:43 2023
diff --git a/group b/group
index 0ca5cac..9d42532 100644
--- a/group
+++ b/group
@@ -111,3 +111,4 @@ netdata:x:954:
 _imunify:x:953:
 linksafe:x:952:
 imunify360-webshield:x:951:
+rnd:x:1024:
diff --git a/group- b/group-
index e3fc539..0ca5cac 100644
--- a/group-
+++ b/group-
@@ -82,7 +82,7 @@ spamd:x:1005:
 sara:x:1006:
 www-data:x:1007:
 clamav:x:958:
-ossec:x:957:ossecr,ossecm,ossece,nginx
+ossec:x:957:ossecr,ossecm,ossece,nginx,ossec
 csf:x:1008:
 smiti:x:1009:
 stapusr:x:156:
diff --git a/gshadow b/gshadow
index e9a4a0d..afac06d 100644
--- a/gshadow
+++ b/gshadow
@@ -111,3 +111,4 @@ netdata:!::
 _imunify:!::
 linksafe:!::
 imunify360-webshield:!::
+rnd:!::
diff --git a/gshadow- b/gshadow-
index 2088548..e9a4a0d 100644
--- a/gshadow-
+++ b/gshadow-
@@ -81,7 +81,7 @@ spamd:!::
 sara:!::
 www-data:!::
 clamav:!::
-ossec:!::ossecr,ossecm,ossece,nginx
+ossec:!::ossecr,ossecm,ossece,nginx,ossec
 csf:!::
 smiti:!::
 stapusr:!::
diff --git a/passwd b/passwd
index 4f863b4..2ae7e52 100644
--- a/passwd
+++ b/passwd
@@ -82,3 +82,4 @@ netdata:x:958:954:Netdata pseudo user:/usr/share/netdata:/sbin/nologin
 _imunify:x:957:953::/home/_imunify:/bin/false
 imunify360-webshield:x:956:951:imunify360-webshield user:/var/cache/imunify360-webshield:/sbin/nologin
 ossec:x:955:957::/var/ossec:/sbin/nologin
+rnd:x:1024:1024::/home/rnd:/bin/bash
diff --git a/passwd- b/passwd-
index 49eafd5..4f863b4 100644
--- a/passwd-
+++ b/passwd-
@@ -81,3 +81,4 @@ privoxy:x:73:73::/etc/privoxy:/sbin/nologin
 netdata:x:958:954:Netdata pseudo user:/usr/share/netdata:/sbin/nologin
 _imunify:x:957:953::/home/_imunify:/bin/false
 imunify360-webshield:x:956:951:imunify360-webshield user:/var/cache/imunify360-webshield:/sbin/nologin
+ossec:x:955:957::/var/ossec:/sbin/nologin
diff --git a/shadow b/shadow
index b708121..e25517b 100644
--- a/shadow
+++ b/shadow
@@ -82,3 +82,4 @@ netdata:!!:19381::::::
 _imunify:!!:19397::::::
 imunify360-webshield:!!:19397::::::
 ossec:!!:19397::::::
+rnd:!!:19502:0:99999:7:30::
diff --git a/shadow- b/shadow-
index 307b465..b708121 100644
--- a/shadow-
+++ b/shadow-
@@ -81,3 +81,4 @@ privoxy:!!:19312::::::
 netdata:!!:19381::::::
 _imunify:!!:19397::::::
 imunify360-webshield:!!:19397::::::
+ossec:!!:19397::::::
diff --git a/subgid b/subgid
index 0fe9649..25e19b8 100644
--- a/subgid
+++ b/subgid
@@ -20,3 +20,4 @@ bogdan:1279648:65536
 laser:1345184:65536
 pydio:1410720:65536
 sftp:1476256:65536
+rnd:1541792:65536
diff --git a/subgid- b/subgid-
index 7becd61..0fe9649 100644
--- a/subgid-
+++ b/subgid-
@@ -19,3 +19,4 @@ litecoin:1214112:65536
 bogdan:1279648:65536
 laser:1345184:65536
 pydio:1410720:65536
+sftp:1476256:65536
diff --git a/subuid b/subuid
index 0fe9649..25e19b8 100644
--- a/subuid
+++ b/subuid
@@ -20,3 +20,4 @@ bogdan:1279648:65536
 laser:1345184:65536
 pydio:1410720:65536
 sftp:1476256:65536
+rnd:1541792:65536
diff --git a/subuid- b/subuid-
index 7becd61..0fe9649 100644
--- a/subuid-
+++ b/subuid-
@@ -19,3 +19,4 @@ litecoin:1214112:65536
 bogdan:1279648:65536
 laser:1345184:65536
 pydio:1410720:65536
+sftp:1476256:65536