Search found 4 matches

by rickphp
10 Mar 2025, 10:38
Forum: General Discussion (csf)
Topic: CSF blocklist oddity
Replies: 0
Views: 23870

CSF blocklist oddity

Hi, I recently added Abuse IP DB to my CSF blocklists file as I've seen an increase in web scanning, and all of the source IPs were listed on AbuseIPDB, so I figured it may be a good source to add to CSF blocklists.. I noticed some unwanted traffic this morning, and the IP was on AbuseIPDB, so I sta...
by rickphp
25 Mar 2013, 09:12
Forum: Suggestions (csf)
Topic: LF_SYMLINK false positives
Replies: 2
Views: 5171

Re: LF_SYMLINK false positives

Reading up on how the sym patch works, it will cause problems like these as it simply blocks the request if the ownerships don't match. The better patch is the one from Rack911, which forces symlinks follow with the if owner match flag. Maybe csf could offer another LFD option for rack911s patch? I ...
by rickphp
22 Mar 2013, 13:39
Forum: Suggestions (csf)
Topic: LF_SYMLINK false positives
Replies: 2
Views: 5171

LF_SYMLINK false positives

Hi, I've recently enabled LF_SYMLINK and have found its been blocking genuine traffic. I use suPHP so of coarse all users should own their own files, but some users have files owned by nobody for whatever reason, these users are triggering the LF_SYMLINK because their userid is accessing the 'nobody...
by rickphp
28 Dec 2012, 19:17
Forum: General Discussion (csf)
Topic: lfd RELAY Alert on incoming mail?
Replies: 1
Views: 3011

lfd RELAY Alert on incoming mail?

I had an account that got sent a load of emails all of once (about 100) and lfd picked this up as relayed mail.

This has happened a few times.

Is this expected behaviour?