ConfigServer Community Forum

Hi there,

I'm on a stock CentOS6 system and have configured csf to read all Plesk domain logs via file globbing. This works great generally, but on some servers with more than roughly 150 or so domains (particularly when we've got nginx and apache running), LFD is reading in a large number of log files and exceeding the default 1024 per user limit.

My temporary fix for this has worked great:...

Port 587 outgoing is default disabled in csf.conf. Is there a reason for having it disabled ?

If not, i would like to suggest to open it in the default csf.conf for TCP_OUT and TCP6_OUT. This because many clients and servers prefer to connect secure over TLS. For example; to relay e-mail at another mailservice provider. In many cases i noticed that other mailservers accept TLS connections only...

my $cmdpid = open3($childin, $childout, $childout, $config{IPSET}, create , -exist ,$set, hash:net );
to
my $cmdpid = open3($childin, $childout, $childout, $config{IPSET}, create , -exist ,$set, hash:net , hashsize , 16777216 , maxelem , 16777216 );
To let much bigger IPSET tables.
I patch it manually on my systems but changes revert often.

Long ago my dial up ISP told me to insure I check POP before trying to send mail. Most e-mail applications do this in that order.

How about monitoring successful POP3/IMAP logins and immediately adding the IP to say /etc/csf/csf.smtpauthallow say for X hours/days/configurable.

Then only advertising SMTPAUTH to IP addresses that are listed in /etc/csf/csf.smtpauthallow

I understand that if...

If csf.deny reaches it maximum limit then the oldest entries are removed unless do not delete is specified.

To avoid quick removal of rules due to DENY_IP_LIMIT please clean up csf.deny after a Netblock is added. When a Netblock is added there are multiple single ip adresses redundant in csf.deny and can be removed from csf.deny. No need to double block them.
This way important blocks are longer...

Hi there, it would be a nice feature to have CSF/lfd send an email alert (if configured) when auto updating the system.
This would mean that we'd get an update email right before (or after) the checksum checks for the firewall scripts fail. As it is now, on every auto-update we have to check the blog to see if there was an update or if it's a security breach.
Just a suggestion. Thanks for the...

I noticed this morning that that I was getting connection refused messages when trying to download the OPENBL blocklists.

I checked their website and they've converted everything to https including the blocklist URLs. Just letting you know so you can update it in a future release.

I am posting this as a bug because it looks like one. :)

I have installed the csf plugin for Directadmin on a server running the fairly new and shiny Centos 7. The script as such in functioning well, but in Directadmin's service monitor, the process shows up using 0 memory and cannot be (re)started or stopped. The error is as follows:

Cannot find the script in /etc/systemd/system or...

Hello,

Until recently my suggestion was never really an issue. I would receive notification of blocked IP's that I can quickly search in my emails if need be. This has worked for the longest time.

Recently however, I have been receiving thousands of emails with regards to distributed smtpauth attacks. This is generating a lot of needless emails and cluttering my inbox. In an ideal world it...

Blocking by Mac Address would be a nice feature.

When CSF is installed on Centos 7 in the CSF server security check I get this message.

Check for kernel logger - rsyslogd appears to be running, but klog may not be loaded which logs kernel firewall messages to rsyslog. You should modify /etc/rsyslogd to load the klog module with:
$ModLoad imklog
Then restart rsyslog

When I look at /etc/rsyslog.conf the line is indeed commented out but...

Forgive me if this is not a bug. I can't find any prior mention of it. I am running CSF on Ubuntu 14.04 and using the Webmin plugin. My concern is about the two files that CSF's install-dot-sh placed in /etc/cron.d, i.e. csfcron-dot-sh and lfdcron-dot-sh. According to the MAN page, these files aren't supposed to have any . (dots) in the name. I mention it because I've had plenty of issues with...

Problem:
Many times I'm working on the command line and I'm about to ban an IP address but I need to make sure that the IP address isn't coming from a legitimate client. This usually involves me opening up a browser and looking up the IP address on some website. CSF already has the Maxmind database info to do this very easily.

Proposal:
eg. csf -i 203.0.113.0
-i, --info ip
Lookup geographical...

We are using cPanel based servers and recently switched from using the AtomiCorp mod_security rules to the OWASP rules now being provided by cPanel (as I imagine a lot of people will be doing).

It looks like CSF no longer recognizes events triggered by these rules and is not blocking the IP addresses after a certain number of hits.

I described the issue in a thread here [edit: I can't post...

Now that everyone is switching over to SSL it would be nice if MESSENGER_HTML_IN could redirect SSL ports (if this is even possible).

lfd ip blocks currently report the country via maxmind country db

but maxmind also has a very helpful asn db

I'd love the report inside csf.deny and the emails to also show the asn info

maybe as an option in csf.conf ?

see, not so helpful 177.71.128.1
GeoIP Country Edition: BR, Brazil

but:
GeoIP ASNum Edition: AS16509 Amazon.com, Inc.

much more helpful!

Thanks for considering.

I can't seem to get LF_BIND to work at all. CENTOS 5.11, BIND 9.9.5.

RESTRICT_SYSLOG = 2
...
LF_BIND = 100
LF_BIND_PERM = 1
...
BIND_LOG = /var/log/messages

I'm getting thousands of lines in /var/log/messages like this:
Dec 10 07:04:40 myserver named : client 185.49.69.255#39122 (*****.com): view external: query (cache) '*****.com/A/IN' denied
Dec 10 07:04:40 myserver named : client...

We love CSF, but we're concerned that no secure download is available.

Since CSF is critical to many servers' security, it could be the target of attack. Imagine a man-in-the-middle or poisoned DNS providing a modified csf.tgz. It could contain a backdoor or other nasty code that you're installing without knowing any better.

Please consider providing the download link and updates over HTTPS/SSL...

Hello, guys!

I just noticed that when I login to the SSH server, using key authentication (not password), I don't get an email alerts?

This is a bug, right? When the same happens using password, emails are coming correctly!

Could you please fix it?