ConfigServer Community Forum

For some odd reason the new CSF 2.87 is not blocking the previously blocked IPs/ranges from the deny file

While it looks like it generates a lot of iptable rules, does do not have an effect

Furthermore it must be noted that a quick deny for an IP, doing an iptable statement still works... but that block is gone after CSF restart

a normal IPTABLES statement for blocking IP/ranges also works...

Connection Tracking set to 100 connections, exclude time_wait. The same IP was blocked twice, got 2 separate emails, 2 seconds apart:

20:37:39
20:37:41

How come the blocked IP doesn't appear in Firewall Deny IPs?

It seems that cpanel has changed the contents of the login_log file and therefore csf cannot detect attempt with login failure.

cpanel: has been changed to cpaneld:

whm: has been changed to vhostmgrd:

Can you check that and maybe report these change to regex.pm

Thanks.

Marc

Hi,

CSF is configured to block IP after 5 attempts to POP3 with these values :
LF_POP3D = 5
LF_POP3D_PERM = 900

This works fine when using the POP standard port 110

When i switch to POP3-SSL using port 995, CSF doesn't detect POP failed login.

Here the content of maillog file :
Aug 13 16:45:36 looping pop3d-ssl: LOGIN FAILED, user=xxx-yyy@domain_name.info, ip=
Aug 13 16:45:41 looping...

# Check the PT_LOAD_AVG minute Load Average (can be set to 1 5 or 15 and
# defaults to 5 if set otherwise) on the server every PT_LOAD seconds. If the
# load average is greater than or equal to PT_LOAD_LEVEL then an email alert is
# sent. lfd then does not report subsequent high load until PT_LOAD_SKIP
# seconds has passed to prevent email floods.
#
# Set LF_LOAD to 0 to disable this feature...

Hi,
I´m getting this error when i try to restart csf.
I get:
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Restarting bandmin acctboth chains for cPanel
ACCEPT all opt -- in lo out * 0.0.0.0/0 -> 0.0.0.0/0
ACCEPT all opt -- in * out lo 0.0.0.0/0 -> 0.0.0.0/0
Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Flushing chain `acctboth'
Deleting chain...

This is on a CentOS and in Generic mode:

> /etc/init.d/csf restart
Stopping csf:Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Error: Setting LF_SSHD is repeated in /etc/csf/csf.conf - you must remove the duplicates and then restart csf and lfd., at line 68

Starting csf:Flushing chain `INPUT'
Flushing chain `FORWARD'
Flushing chain `OUTPUT'
Error: Setting LF_SSHD is...

Hello,
I trying to use your firewall but I have very big problem, from my server I connecting to external MySQL server and your firewall blocking this connection with error blocked with too many connections but OK (I thinked) I added IP for my MySQL server on white list (Firewall Allow IPs) and restarted firewall/lfd but after 60 seconds firewall AGAIN blocking this IP!!! Why??? How I can disable...

Hey I got Debian Sarge and I installed csf, I also hava Webmin and I added module for csf, when I click on icon in Wemin -> System -> ConfigServer Security & Firewall I got this message:

Error - Perl execution failed

Undefined subroutine &main::init_config called at /usr/local/share/webmin/csf/index.cgi line 14.

Anyone can help me?

I got:

Apache/2.0.54 (Debian GNU/Linux) mod_jk2/2.0.4...

I just downloaded / installed New csf v2.84 (released just this morning) and I've noticed something very odd.

Instead of actually putting the ip address of a brute forcer in the Deny list (like it normally would), LFD just keeps sending me alerts s every 4 minutes saying it's denying the user, but it never adds their IP to the Deny list and I have to go in and do it manually to stop them.

For...

Since 7/3 one of my servers has reported the same error when tryingto update

Unable to connect to configserver.com at this time: Died

Now running ConfigServer Security & Firewall - csf v2.79 - so its a ways behind

I wasnt worried about one or 2 errors - figured they were timeouts - but 5 times in a row...

Any ideas ?

I just noticed that the Web Disk feature in CPanel 11 ports aren't supported in CSF as the use 2078 (SSL) and 2077 (Non-SSL) :) .

Hi Guys,

I've come across an interesting issue on a number of Centos 4.5, cPanel 11 and CSF installations.

For some reason when running Check Server Security, it starts to render the screen and then just stops with this error at the top of the screen. It gets to the Check Shell Limits line and then dies.

I've tried on Release and Current branches of cPanel 11, to no avail.

Anyone have any...

Just getting an error when trying to access the CSF interface in WHM :

Unable to connect to configserver.com at this time: Unrecognized character \x1B

Upgrading through SSH to the newest version did not change this.

Cheers
Graham

Is it only me or are people beginning to have some trouble with cfd? I have three dedicated hosting servers (US, Hong Kong, Japan) and all of them only recently started having the slowness. My friends have sent me traceroutes from their machines, and I have used traceroute.org to test it myself -- the problem is always with the last hop. From my bandwidth provider to my own server. Then, just to...

Hello

What's the problem if the both security on same server CSF+APF ?

and why it show me :

Remove APF from the server. You must not run both APF with csf on the same server

Thank you

When ever i have the security settings set to MED or High, i cannot update cpanel, but i can when i set it to low, why?

SMTP_block also doesnt work, if i set to med or high i need to go in and disable this because i get an iptables error.

any idea's on how to fix this?

Just updated to v2.69 and did see the changelog:

When upgrading the new setting will be set to whatever you have LF_FTPD set to

This is not happening, just wanted let you know. I had LF_FTPD to 8 and after update the smtp value is 1.

Thanx!