ConfigServer Community Forum

I want to allow all ports to the US
but I want to only allow certain ports to the world. ie port 80 http, & https. incoming mail, etc

thanks
Robert Harvey

I'm trying to come up with a solution to get a developer that has a dynamic IP through the firewall whenever he tries to access the server. I thought I could give him access to the web UI so he could add his IP whenever it changes but that requires his IP to get access in the first place. Is there some other solution?

Hi,

I rebooted my server and the boot is stuck as CSF failed to start.

When I tried restarting the following error is shown.

# csf -x
Error: csf is being restarted, try again in a moment: Resource temporarily unavailable at /usr/sbin/csf line 176.

When checked what is stopping from server to completely boot we found the following.

# systemctl status | head -5
● server.sastaservers.com...

Hello;
I have new Centos 7.4 Pure VM and after installing csf getting this Warring:
*WARNING* Cannot use DROP_OUT value of [] on this server, set to DROP
Can anyone help me.
BR

Hi i recently installed CSF on my new webuzo server , after installing all the requirements i have one error still remaining .

When i do a restart csf -r i get the following error

*WARNING* Cannot use DROP_OUT value of [] on this server, set to DROP

What does this mean? and if this is a problem i should worry about, how can i fix ?

Thank you.

This option can mask a users real IP address and hinder security. You should disable WHM > Tweak Settings > Proxy subdomains

This option in WHM doesn't seem to exist anymore or has since been renamed because I'm not able to find it. Very few results for proxy with none of them to do with what I'm actually looking for.

Any ideas?

Hello,

Since csf/lfd is very important for my server security, I would like with a monitoring script to ensure that csf and lfd are both running and operational. Is there a recommended way to do this ? I am running CentOS 7.
I am thinking about:
- either parsing the output of command systemctl status csf lfd and detect that they are active, and also running for lfd.
- either parsing the output...

Hi,

it seems that port knocking stopped working after updating to version 13.00 of CSF?

Rgs,
Christian

I have a site on a WHM/CentOS dedicated server using CSF. This 144.x.x.x server has a client who has a remote database on a different server (37.x.x.x) and he needs to connect his script from the local server over to that 37.x server using a remote MySQL connection.
Up until now all he gets when we try to connect is the error:

IP Be 144.x.x.xFailed to connect to MySQL: (2002) Connection...

An IP just got blocked by CSF

Temporary Blocks: IP:xx.xx.xx.xx Port: Dir:inout TTL:86400 (lfd - **(eximsyntax) Exim syntax errors from xx.xx.xx.xx** (US/United States/ipxx.xx.xx.xx.net): 10 in the last 3600 secs)

The to address in a recipient contains single quotation marks which seems to be the reason for blocks.

SMTP call from (user) :3312 dropped: too many syntax or protocol errors (last...

So I'm running the owasp modsecurity rules, but for some reason I cannot get CSF to block those IP's triggering the rules anymore.

I have LF_MODSEC set to 5, and I've even tried setting LF_CXS to 1, but the IP's just aren't getting blocked. Am I possibly missing something?

The server is receiving repeated connections which are like DOS attempts which seem to be generated from some exploit, possibly Android Stagefright, blocking IP addresses does not seem to help as new IPs appear everyday, this is resulting in heavy use of bandwidth. See sample logs below. Please advise how such connections can be blocked based on user agent or any other way. (i have disabled the...

The example shows (e.g. 192.168.254.0/24)

Is it possible to block say: 192. everything after that?

Like maybe: 192.0.0.0/8 which I think blocks 16 million IPs?

Hi,

I am trying to have CSF/LFD not alert about rpc. I've tried adding the following exe's to the csf.pignore file to no avail:

exe:/sbin/rpcbind
exe:/usr/sbin/rpc.statd

For some reason I am still being bombarded with this alert:

Executable:

/usr/sbin/rpcbind

Command Line (often faked in exploits):

/sbin/rpcbind -w

I also tried adding them as cmd: as well with no difference.... am I...

How can i add in ignore list? i have WHM with me i need guide.

Hi, in this day my server is under spam attack, for this reason i have activated a Gateway guard solution to my MX Records.
Some spam maybe are able to bypass MX record so continue to arrive on my inbox.

I need ask to the CSF Firewall to deny all IP except some IP who will be this MX Guard IP.
How i can do this?

Hi,

I am new here. I have been trying to find my answer through the search function on the forum but cannot find it.
I am blocking traffic from certain countries. Is it possible to redirect that traffic to a specific custom url ?

Thanks,
Marcus

What is the timeout for LFD UI to kick you out to the login screen? It seems very short, is there a way to change it? I tried to migrate some CSF settings from another server over and when I went to save it had already timed out and I had to start again. I did that twice before just saving after every 3rd setting....

csf can be configured so that when a client is blocked by ip itself site will display a message , (AS BEEN BLOCKED IP )

Hello,
We have a VPS with Centos 7.6 and Cpanel/WHM installed. We installed CSF and it worked great until some days ago. The interface in WHM doesn't load and it is showing a blank page.
In the error logs we fond the below:

Below you can find the error log from /usr/local/cpanel/logs/error_log:

warn The subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/configserver/csf.cgi) exited with an...